Clause 9: Performance evaluation

1. A list of what you measure: what, how, when, who measures and who reviews the results.
2. Measurement results such as dashboards or monthly reports.
3. Proof results were reported at management review.
4. Be able to explain what a result means and what was done about it.

1. Information security objectives plan
2. Human Resource Security Policy

1. Your internal audit plan covering the whole programme over a set period.
2. Internal audit reports with clear results.
3. Proof findings were fixed.
4. Be able to explain how audits are scheduled.

Internal audit procedure

1. Your audit programme: frequency, methods, responsibilities and reporting.
2. Records showing auditors were independent of the work they checked.
3. Proof audit results reached the relevant managers.
4. Be able to explain how auditors are chosen.

Internal audit procedure

1. Your management review schedule.
2. Meeting minutes showing the review happened as planned.
3. Attendance records showing top management took part.
4. Leadership should be able to explain the main outcomes.

1. Management review procedure
2. Risk Management Policy

1. Your management review agenda covering all required topics.
2. Minutes showing each topic was discussed, including changes in issues and interested parties, results of measures, audits, incidents and feedback.
3. Input packs or reports prepared for the meeting.
4. Be able to explain how inputs are gathered.

Management review procedure

1. Your management review minutes with decisions and actions.
2. Actions with owners and deadlines, and proof of progress.
3. Decisions on changes to the programme and resources needed.
4. Be able to explain what changed because of the last review.

Management review procedure