Skip to content
Keel Docs

Audits & management review

Internal audit programme in Keel

Auditing the ISMS and reviewing it with leadership are the two clauses that prove the system is actually being run, not just documented. Keel covers both, and the audit programme keeps them on a cadence. These modules are shared by ISO 27001 and ISO 9001.

Internal audits (Clause 9.2)

Section titled “Internal audits (Clause 9.2)”

In Internal audits, plan an audit with a title, the framework you’re auditing, an auditor, a planned date, and a scope. Keel generates a clause-by-clause checklist from that framework, grouped into sections. Work down it and record a result against each clause:

  • Conforming, Nonconformity, Observation, or Opportunity (OFI), each with a note.

An audit moves Planned → In progress → Completed. The header tallies clauses reviewed, conformities, nonconformities, and observations/OFIs. When you record a nonconformity finding, raise it into the CAPA register in one click — Keel creates a linked nonconformity (source: audit) and back-links the finding. Add an overall conclusion, then Download audit report (PDF) for an auditor-ready record.

Audit programme & calendar (Clause 9.2.2)

Section titled “Audit programme & calendar (Clause 9.2.2)”

Clause 9.2.2 asks you to plan a programme of audits over time. In Audit programme, create a programme (a period and its objectives), then schedule audits by process or area, each with an auditor, a planned date, and an optional recurrence cadence that auto-rolls the next occurrence forward once done.

An Upcoming & overdue view spans every programme and flags each schedule as Overdue, Due soon (≤30 days), or on track. When it’s time, launch a scheduled audit straight into a full internal audit.

Management review (Clause 9.3)

Section titled “Management review (Clause 9.3)”

In Management reviews, schedule a review with a chair, date, and attendees. Keel pre-fills the agenda inputs live from your program:

  • open / total nonconformities,
  • completed / total internal audits and open audit findings,
  • open (and high-severity open) security incidents,
  • framework readiness percentages.

Record minutes, decisions & outputs, and action items (owner, due date, done), then Download minutes (PDF). A review moves between Draft and Completed.

Next steps

Section titled “Next steps”