What does ISO 27001 require for internal audit?
Clause 9.2 requires audits at planned intervals, against defined criteria and scope, by auditors selected to be objective and impartial, with results reported to management and evidence retained.
In practice the certification auditor will ask for four things: the programme, who audited and why they were competent to, the reports, and what happened about the findings. Weakness in any one of the four is a recurring Stage 1 and Stage 2 finding.
What does a workable internal audit programme look like?
- Cover every clause and every applicable control area across the programme cycle; riskier and previously weak areas more often.
- Schedule audits through the year rather than one annual event, so evidence stays current for surveillance.
- Name the auditor for each area in advance, and check they do not own what they audit.
- Record auditor competence: training, experience, or supervised first audits.
What should you sample on the day?
| Area | Evidence to sample |
|---|---|
| Clauses 4–7 | Scope, policy approvals, objectives, competence and awareness records |
| Risk (clause 6 and 8) | Methodology applied as written, register currency, treatment progress, SoA accuracy |
| People controls | Joiners, movers and leavers; screening; training completion |
| Technology controls | Access reviews, privileged access, backup restore tests, patching and logging records |
| Suppliers | Assessments before go-live, contract clauses, review activity |
| Incidents and improvement | Incident log through to lessons learned; corrective actions closed with root cause |
| Interviews | Control owners describing their process in their own words |
Sample across the whole year. Three access reviews spread over the year prove a working control, while three produced in the same week prove a deadline.
What makes an internal audit finding useful?
Classify findings honestly: nonconformity where a requirement is not met, observation where it is met weakly. Each finding needs evidence, an owner and a date, and closure needs root cause (see my guide to major and minor nonconformities).
Feed the results into management review. An audit programme whose findings go nowhere is a finding in itself.
Who should audit if nobody internal is impartial?
Small organisations often cannot separate builder from auditor, which is the normal case for a standalone external internal audit. An independent Lead Auditor examines the system, reports findings in the format a certification body expects, and leaves your team to fix them without marking its own homework.
It is one of the services set out in my guide to ISO 27001 costs.