Internal Audit Program

Audit Management

Manage your ISMS audit program in the same system where your controls actually run.

Try Kordon for Free
Kordon control detail view showing an internal audit task with connected framework requirements and evidence
How it works

From ad-hoc audit prep to a continuous audit program

ISO 27001 Clause 9.2 requires organisations to conduct internal audits at planned intervals. SOC 2 requires periodic control reviews. NIS2 requires documented assurance. Kordon makes the program operational — not a once-a-year documentation project that happens the month before your certification auditor arrives.

01

Map the controls that need auditing

Start with the controls in your ISMS. Decide which ones need formal audit tasks, how frequently, and who performs them. High-risk controls can run quarterly audit tasks; lower-risk ones annually. You set the cadence that matches your audit plan — Kordon maintains it from there.

02

Run audits as part of normal security work

Audit tasks sit alongside maintenance and review tasks on the same controls. When an audit task comes due, the assignee reviews the relevant evidence, records a verdict — OK or Not OK — and attaches their findings. The control status updates immediately. The audit record stays in the system, attached to the control it tested.

03

Manage findings without losing context

When an audit identifies a gap, create a nonconformity (NCR) or opportunity for improvement (OFI) directly in Kordon. The finding connects to the failed control, the risk it evidences, and the requirement it maps to. Convert it into a remediation task with a named owner and a deadline — tracked to closure in the same system.

04

Arrive at certification already prepared

Because evidence builds throughout the year as tasks are completed — not in a three-week scramble before the auditor arrives — audit preparation becomes evidence review, not evidence hunting. Give your certification auditor read-only access and walk into your certification audit knowing the trail is there.

Audit management built into your ISMS

From recurring audit tasks to real auditor access

Every audit management tool in this market is built for enterprise internal audit departments running SOX and operational audits. Kordon is built for the security manager who manages, executes, and evidences their own information security audit program — without a separate audit tool, a dedicated audit department, or a platform that costs more than your entire security budget.

Audit tasks built into controls

Schedule recurring internal audit tasks directly on the controls they test. Choose the type — Audit, Review, or Maintenance — and set the frequency that fits your ISO 27001 or SOC 2 audit cycle. Audit tasks run on a schedule that never drifts, assigned to the person actually responsible for the control. <a href="/control-management/">How control management works in Kordon →</a>

Controls go Failing when audits fail

When an audit task returns a "Not OK" verdict, the connected control immediately moves to Failing status. The risks that control was mitigating reflect the change at once — no manual update, no reconciliation between what your audit found and what your risk register shows. Real accountability, not a status field you remember to update.

Read-only access for certification auditors

Give your ISO 27001 certification auditor, external reviewer, or internal audit function direct read-only access to see controls, tasks, completed evidence, and risk context at exactly the level of detail they need — without a full Kordon user account. No document pack to compile. No email chain of attachments. They see the program as it actually is.

Evidence accumulates continuously, not pre-audit

Evidence is captured as tasks are completed throughout the year — attached to the task that generated it, traceable to the control it maintains and the requirement it satisfies. When your auditor arrives, the evidence is already there. Kordon customers report reducing audit preparation time by up to 80%. <a href="/case-studies/case-study-migrating-from-vanta-with-qminder/">See how Qminder cut audit prep time →</a>

Audit findings with full traceability

Nonconformities and opportunities for improvement raised during an internal audit connect directly to the control that failed, the risk it evidences, and the framework requirement it violates. Remediation tasks flow from the finding with an assigned owner and deadline — not into a separate issue tracker that loses context the moment it's detached from the audit. <a href="/findings-management/">How findings management works in Kordon →</a>

One audit program across every framework

A control tested for ISO 27001 simultaneously satisfies the equivalent requirement in SOC 2, NIS2, or DORA. Maintain one internal audit program, one evidence trail, and one set of control statuses — across every framework your organisation needs to demonstrate compliance with. <a href="/frameworks/">Multi-framework management in Kordon →</a>

Common questions

Audit management software, answered

What is audit management software?

Audit management software helps organisations plan, schedule, execute, and document audits — and track findings through to remediation. For information security teams, this means managing the internal audits required by ISO 27001 (Clause 9.2), SOC 2, and NIS2: scheduling recurring control tests, collecting and linking evidence, recording nonconformities, and maintaining a clear audit trail for certification auditors. In Kordon, audit management is built into the same platform as your controls, risks, and tasks — not a separate tool that needs to stay in sync with your ISMS.

How is Kordon different from enterprise internal audit software?

Enterprise internal audit tools like AuditBoard, TeamMate+, and Workiva are designed for Chief Audit Executives running dedicated internal audit teams — typically auditing financial controls, operational processes, and SOX compliance. They manage the audit as a standalone workflow, separate from the controls and risks those audits are actually testing. Kordon is purpose-built for information security audit management: the security manager running their own ISO 27001 or SOC 2 internal audit program as part of a broader ISMS role. In Kordon, an audit task lives on the control it tests, an audit failure immediately updates that control's status, and findings stay connected to the risk and requirement they map to. The audit program and the ISMS run as one system — not two systems you have to keep in sync.

Does ISO 27001 require internal audits, and how does Kordon support them?

Yes. ISO 27001 Clause 9.2 requires organisations to conduct internal audits at planned intervals to determine whether the ISMS conforms to requirements and is being effectively implemented and maintained. In Kordon, internal audits are modelled as Audit-type tasks on controls. When an audit task is completed with a "Not OK" verdict, the control moves to Failing status and connected risks update immediately. Evidence from completed audit tasks stays attached to the control — so when your certification auditor reviews the audit record, the full trail is already there.

How much does audit preparation time reduce when using Kordon?

Kordon customers report reducing audit preparation time by up to 80% compared to spreadsheet-based audit management. The primary reason is continuous evidence accumulation: evidence is captured when tasks are completed throughout the year — attached directly to the tasks that generated it — so there is no manual evidence-gathering phase before the audit. Audit preparation becomes reviewing what is there, not assembling it from emails, shared drives, and faded memory.

Can external auditors access Kordon directly?

Yes. Kordon supports read-only auditor access, which allows your ISO 27001 certification auditor, external reviewer, or internal audit function to browse controls, view completed tasks and their evidence, check risk connections, and navigate the program's structure — without a full user account. This eliminates the need to compile an audit evidence pack or manage an email exchange of attachments. The auditor sees the program in the same system that runs it.

Is Kordon available as an on-premises deployment for audit-sensitive environments?

Yes. Kordon can be deployed on-premises inside your own infrastructure when internal hosting policy, data boundary requirements, or regulatory constraints mean that audit data and security program information cannot be sent to a vendor-hosted cloud environment. On-premises deployment gives you the same connected audit model — tasks, evidence, findings, control status — running entirely within the environment you control. Most GRC platforms are SaaS-only; on-premises is a Kordon differentiator for organisations in regulated sectors. On-premises GRC platform →

Arrive at every audit already prepared.

Try Kordon for Free