Internal audit — General

Plain-language summary

Auditing your own ISMS at planned intervals to find out two things: does it meet your own requirements and the standard's, and is it actually implemented and maintained in practice.

What the clause is really asking

Internal audit is the organisation's own check before anyone else's. The clause requires audits at planned intervals that provide information on whether the ISMS conforms to the organisation's own requirements (its policies, procedures, SoA and objectives) and to the requirements of ISO/IEC 27001, and whether it is effectively implemented and maintained. The 2022 edition split the clause so that 9.2.1 states the purpose and 9.2.2 the programme. Two scopes need covering over the cycle: the management-system clauses 4 to 10, and the Annex A controls declared applicable in the SoA — an audit that reads the policies and never tests a control is incomplete. Internal audit of an ISMS needs auditors who understand both auditing and information security; for small organisations that may mean training a quality auditor on 27001, pairing them with IT, or buying in an auditor for the technical controls. Missing or late internal audits are among the most common certification findings.

What auditors look for

Auditors review the audit records for coverage and depth: over the cycle, were all clauses and all applicable controls audited; were real tests performed (sampling access records, watching a backup restore) or only documents read; were nonconformities raised, and did they go through 10.2? They check the audits happened when planned and that findings reached management review. They look at who audited: trained, independent of the area, with technical help where needed. An ISMS whose internal audit found nothing in two years is questioned, not congratulated.

Typical evidence

Internal audit reports with scope, criteria, evidence sampled, findings and conclusions; coverage matrix showing clauses and SoA controls audited over the cycle; nonconformities raised and tracked under 10.2; auditor competence records; management-review minutes discussing audit results.

How to comply — recommendations

Audit the ISMS in parts across the year rather than one marathon: the management-system clauses in one audit, then Annex A by theme (organisational, people, physical, technological) in quarterly audits, each testing a sample of controls with evidence. Write findings as the Qlause nonconformity method teaches — requirement, evidence, gap — and route them into corrective action. Use the Audit Manager's ISO/IEC 27001 scheme to plan the programme and anchor every finding to its clause or control. Train your auditors on 27001 and pair them with a technical colleague for the Annex A controls.

Common nonconformities

Internal audits not performed, or not at the planned intervals; audits covering clauses 4–10 but not the Annex A controls, or vice versa; audits that review documents without testing operation; no nonconformities raised despite evident gaps; findings not routed into corrective action; auditors not competent in ISO 27001; results not reported to management review.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• ArticleHow to write an ISO 9001 audit nonconformity that won't get thrown out
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadNC Writing ChecklistWrite audit nonconformities that hold: requirement, evidence, statement — in that order, checked before the finding is issued.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free courseInternal Auditor coursePlanning, running and reporting internal audits, with a verifiable certificate.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.