Audit & Monitoring

Complete template

Need a complete template of this directive customized for your organization? Learn more ->

Version: 1.0 | Effective from: 1 January 2026

---

1. Purpose

This directive defines the requirements for audit, monitoring, and continuous improvement of the compliance programme.

---

2. Audit Programme

2.1 Types of audits

Type	Frequency	Scope	Conducted by
Internal audit	Quarterly	Rotating areas	Compliance Officer
External audit	Annually	Full ISMS	External auditor
Compliance check	Semi-annually	Regulatory requirements	DPO + CISO
Penetration test	Annually	Full scope	External vendor
Vulnerability scan	Monthly	All systems	IT Security

2.2 Internal Audit Programme

2.3 Audit Process

---

3. Continuous Monitoring

3.1 Security Monitoring

Area	Monitoring	Tool	Alert threshold
Authentication	Failed logins	SIEM	>5 failures / 10min
Access	Privileged access	PAM	Any admin access
Network	Traffic anomalies	IDS/IPS	Signature match
Endpoint	Malware detection	EDR	Any detection
Application	Error rates	APM	>1% error rate
Data	Sensitive data access	DLP	Any PII export

3.2 Compliance Monitoring

Regulation	Metric	Target	Measurement
AI Act	AI inventory completeness	100%	Quarterly
AI Act	High-risk AI documentation	100%	Monthly
NIS2	Patch compliance	>95%	Monthly
NIS2	Incident response time	<4h (critical)	On incident
GDPR	DSAR response time	<30 days	Per DSAR
GDPR	Breach notification	<72h	On breach

3.3 Monitoring Dashboard

COMPLIANCE DASHBOARD

OVERALL COMPLIANCE SCORE: 78%

Regulation	Score
AI Act	65%
NIS2	72%
GDPR	85%

OPEN FINDINGS: Critical: 2 | High: 5 | Medium: 12

RECENT ACTIVITY:

• [Today] Security scan completed - 3 new vulnerabilities
• [Yesterday] DSAR-2026-045 closed
• [2 days ago] AI-003 risk assessment updated

---

4. Key Performance Indicators

4.1 Security KPIs

KPI	Target	Current	Trend
Patch compliance (critical)	>99%
Patch compliance (high)	>95%
MFA adoption	100%
Phishing click rate	<5%
Mean time to detect (MTTD)	<1h
Mean time to respond (MTTR)	<4h

4.2 Privacy KPIs

KPI	Target	Current	Trend
DSAR response time	<30 days
DSAR compliance rate	100%
Data mapping accuracy	>95%
DPA coverage	100%
Privacy training completion	100%

4.3 AI Governance KPIs

KPI	Target	Current	Trend
AI inventory completeness	100%
Risk classification coverage	100%
High-risk AI documentation	100%
Bias testing frequency	Monthly
AI incident rate	<1/quarter

---

5. Risk Register

5.1 Risk Register Template

Risk ID	Description	Category	Likelihood	Impact	Score	Status	Mitigation
RISK-001		AI/NIS2/GDPR	1-5	1-5	LxI	Open/Mitigated

5.2 Risk Review Process

Frequency	Activity
Weekly	New risks identification
Monthly	Risk register review (CISO + DPO)
Quarterly	Risk treatment plan update (C-level)
Annually	Full risk assessment refresh

5.3 Risk Acceptance

Risk acceptance criteria:

Risk Score	Acceptance	Approval
1-5 (Low)	Automatic	Risk owner
6-12 (Medium)	With mitigation	CISO/DPO
13-20 (High)	Exceptional	CTO + CEO
21-25 (Critical)	Never	N/A

---

6. Reporting

6.1 Report Schedule

Report	Audience	Frequency
Security metrics	IT Management	Weekly
Compliance status	C-level	Monthly
Risk register	Board	Quarterly
External audit	Board + Regulators	Annually

6.2 Monthly Compliance Report Template

MONTHLY COMPLIANCE REPORT — MONTH YYYY

1. EXECUTIVE SUMMARY — Overall compliance: XX% | Key highlights: […] | Key concerns: […]
2. REGULATORY COMPLIANCE — AI Act: XX% | NIS2: XX% | GDPR: XX%
3. SECURITY METRICS — Incidents: X | Vulnerabilities: X | Patch compliance: XX%
4. PRIVACY METRICS — DSARs: X | Avg response: X days | Breaches: X
5. OPEN FINDINGS — [List of critical/high findings]
6. UPCOMING — [Key deadlines and activities]
7. RECOMMENDATIONS — [Actions for management]

---

7. Continuous Improvement

7.1 PDCA Cycle

7.2 Lessons Learned

After each incident or audit:

1. Document — What happened
2. Analyze — Root cause
3. Identify — What to improve
4. Implement — Changes
5. Verify — Effectiveness

7.3 Improvement Register

ID	Source	Description	Status	Deadline
IMP-001	Incident
IMP-002	Audit

---

8. Documentation Requirements

8.1 Retention Schedule

Document	Retention	Note
Audit reports	5 years	After audit cycle ends
Compliance evidence	5 years	For regulatory inspections
Risk assessments	5 years	After validity expires
Training records	3 years	After employee departure
Meeting minutes	3 years
Metrics data	2 years	For trend analysis

---

9. Tools & Systems

9.1 Recommended Tools

Category	Tool	Purpose
GRC	OneTrust, ServiceNow	Compliance management
SIEM	Splunk, Elastic, Sentinel	Security monitoring
Vulnerability	Qualys, Nessus, Tenable	Scanning
DLP	Microsoft Purview, Symantec	Data protection
PAM	CyberArk, BeyondTrust	Privileged access
Training	KnowBe4, Proofpoint	Security awareness

---

10. Policy Review

• Monthly: Security metrics review
• Quarterly: Audit findings review, risk register update
• Semi-annually: Policy effectiveness assessment
• Annually: Full policy review + external audit

Next review: Q2 2026