Internal Audit

[kitty]

Hi!

I would like to ask what would be the scope of internal audit for BS7799?

Is this the following:
DOcumented
SOA
COP
BCP
DRP
Infosec Policy
Risk Assesment - Frequency

And what are the things to be documented?

And If there is an internal audit procedure for BS7799, can I have a copy?

Is the first part of the BS7799 which is the standard, will be this audited?
And how about the second part which is the controls? will this be audited?

Is there any available complete checklist?

Sorry for asking and requesting many things....hope for reply
Thank you.

[Padgetto]

I don't know if you are in the UK but we are holding a series of BS7799 breifings which, will answer your questions. You will also have direct access to BS7799 consultants that have taken a varity of diffrent organisations through the standard.

Please see http://www.ecsc.co.uk/7799brief.html

Hope this helps.

Padgetto

[chaitanyakunthe]

The scope for internal audit has to be mentioned in the policy. The scope would be the same as the scope for which you are certified on BS7799

Also you will be audited on part 2 of the standard, not part 1. Part 2 is the auditable part.

Yes, there is a checklist. There is a PD document called 'Are you ready for Certification'. This doc gives you a complete checklist.

[Arviragus]

I have a flowchart, plan template, audit schedule and methodology. Contact me at arviragus at gmail dot com.