HealthSafe NZ Internal Audits Plan & Progress
Document identification
| Document Identification | HSNZ/SUBF/IAPP |
|---|---|
| Document Name | HealthSafe NZ Internal Audits Plan & Progress |
| Master Copy | CISO |
| Version Number | 3.1 |
| Date Of Release | 01 November 2024 |
| Prepared By | Eparama Tuibenau CISO |
| Approved by | Gideon Burke CEO |
Version history
| From | To | Prepared by | Approved by | Description | Date | Reason |
|---|---|---|---|---|---|---|
| 1 | 1 | CISO | MD | First Release | 14 April 2020 | No changes made |
| 1 | 1.1 | CISO | MD | Updated Release | 31 July 2020 | Updated audit plan |
| 1.1 | 2 | CISO | MD | Updated Release | 11 October 2021 | Updated format in tab 2021 |
| 2 | 3 | CISO & Sr. Tech BA | CEO | Updated Release | 01 November 2021 | Updated approver to new CEO. |
| 3 | 3.1 | CISO | CEO | Updated Release | 01 November 2024 | Reviewed |
Document status
| Date | Status |
|---|---|
| 14 April 2020 | Updated |
| 31 July 2020 | Updated |
| 11 October 2021 | Updated |
| 01 November 2024 | Current |
2024 – Internal audit plan and progress
| Date | ISO/IEC 27001:2022 Clauses | Person | Reason | Summary of Outcome | CAR # | Notes |
|---|---|---|---|---|---|---|
| 01 November 2024 | 5.3 Organisational roles, responsibilities, and authorities | CISO & Sr. Tech BA | An IA conducted to check if the current resources has refelected on the ISO policy's Organisational roles, responsibilities, and authorities alongside third party consultants (e.g. Lancom and Y5) as defined from the ISMS Policy's Section 5.3: Define different levels – Management Committee, ISMS Project Leader, ISMS Internal Auditor(s), Security Outsourcing etc | |||
| 01 November 2024 | A.9.2.5 Review of User Access Rights (Control) | CISO & Sr. Tech BA | An IA conducted to check if the control is conducted in a frequent manner besides existing controls, such as data purge processes, LastPass, MFA, and the Software/Repository Access Requisition Form process. |
2023 – Internal audit plan and progress
| Date | ISO/IEC 27001:2013 Clauses | Person | Reason | Summary of Outcome | CAR # | Notes |
|---|
2022 – Internal audit plan and progress
| Date | ISO/IEC 27001:2013 Clauses | Person | Reason | Summary of Outcome | CAR # | Notes |
|---|
| Date | ISO/IEC 27001:2013 Clauses | Person | Reason | Summary of Outcome | CAR # | Notes |
|---|---|---|---|---|---|---|
| 01 October 2021 | 5.2 Policy 5.3 Organisational roles, responsibilities and authorities |
CISO | Planned | |||
| 01 November 2021 | 4.3 Determining the scope of the information security management system 4.4 Information security management system |
CISO | Planned |
2020 – Internal audit plan and progress
| Date | Department/Area/Process | Person | Reason | Summary of Outcome | CAR # | Notes |
|---|---|---|---|---|---|---|
| May | - Password Management Policy - Physical Asset Management Policy |
- PW policy - All staff - Asset policy - Sam |
- PW policy - 2 - Asset policy - 1 |
- PW policy - Overall it was good, there were some staff who were struggling to get familiar with LastPass and some new staff joining so LastPass overview showed some had yet to sign up for LastPass and most security score pw based on the settings were weak. - Asset policy - Was ok, wasn't updated on a regular basis. |
||
| Jun | - Password Management Policy - IT Resource Request Policy - Physical Asset Management Policy - Antivirus Policy - Backup Policy |
- PW policy - All staff - IT resource request policy - Lucas, Fernando, Nick - Asset policy - Renee, Sam, Nick - Antivirus Policy - All staff, and server - Backup Policy |
- PW policy - 2 - IT Request Policy - 1 - Asset policy - 1 - Antivirus Policy - 2 - Backup Policy - 2 |
- PW policy - most staff have improved their scores from last month, some still outstanding. - IT Request Policy - Good - Asset policy - Good - Antivirus Policy - Good - Backup Policy - Good |
||
| 19 August 2020 | Department: All Area: Competence (7.2) and awareness (7.3) Process: A.7.2.2 Information security awareness, education and training |
Renee Parlane to carry out IA | To check that the corrective actions for NC2 were affective | |||
| 23 September 2020 | Department: All Area: Documented information (7.5) Process: 7.5.2 Creating and updating, 7.5.3 Control of documented information |
Lucas Baranovic to carry out IA | To check that the corrective actions for NC3 and NC4 were affective | |||
| 21 October 2020 | Department: Production Area: Actions to address risks and opportunities (6.1) Process: 6.1.1 General, 6.1.2 Information security risk assessment |
Gavin O'Hara to carry out IA | A random IA to check a process is still effective and fit for purpose |