Information Security Management System (ISMS) Audit
PURPOSE
The HIC Services External Audit is commissioned by the HIC Governance Committee and is carried out annually by an external auditing company. The audit includes a review of operating standards, documentation, Standard Operating Procedures, systems, facilities, and projects for compliance with conditions of approval (by Caldicott Guardian, Ethics Committee and other authorities) and requirements of UK data protection legislation. The audit is carried out at the Health Informatics Centre located in Ninewells Hospital.  Â
HIC also receives a second annual external audit involving an external penetration test of HIC’s Safe Haven environment and IT systems, to check for system security vulnerabilities. Â
This SOP describes procedures to follow-up and resolve actions raised in the audit reports and the routine internal audits carried out more widely across HIC processes to provide information on whether HIC Services’ Information Security Management System (ISMS) is being effectively implemented, maintained, and followed.
SCOPE
This SOP covers the HIC’s response to external HIC audits and wider routine internal audits. It is applicable to all HIC staff. This SOP is made available to all users and potential users of the HIC Service and will be externally visible on the public HIC website. Â
RESPONSIBILITIES
ROLE | RESPONSIBILITY |
Auditor | Carries out assigned internal or external audit |
All Staff | Responsible for actions assigned from audit report |
Governance Manager | Responsible for assigning responsibility and ensuring remedial action is taken from audit reports |
PROCEDURE
Policy
For overall Policy see Legal and Governance Policy.Â
External Audit Steps
HIC Services will receive 2 external audits annually, one an IT System Penetration test and the other a wider audit of HIC Processes and Procedures.  Â
Once the external audits have taken place and the Auditor reports are received by HIC Services, they will be circulated to the Chair of the HIC Information Governance Committee and the HIC Services Executive Committee. They are subsequently discussed, along with HIC’s response, at the HIC Information Governance Committee meeting.  Â
All action points raised will then be taken from the audit reports and inputted to the HIC Services PM system which allows the progress of each point to be monitored until complete, with space for additional comments and updates.  Each action will be assigned to the appropriate member of staff, with a completion deadline, who will then carry out the remedial work needed. Â
Internal Audit StepsÂ
A quarterly internal audit plan of HIC’s Information Security Management System (ISMS) will be prepared in advance, covering a 12-month period, to ensure that HIC’s ISMS is conforming to the International Standard requirements and is being effectively implemented and maintained. Â
Individual audits are planned, including methods, responsibilities, and reporting; and a scope of audit agreed with the Team Leader as appropriate. Â
Audits are carried out throughout the year, following the audit plan, by staff independent of the work being audited, or by external auditors employed for the purpose. Â
Previously issued corrective/preventative action requests are reviewed at audits and entered, where appropriate, onto the audit plan. Â
The internal audit results, including target implementation dates for completion of corrective/preventative action, will be recorded centrally, and reported to the HIC Governance Manager who is then responsible for assigning responsibility and ensuring remedial action is taken. The results of audits are presented for discussion at the HIC Executive Committee meeting. Â
APPLICABLE REFERENCES
Security Policy
Standard Operating Procedures
For Definitions see ISMS Glossary
DOCUMENT CONTROLS
Process Manager | Point of Contact |
---|---|
Jenny Johnston |
Revision Number | Revision Date | Revision Made | Revision By | Revision Category | Approved By | Effective Date |
---|---|---|---|---|---|---|
1.0 | 01/01/24 | Moved SOP to Confluence from SharePoint and updated into new template | Bruce Miller and Symone Sheane | Superficial | Governance Co-Ordinator: Symone Sheane | 10/01/24 |
1.1 | 04/04/24 | Updated Roles and Responsibilities | Bruce Miller | Superficial | Governance Co-Ordinator: Symone Sheane | 5/04/24 |
1.2 | 10/04/24 | Formatted document controls table and added in revision category. Added in roles and responsibilities table. | Symone Sheane | Superficial | Governance Co-Ordinator: Symone Sheane | 10/04/24 |
1.3 | 19/04/24 | Updated Approved by title | Symone Sheane | Superficial | Governance Co-Ordinator: Symone Sheane | 19/04/24 |
1.4 | 30/04/24 | Updated Header to conform with BSI guidelines | Bruce Miller | Superficial | Governance Co-Ordinator: Symone | 30/04/24 |
Copyright Health Informatics Centre. All rights reserved. May not be reproduced without permission.
All hard copies should be checked against the current electronic version within current versioning system
prior to use and destroyed promptly thereafter. All hard copies are considered Uncontrolled documents.