--- title: "ISO 27001 Internal Audit Guide: Checklist & Report" description: "How to plan and run an ISO 27001 internal audit: programme, impartiality, what to sample, what the report must contain, and closing findings properly." canonical: https://www.isosecurity.co.uk/resources/iso-27001-internal-audit updated: 2026-11-10 --- # ISO 27001 internal audit: your rehearsal, done properly The internal audit is where you find your own problems while they are still cheap. It needs a programme covering the whole system, auditors who did not build what they are examining, sampling of real records and interviews, and findings that drive corrective action. ## What does ISO 27001 require for internal audit? Clause 9.2 requires audits at planned intervals, against defined criteria and scope, by auditors selected to be objective and impartial, with results reported to management and evidence retained. In practice the certification auditor will ask for four things: the programme, who audited and why they were competent to, the reports, and what happened about the findings. Weakness in any one of the four is a recurring [Stage 1 and Stage 2](/resources/iso-27001-stage-1-stage-2-audit) finding. ## What does a workable internal audit programme look like? - Cover every clause and every applicable control area across the programme cycle; riskier and previously weak areas more often. - Schedule audits through the year rather than one annual event, so evidence stays current for [surveillance](/resources/iso-27001-surveillance-audit). - Name the auditor for each area in advance, and check they do not own what they audit. - Record auditor competence: training, experience, or supervised first audits. ## What should you sample on the day? | Area | Evidence to sample | | ------------------------- | ------------------------------------------------------------------------------------- | | Clauses 4–7 | Scope, policy approvals, objectives, competence and awareness records | | Risk (clause 6 and 8) | Methodology applied as written, register currency, treatment progress, SoA accuracy | | People controls | Joiners, movers and leavers; screening; training completion | | Technology controls | Access reviews, privileged access, backup restore tests, patching and logging records | | Suppliers | Assessments before go-live, contract clauses, review activity | | Incidents and improvement | Incident log through to lessons learned; corrective actions closed with root cause | | Interviews | Control owners describing their process in their own words | Sample across the whole year. Three access reviews spread over the year prove a working control, while three produced in the same week prove a deadline. ## What makes an internal audit finding useful? Classify findings honestly: nonconformity where a requirement is not met, observation where it is met weakly. Each finding needs evidence, an owner and a date, and closure needs root cause (see my guide to [major and minor nonconformities](/resources/major-vs-minor-nonconformity)). Feed the results into [management review](/resources/iso-27001-management-review). An audit programme whose findings go nowhere is a finding in itself. ## Who should audit if nobody internal is impartial? Small organisations often cannot separate builder from auditor, which is the normal case for a standalone external internal audit. An independent Lead Auditor examines the system, reports findings in the format a certification body expects, and leaves your team to fix them without marking its own homework. It is one of the services set out in my [guide to ISO 27001 costs](/resources/iso-27001-cost-uk). ## Frequently asked questions about ISO 27001 internal audit ### What is an ISO 27001 internal audit? A planned, impartial examination of your own management system before the external auditor arrives: whether it meets ISO/IEC 27001:2022 and your own documented commitments, and whether it works in practice. It must cover the whole ISMS across its programme, use competent auditors who do not audit their own work, record findings, and feed corrective action and management review. ### Can we do our own ISO 27001 internal audit? Yes, if the auditors are competent and impartial, and in a small organisation impartiality is the hard part because the person who built the system cannot audit it. Common solutions are a trained manager auditing areas they do not own or an external consultant for independence, and ISO Security provides standalone internal audits from £1,950 where that separation is needed. ### What should an internal audit report contain? Scope and criteria, who audited and their basis of competence, what was sampled (documents, records, interviews), findings classified as nonconformities or observations with evidence, and agreed corrective actions with owners and dates. The report is evidence your system checks itself, so a one-page 'all satisfactory' note does your certification no favours. ### When should the internal audit happen? Early enough to fix what it finds before Stage 1: in practice, once the system has operated long enough to generate records, and at least annually thereafter within a rolling programme. Leaving it to the fortnight before the external audit converts a useful check into a crisis. ### Is there an ISO 27001 internal audit checklist or template we can use? A checklist helps, provided it is built from your own scope, Statement of Applicability and previous findings, because borrowed checklists test controls you do not have and miss the ones you do. My free ISO 27001 checklist spreadsheet includes an audit-readiness sheet that turns naturally into an internal audit plan: work through it clause by clause, record what you sampled, and keep the findings with owners and dates. ## Contact Need an independent internal audit? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.