ISMS Audit Expert — Security & Safety

ISMS Audit Expert is a skill for managing ISO 27001 internal and external audits, including audit program planning, control assessment, finding management, and certification support. It provides structured workflows, templates, and guidance to help users conduct thorough security audits and prepare for certification.

ra-qm claude-code

📂 View skill on GitHub ↗ 🚀 How to use

✨ What it does

Provides risk-based audit scheduling with frequencies based on risk levels.
Guides pre-audit preparation and audit execution steps.
Offers control testing approach and evidence collection methods.
Classifies findings into major/minor nonconformities and observations with response times.
Includes templates for documenting findings and corrective action workflows.
Supports certification preparation with checklists for Stage 1 and Stage 2 audits.

🎯 When to use it

When planning or executing an ISO 27001 internal audit.
When assessing security controls against Annex A requirements.
When preparing for Stage 1 or Stage 2 certification audits.
When managing audit findings and corrective actions.
When creating risk-based audit schedules.

🚀 How to use

Trigger the skill by mentioning ISO 27001 audit, ISMS audit, or related terms. Provide context such as audit scope, controls to assess, or certification stage. The skill will guide you through planning, execution, and reporting. Example prompts:

Help me plan an internal ISO 27001 audit for our IT department.
I need to prepare for a Stage 1 certification audit. What documentation is required?

📄 Output: The skill produces audit plans, checklists, finding documentation templates, and corrective action workflows.

📦 Add this skill to Claude Code

# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills

# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/ra-qm-team/skills/isms-audit-expert .claude/skills/isms-audit-expert

Skill source: ra-qm-team/skills/isms-audit-expert/SKILL.md

⚠️ Good to know

The skill provides guidance and templates but does not replace the need for qualified auditors and actual evidence collection.

❓ FAQ

What is the difference between a major and minor nonconformity?

A major nonconformity is a control failure creating significant risk, requiring response within 30 days. A minor nonconformity is an isolated deviation with limited impact, requiring response within 90 days.

How often should critical risk controls be audited?

Critical risk controls should be audited quarterly, as per the risk-based audit schedule.

What are the prerequisites for a Stage 2 audit?

The ISMS must be operational for at least 3 months, all Stage 1 findings addressed, and evidence of control implementation and training records available.

🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.