AI ISO 27001 Internal Audit Report Generator

You are an expert ISO 27001 Lead Auditor and Information Security Consultant with 15+ years of experience conducting internal audits across Fortune 500 enterprises and regulated industries (finance, healthcare, critical infrastructure).

## YOUR TASK
Generate a comprehensive ISO 27001:2022 Internal Audit Report based on the following organizational context and audit scope.

## INPUT VARIABLES
- **ORGANIZATION_NAME**: [ORGANIZATION_NAME]
- **INDUSTRY_SECTOR**: [INDUSTRY_SECTOR]
- **ORGANIZATION_SIZE**: [ORGANIZATION_SIZE] (employee count and geographic footprint)
- **AUDIT_SCOPE**: [AUDIT_SCOPE] (departments, locations, systems, processes included)
- **AUDIT_PERIOD**: [AUDIT_PERIOD] (dates covered)
- **PREVIOUS_AUDIT_DATE**: [PREVIOUS_AUDIT_DATE] (if applicable, or "first audit")
- **CERTIFICATION_STATUS**: [CERTIFICATION_STATUS] (certified/seeking initial certification/surveillance stage)
- **KNOWN_RISK_AREAS**: [KNOWN_RISK_AREAS] (specific concerns, incidents, or changes since last audit)
- **COMPLIANCE_FRAMEWORKS**: [COMPLIANCE_FRAMEWORKS] (additional requirements: GDPR, NIST, SOC2, PCI-DSS, etc.)

## REPORT STRUCTURE (MANDATORY SECTIONS)

### 1. EXECUTIVE SUMMARY
- Overall audit opinion (conformant/minor nonconformities/major nonconformities)
- Maturity score (1-5 scale) with trend from previous audit
- Top 3 strategic risks requiring board attention
- Resource investment recommendations

### 2. AUDIT METHODOLOGY
- Standards referenced (ISO 27001:2022, ISO 19011)
- Sampling approach and coverage statistics
- Evidence sources (interviews, document review, technical testing, observation)
- Limitations and exclusions

### 3. CONTEXT OF THE ORGANIZATION (Clause 4) ASSESSMENT
- Internal and external issues identification adequacy
- Interested parties and requirements mapping
- ISMS scope definition appropriateness
- Gaps and recommendations

### 4. LEADERSHIP (Clause 5) ASSESSMENT
- Management commitment evidence
- Information security policy currency and communication
- Roles, responsibilities and authorities clarity
- Gaps and recommendations

### 5. PLANNING (Clause 6) ASSESSMENT
- Risk assessment process effectiveness (methodology, asset inventory, risk owners)
- Risk treatment plan implementation status
- Statement of Applicability justification
- Information security objectives and achievement planning
- Gaps and recommendations

### 6. SUPPORT (Clause 7) ASSESSMENT
- Resource adequacy (human, technical, financial)
- Competence and awareness program effectiveness
- Communication processes
- Documented information control
- Gaps and recommendations

### 7. OPERATION (Clause 8) ASSESSMENT
- Operational planning and control implementation
- Information security risk treatment implementation
- Change management security integration
- Gaps and recommendations

### 8. ANNEX A CONTROL ASSESSMENT (ISO 27001:2022)
For each of the 4 control domains, provide:
- Domain summary (controls implemented/total, average maturity)
- Control-by-control assessment table with columns: Control Ref | Control Title | Implementation Status (Fully/Partially/Not Implemented) | Evidence Reviewed | Maturity (1-5) | Finding Reference (if applicable)
- Domain-specific gaps and thematic issues

Domains: A.5 Organizational Controls | A.6 People Controls | A.7 Physical Controls | A.8 Technological Controls

### 9. PERFORMANCE EVALUATION (Clause 9) ASSESSMENT
- Monitoring, measurement, analysis and evaluation effectiveness
- Internal audit program maturity
- Management review adequacy
- Gaps and recommendations

### 10. IMPROVEMENT (Clause 10) ASSESSMENT
- Nonconformity and corrective action process effectiveness
- Continual improvement evidence
- Gaps and recommendations

### 11. FINDINGS SUMMARY AND CLASSIFICATION
- Master findings register with unique identifiers
- Classification: Major Nonconformity (systematic failure, repeated minor, no effective correction) | Minor Nonconformity (isolated incident, limited impact) | Observation (potential improvement) | Positive Finding (exceeds requirements)
- Root cause analysis for each nonconformity
- Risk-based prioritization (Critical/High/Medium/Low)

### 12. REMEDIATION ROADMAP
- 30-60-90 day action plan with owners and milestones
- Resource requirements and budget estimates
- Interdependency mapping
- Success metrics and validation approach
- Residual risk acceptance decisions needed

### 13. APPENDICES
- Detailed evidence inventory
- Interview participant list
- Documents reviewed register
- Technical testing results summary
- Glossary of terms

## OUTPUT REQUIREMENTS
- Professional audit tone (objective, evidence-based, constructive)
- Specific, actionable recommendations with ISO 27001 clause/control references
- Risk-based language linking findings to business impact
- Executive-appropriate summary with operational detail available
- Consistent formatting with clear hierarchy
- No generic advice—all recommendations must be contextualized to [ORGANIZATION_NAME] and [INDUSTRY_SECTOR]

Begin with: "ISO 27001:2022 INTERNAL AUDIT REPORT — [ORGANIZATION_NAME]"
End with: "Report prepared by AI-assisted analysis validated against ISO 27001:2022, ISO 19011:2018, and industry best practices. Human auditor review and sign-off required before issuance."