Internal audit NEN 7510: approach in the healthcare context

The internal audit is a mandatory part of NEN 7510 and your final check before the external auditor from an accredited certification body visits. In the healthcare context, the internal audit is also an opportunity to test whether your measures really fit daily care practice. Carry out the step-by-step plan first so that your ISMS is in place, then plan the internal audit.

The standard requires that the internal audit is carried out by someone who is independent of the processes being audited. You cannot audit your own work. In small organisations, this calls for a creative but legitimate solution.

Why is the internal audit mandatory?

NEN 7510-1 (clause 9.2) requires your organisation to carry out internal audits at planned intervals. The purpose is twofold: to check whether the ISMS meets the requirements of the standard, and to check whether it is effectively implemented.

For the external auditor, the internal audit report is crucial evidence. It shows that you take your own system seriously and that you know where the points for improvement are. If the internal audit report is missing, or out of date, the external audit will show this immediately.

Who may carry out the internal audit?

The standard sets three requirements for the internal auditor: knowledge of NEN 7510, audit skills, and independence from the processes being audited.

This combination is not always easy to find in small healthcare organisations. Practical solutions:

Internal cross-audit: departments or teams audit each other. An employee from the ICT department audits the processes at the outpatient clinic, and a care coordinator audits the ICT processes. This works well in larger organisations with several departments.

External internal auditor: an independent adviser carries out the internal audit. It may sound paradoxical, but this is a common and accepted arrangement. The external party is internal in the sense that “you pay them and they work for you”, but independent in the sense that “they have no stake in the outcome”. Choose someone with healthcare experience.

Partner organisations: two small healthcare practices audit each other’s internal audit. Mutual benefit, low costs.

Three minor non-conformities in the same area can together become a major non-conformity. Do not be caught off guard: make sure the internal audit is thorough enough to spot patterns, not just isolated points.

Preparing the internal NEN 7510 audit

A good internal audit starts well before the audit day. Plan the preparation carefully.

Set up an audit programme

Decide which parts of the ISMS you will audit this year. You do not have to do everything in one audit, but over a three-year period, every part must be audited at least once.

Record the plan in an audit programme: which part, when, and audited by whom.

Review the documentation in advance

The auditor reviews the documents before the interviews. Are your policy, risk analysis, procedures and the mandatory documents up to date and available? Is the Statement of Applicability (Verklaring van Toepasselijkheid) complete? Have the findings from the previous audit been resolved?

Carry out the audit

Combine document review, interviews with employees and observations of the actual situation. Do employees really work the way the procedures describe? Is logging switched on? Are the server rooms locked?

Document the findings

Record every finding. Distinguish between conformities (good), minor non-conformities (not serious, but action is required), major non-conformities (serious, urgent action is required) and points for improvement.

Address the findings

An internal audit is worthless if you do nothing with the findings. Create an action list with owners and deadlines. Resolve major non-conformities before the external audit.

What do you check in an internal NEN 7510 audit in healthcare?

Below are the key points per clause, worked out specifically for the healthcare context. Use this as a guide when preparing.

Clauses 4-5: context and leadership

Is the scope of the ISMS clearly documented and logically defined?
Has the board adopted and communicated the information security policy?
Are roles and responsibilities clearly assigned?
Are there minutes of the management review with concrete decisions?

Clause 6: planning and risk analysis

Has the risk analysis been carried out and is it up to date?
Are healthcare-specific risks included: patient records, medical equipment, data exchange within the care chain?
Is the Statement of Applicability complete and aligned with the risk analysis?

Clauses 7-8: support and operation

Have all employees demonstrably been trained in information security?
Have the control measures actually been implemented?
Are there signed processing agreements with the EHR supplier, hosting provider and IT administrator?

Healthcare-specific checks

These are the points an external auditor always checks under NEN 7510, and which internal audits in healthcare should give extra attention to.

Check	How you test this
Logging in line with NEN 7513	Request a log report from the EHR; check that it contains the required fields
Access based on treatment relationship	Select three employees at random and check why they have the access they have
Patient requests to view logs	Test whether you can fulfil a patient’s request to view logs; can you do it, and how quickly?
Security of medical equipment	Check whether network equipment is listed in the inventory and included in the risk analysis
Incident register up to date	Have recent incidents (including minor ones) been recorded? Have they been resolved?
Clean desk	Walk through the practice at a random moment: is any patient data visible?

The internal audit report

Record the findings in an audit report. This does not have to be a bureaucratic document, but it must contain the following elements:

Date and scope of the audit
Who carried out the audit (name and independence statement)
Audit criteria (NEN 7510 and your own procedures)
Summary of findings per category
Non-conformities with category (minor or major) and recommended action
Points for improvement
Signature of the auditee and the auditor

Keep the report. The external auditor will want to see it, together with evidence that you have addressed the findings.

How often should the internal audit take place?

NEN 7510 requires “periodic” internal audits. In most organisations, this means at least once a year. In your audit programme, you plan this in advance and actually follow through on it.

When there are new risks or major changes in your organisation (a new EHR system, a merger, a new location), an extra internal audit is advisable, even outside the regular schedule.

Relationship with the external audit

The internal audit is not the same as the external audit. You check for yourself whether you meet the standard; the external auditor from the certification body checks this independently. Both are needed.

A good internal audit programme makes the external audit smoother. Findings that you identified and addressed internally are evidence for the external auditor that your improvement cycle works. Read more about the external audit process for NEN 7510 for what the certification body checks in detail.