Internal Audit Program — EMStool / Cadence

1. Purpose

This program defines a recurring, scheduled review of access logs and policy compliance — the piece SOC2 5.36 / ISO 27001 identifies as missing beyond simply having audit logs available to review on request. It satisfies the requirement for a formal internal audit cadence, scoped appropriately for a one-engineer team (Security Officer self-review, not a separate audit department).

2. Schedule

Quarterly, on the 1st business day of January, April, July, and October. An automated reminder email fires on that schedule (see Section 4) so the review does not depend on manual tracking.

3. Review Checklist

Review audit_log for anomalous access patterns (unusual login times, unusual IP ranges, repeated failed-login lockouts) on each active deployment. Confirm no disabled/offboarded users still show recent login activity (cross-check against the Workforce Access Offboarding Checklist). Spot-check a sample of PHI record exports (§164.524 requests) against `patient_notes` entries to confirm each was logged. Confirm the most recent backup restore test (Business Continuity Plan, Section 7) is within the last 90 days; schedule one if not. Confirm Uptime Kuma alerting is still active and has fired/resolved correctly for any real downtime in the quarter. Review the Vendor Security Register for any new third-party service added since the last review; add it if missing. Confirm CI (php-lint, Semgrep, Trivy) is green on `main` and no suppressed/ignored findings have accumulated. Re-confirm each policy document's "Next Review" date — flag any overdue.

4. Automated Reminder

An automated quarterly email reminder (Resend, same recipient list as the security-alert/inactive-user notifications) links to this checklist. Completion itself is manual — the Security Officer works through the checklist and notes findings below — but the schedule is enforced by automation, not memory.

5. Findings Log

Quarter	Reviewed By	Findings	Actions Taken
No reviews conducted yet — first scheduled review is the next quarterly reminder after this program's effective date.