ISO 27001

Outsourced IT

Third-Party Risk

Canada

ISO 27001 Internal Audit When IT Is Outsourced: What Canadian Businesses Must Prepare

Your MSP may manage Microsoft 365, backups, patching, endpoints, cloud infrastructure, and user access. Your organization still needs evidence that those outsourced controls are working.

Your IT Is Outsourced. Your ISO 27001 Responsibilities Are Not.

Your MSP manages Microsoft 365.

Another provider handles your backups.

Your cloud infrastructure may also be supported externally.

Patching, endpoint security, user administration, monitoring, and incident response may be outsourced too.

Then the internal auditor asks:

“Show me evidence that these controls are working.”

Your provider may perform the technical activity. However, your organization still needs to understand and manage the related information security risk.

That is why an ISO 27001 internal audit for outsourced IT should test both your responsibilities and the services your provider performs on your behalf.

You can outsource an activity. You cannot simply outsource oversight of the risk.

Quick Answer

What Should an ISO 27001 Internal Audit Check When IT Is Outsourced?

Which IT activities are outsourced?
Which responsibilities affect the ISMS?
Do contracts define security responsibilities?
Who has privileged access?
Is third-party access reviewed?
Are backups working and tested?
How are incidents escalated?
Are vulnerabilities and patches managed?
Is supplier performance monitored?
Can evidence be retrieved when needed?

The auditor should focus on the outsourced services that affect your ISMS scope and information security risks.

Who Is Responsible When IT Is Outsourced?

Your provider may operate a control. Your organization still needs to understand whether that control supports your ISMS requirements.

Example: Employee Offboarding

Your MSP may disable accounts.

However, your company still needs a process that tells the MSP:

  • Who has left.
  • When access must end.
  • Which systems are affected.
  • Who verifies completion.

Example: Backups

Your provider may run daily backups.

Your organization should still know:

What is backed up?
How long is it retained?
Who monitors failures?
Has restoration actually been tested?

Which Outsourced IT Activities Should the Audit Cover?

Start by mapping the provider activities that can affect your ISMS.

Microsoft 365 administration
Microsoft Entra ID
Endpoint management
Antivirus and EDR
Vulnerability management
Patching
Backups
Cloud infrastructure
Network management
Firewall management
Help desk
User onboarding
User offboarding
Privileged access
Security monitoring
Incident response
The auditor does not necessarily need to audit the provider’s entire organization. The focus should be the outsourced services that affect your ISMS.

What Evidence Should You Request From Your IT Provider?

Do not wait until audit week to ask your provider for evidence.

Contracts and Responsibilities

  • Master service agreement.
  • Security clauses.
  • Service-level agreements.
  • Responsibility matrix.
  • Confidentiality requirements.
  • Incident-notification requirements.

Access Evidence

  • Administrator account list.
  • Privileged-access approvals.
  • MFA evidence.
  • Access-review records.
  • Technician onboarding and offboarding.
  • Remote-access tool inventory.

Security Operations

  • Patch reports.
  • Vulnerability reports.
  • Endpoint-management reports.
  • Security alerts.
  • Change tickets.
  • Monitoring records.

Backup Evidence

  • Backup scope.
  • Backup-status reports.
  • Failed-job records.
  • Retention settings.
  • Restore-test evidence.

Incident Evidence

  • Incident tickets.
  • Escalation records.
  • Customer-notification procedures.
  • Root-cause analysis.
  • Corrective actions.
Provider certifications and assurance reports can be useful, but they should not automatically replace your own supplier oversight.

How Should an Auditor Test Third-Party Access?

Third-party access deserves special attention.

An MSP may have powerful administrative access to Microsoft 365, endpoints, cloud platforms, firewalls, servers, or other critical systems.

Start with one simple question:

Who can access our systems today?

Then test the answer.

  1. Obtain the provider administrator list.
  2. Compare accounts with authorized technicians.
  3. Verify MFA.
  4. Review privileged roles.
  5. Confirm access is still required.
  6. Review recent administrative activity.
  7. Sample technicians who left or changed roles.
Weak audit answer

“The MSP handles access.”

Stronger audit answer

“The MSP administers access under our responsibility matrix. Privileged accounts are named, MFA is enforced, access is reviewed, and evidence is retained.”

How Should Outsourced Backups Be Audited?

Do not stop with:

“Are backups enabled?”

Test whether the process actually works.


Backup Scope
↓
Successful Jobs
↓
Failed Jobs
↓
Escalation
↓
Restore Test

A provider dashboard showing green backup jobs is useful.

A successful restoration test provides stronger evidence that the process can recover data.

Responsibility for backup failures should be clear before an incident occurs.

How Should Incident Management Be Tested?

Outsourcing IT can create confusion during a security incident.

Imagine ransomware is detected at 2:00 a.m.

Who investigates?
Who decides severity?
Who contacts management?
Who preserves evidence?
Who notifies customers?
Who reports to your organization?

The auditor should look for:

  • Defined escalation paths.
  • Notification timelines.
  • Named contacts.
  • Incident records.
  • Root-cause analysis.
  • Corrective actions.
Your provider’s incident process and your internal incident process should connect.

Is Your MSP Operating Critical ISO 27001 Controls on Your Behalf?

An independent internal audit can test provider access, backups, incidents, vulnerability management, supplier oversight, and other outsourced controls before certification.

The goal is to confirm that outsourced activities are producing reliable evidence.

Request Your ISO 27001 Internal Audit Quote from Canadian Cyber

What If the IT Provider Will Not Share Evidence?

This can become an audit concern.

Your organization needs enough visibility to understand whether important outsourced controls are operating.

That does not mean the provider must expose confidential information about other customers.

Possible evidence can include:

Redacted reports
Screen sharing
Customer-specific records
Independent assurance reports
Certification evidence
Service reports
Ticket samples
Contractual commitments
If a provider performs a security-critical service but cannot demonstrate how it operates, review whether your organization has enough assurance over the arrangement.

When Should You Hire an Independent ISO 27001 Internal Auditor?

External support may be especially useful when:

  • Your MSP manages most technical controls.
  • Your internal team is small.
  • Certification is approaching.
  • You are unsure what evidence to request.
  • Your compliance manager implemented the ISMS.
  • You recently changed IT providers.
  • Previous supplier findings remain open.
  • You need an objective view before Stage 1, Stage 2, surveillance, or recertification.

What Your Organization Expects
↕
What the IT Provider Actually Delivers

Outsourced IT Internal Audit Preparation Checklist

Before the audit, confirm that you have:

☐ Current ISMS scope.

☐ List of outsourced IT services.

☐ IT provider contracts and SLAs.

☐ Supplier risk assessment.

☐ Responsibility matrix.

☐ Privileged account list.

☐ Access-review evidence.

☐ Technician offboarding evidence.

☐ Backup reports.

☐ Restore-test evidence.

☐ Patch reports.

☐ Vulnerability reports.

☐ Incident records.

☐ Security escalation process.

☐ Change-management records.

☐ Provider performance reviews.

☐ Open corrective actions.

For every outsourced control, ask one more question: What evidence proves that we are monitoring it?

Practical Outsourced IT Audit Tests

Area What to Test Example Evidence
Responsibilities Who owns each security activity? Contract, SLA, responsibility matrix
Privileged Access Who has administrator rights? Admin list, MFA, access reviews
Offboarding Are accounts removed on time? Tickets, account status, termination records
Backups Can systems actually be restored? Backup reports, restore-test results
Patching Are security updates completed? Patch reports, exceptions, tickets
Vulnerabilities Are findings remediated? Scan results, remediation tickets
Incidents Does escalation work? Incident tickets, notification records
Monitoring Does management review provider performance? Service reports, review minutes, KPIs

Frequently Asked Questions

Does outsourcing IT remove our ISO 27001 responsibility?

No. A provider may perform an activity, but your ISMS still needs to manage the associated information security risks and supplier relationship.

Does our internal auditor need to audit the entire MSP?

Not necessarily. The auditor should assess outsourced services and responsibilities that affect your ISMS scope and risks.

Can an MSP’s ISO 27001 certificate be used as evidence?

It can provide useful assurance. However, your organization should still understand the certification scope and how the provider’s services connect to your own responsibilities.

Can the internal audit be completed remotely?

Often, yes. Contracts, administrative access, backup dashboards, ticket samples, incident records, and other evidence can often be reviewed through screen sharing and secure virtual interviews.

What if our MSP refuses to provide audit evidence?

Consider whether customer-specific records, screen sharing, redacted reports, certification evidence, service reports, or other assurance methods can demonstrate the service. If critical controls still cannot be evidenced, review whether your organization has sufficient oversight.

What should we prepare before requesting an audit quote?

Prepare your ISMS scope, outsourced service list, employee count, locations, certification timeline, key providers, technology environment, and the audit deliverables you need.

The Takeaway

Outsourced IT does not mean outsourced accountability.

Your provider may:

Manage access.
Install patches.
Run backups.
Monitor alerts.
Respond to incidents.

However, your organization still needs to know whether those activities work and whether reliable evidence exists.

Before certification, your internal audit should answer:

What did we outsource?
Who is responsible?
What access does the provider have?
What evidence do we receive?
How do we monitor performance?
What happens when something fails?

If you cannot answer those questions clearly, address the gaps before the certification auditor arrives.

Need an Independent ISO 27001 Internal Audit?

Outsourcing IT does not remove your ISO 27001 responsibilities.

Canadian Cyber can help test:

  • Outsourced IT responsibilities.
  • Supplier evidence.
  • Third-party administrative access.
  • Backup and restore controls.
  • Incident management.
  • Vulnerability and patch management.
  • Provider performance monitoring.
  • Corrective-action evidence.
  • Other applicable ISMS requirements.

Request Your ISO 27001 Internal Audit Quote from Canadian Cyber

Stay Connected With Canadian Cyber

Follow Canadian Cyber for practical guidance on ISO 27001 internal audits, supplier security, third-party risk, certification readiness, and ISMS improvement.