{"catalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","download":{"releaseId":"sha256:58b6da1ad83d634bb57b1df5b9cdc890aaded75096ac52a7c7d541c7f7a600cf","slug":"controls-isms-internal-audit-management-review","url":"/controls/assets/agent_workflow-controls-isms-internal-audit-management-review-777a9fb7.dcefa96b82cee12e.json"},"kind":"record","record":{"attributes":{"department":"internal-audit","domain":"controls","lineOfDefense":"assure"},"canonicalUrl":"https://assureswarm.com/workflows/all/?w=controls-isms-internal-audit-management-review","description":"Runs one ISO 27001 clause 9.2 internal audit and clause 9.3 management review cycle — including clause 10.1 corrective actions — against the existing Audit item for this cycle (audit_type=internal), whose scope, lead_auditor, and period dates already carry the ISMS audit-programme entry: the workflow enriches that Audit item and its findings, never creates a duplicate audit. Upstream it consumes the Annex A control population (Control items, framework iso-27001) and the applicability decisions in the Statement of Applicability, the risk register (Risk items) and treatment plan, the prior-cycle Audit and open Issue records, and the org's ISMS policies and procedures (Policy items) as audit criteria. Named deliverables: the internal audit findings report, the clause 10.1 corrective-action records (recorded on the finding Issue items), the management review pack, and the approved clause 9.3 minutes and action register. Out of scope: the certification-body external audit and day-to-day control operation. No upstream workflow feeds this cycle and no single downstream workflow consumes its output; at close the cycle is archived on the Audit item as retained ISMS documented information, and carry-forward items re-enter the audit programme (the next PLANNED Audit item), the risk register, or the next review's inputs.","details":{"canonicalUrl":"https://assureswarm.com/workflows/all/?w=controls-isms-internal-audit-management-review","capabilities":[],"controls":["UC-AUDIT-23","UC-AUDIT-22","UC-GOV-15","UC-AUDIT-17"],"domains":["controls"],"lineOfDefense":"assure","mappingStatus":"mapped","releaseId":"sha256:58b6da1ad83d634bb57b1df5b9cdc890aaded75096ac52a7c7d541c7f7a600cf","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[{"code":"reliance-basis-incomplete","message":"Template-design warning: material reliance is mapped without a tagged step covering the full provider-reliance basis.","missing":["independence","competence","evidence","recency","reliance rationale"],"nodeIds":[],"title":"Reliance basis is incomplete"}]},"sourceTemplateId":"workflow-library:controls-isms-internal-audit-management-review","standards":["iso-27001"],"teams":["internal-audit","it","executive"]},"id":"wf:C16","mapUrl":"https://assureswarm.com/controls/?v=1&node=wf%3AC16","slug":"controls-isms-internal-audit-management-review","sourceIds":["ccpa","cobit-2019","iia-2024","iia-pos-2026-three-lines","iso-27001","nist-800-53","nist-csf-2","nydfs-500"],"sourceUrl":null,"title":"ISMS Internal Audit & Management Review","type":"workflow"},"relationships":[{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:10ab744fc2f05812744d0be837bb31e3211af44a5d3e5027b8455f310249bb3a","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-c16-5cfe940e.json","sourceId":"wf:C16","targetDetailPath":"/controls/data/v1/records/uc-uc-audit-23-124d94d5.json","targetId":"uc:UC-AUDIT-23","type":"operates"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:1f5e6e3ef31d711591300f8333a8d8a43e3ab33422eedfb367446e0322e6c4dd","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-c16-5cfe940e.json","sourceId":"wf:C16","targetDetailPath":"/controls/data/v1/records/uc-uc-audit-17-94dc7e0c.json","targetId":"uc:UC-AUDIT-17","type":"operates"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:33d51243e984b04bf8fb218c8b2ed38b30dbb83cb52c23a35adca03134ce4b64","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-c16-5cfe940e.json","sourceId":"wf:C16","targetDetailPath":"/controls/data/v1/records/uc-uc-gov-15-828b3eec.json","targetId":"uc:UC-GOV-15","type":"tests"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:4bde47f051fc342b2775a938985e32c5291436fa9a3c1d345163b4af1bab572e","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-c16-5cfe940e.json","sourceId":"wf:C16","targetDetailPath":"/controls/data/v1/records/uc-uc-audit-22-2a70149b.json","targetId":"uc:UC-AUDIT-22","type":"operates"}],"schemaVersion":1}