Skip to content
Keel Docs

Audits & management review

Internal audit programme in Keel

Auditing the ISMS and reviewing it with leadership are the clauses that prove the system is actually being run, not just documented. Keel covers both, and the audit programme keeps them on a cadence. These modules are shared by ISO 27001 and ISO 9001.

Internal audits (Clause 9.2)

Section titled “Internal audits (Clause 9.2)”

In Internal audits, plan an audit with a title, the framework you’re auditing, an auditor, a planned date, and a scope. Keel generates a clause-by-clause checklist from that framework, grouped into sections. Work down it and record a result against each clause:

  • Conforming, Nonconformity, Observation, or Opportunity (OFI), each with a note.

An audit moves Planned → In progress → Completed. The header tallies clauses reviewed, conformities, nonconformities, and observations/OFIs. When you record a nonconformity finding, raise it into the CAPA register in one click. Keel creates a linked nonconformity (source: audit) and back-links the finding. Add an overall conclusion, then Download audit report (PDF) for an auditor-ready record.

CAIQ self-assessment

Section titled “CAIQ self-assessment”

You can run the Cloud Security Alliance’s Consensus Assessments Initiative Questionnaire (CAIQ) as an internal audit. In Internal audits, open Run a CAIQ self-assessment and upload your copy of the CAIQ workbook (.xlsx, as downloaded from the CSA website). Keel reads the questions from your file and makes each one a checklist item, grouped by CCM domain. Keel does not include the CAIQ itself: CSA’s notice on the workbook allows personal, informational, non-commercial use and does not allow redistribution. If your file already has answers filled in, they carry over.

For each question, record:

  • the answer: Yes, No, or N/A,
  • the SSRM control ownership (CSP-owned, CSC-owned, 3rd-party outsourced, or shared),
  • an implementation description and any customer responsibilities,
  • one piece of workspace evidence that backs the answer.

Filter to Unanswered or Answered No to work through the list. A No counts as a nonconformity, so you can raise it into CAPA the same way as any other audit finding.

When you Mark complete, Keel does two things:

  • adds every Yes and No answer, with its implementation description, to your answer library, so Questionnaire Assist can reuse them on customer security questionnaires;
  • saves your CAIQ file, with the answers written in, to Evidence, if file storage is set up and your plan’s storage has room. When it does not, the audit still completes and the answers are still banked.

Your CAIQ file, answered

Section titled “Your CAIQ file, answered”

Download your CAIQ file, answered returns the workbook you uploaded with your answers written into its CSP CAIQ Answer, SSRM Control Ownership, CSP Implementation Description and CSC Responsibilities columns. Everything else in the file stays as CSA published it: the other tabs, the drop-downs, the formatting and the copyright notice. That is the file you submit to the CSA STAR Registry for a Level 1 self-assessment.

Keel matches each answer to its row by Question ID. A question you have not answered keeps whatever your file had, and a cell that holds a formula is never overwritten.

Keel keeps your upload in your workspace’s file storage for this, and deletes it when you delete the audit. An audit imported before Keel kept uploads does not offer this download; import the file again to get it.

Download answers (.xlsx) gives you a plain sheet with only the question and answer columns, plus the linked evidence and CSA’s copyright notice from your upload.

Audit programme & calendar (Clause 9.2.2)

Section titled “Audit programme & calendar (Clause 9.2.2)”

Clause 9.2.2 asks you to plan a programme of audits over time. In Audit programme, create a programme (a period and its objectives), then schedule audits by process or area, each with an auditor, a planned date, and an optional recurrence cadence that auto-rolls the next occurrence forward once done.

An Upcoming & overdue view spans every programme and flags each schedule as Overdue, Due soon (≤30 days), or on track. When it’s time, launch a scheduled audit straight into a full internal audit.

Management review (Clause 9.3)

Section titled “Management review (Clause 9.3)”

In Management reviews, schedule a review with a chair, date, and attendees. Keel pre-fills the agenda inputs live from your program:

  • open / total nonconformities,
  • completed / total internal audits and open audit findings,
  • open (and high-severity open) security incidents,
  • framework readiness percentages.

Record minutes, decisions & outputs, and action items (owner, due date, done), then Download minutes (PDF). A review moves between Draft and Completed.

Next steps

Section titled “Next steps”