Internal audit programme

Plain-language summary

Planning the audits as a programme — frequency, methods, responsibilities, planning and reporting — weighted by what matters most and what went wrong last time, with objective auditors, defined criteria and scope for each audit, results reported to the right managers and records kept.

What the clause is really asking

The programme is the schedule and the rules behind the individual audits. The organisation sets up and runs one or more audit programmes that settle how often audits happen, how they are done, who is responsible, how they are planned and how they are reported, weighting the programme by how important each process is and by what earlier audits found — so the identity system and the cloud platform get audited more often than the visitor book, and an area with findings last year is revisited sooner. For each audit the criteria and scope are defined; auditors are selected and audits conducted to ensure objectivity and impartiality (nobody audits their own work); results are reported to relevant management; and documented information is available as evidence of the programme and the results. For an integrated system, one programme can cover ISO 9001 and ISO 27001 as long as the ISMS criteria and controls are explicit in it.

What auditors look for

Auditors read the programme and ask how frequency was decided — the right answer mentions risk, control importance and last year's results. They check scope and criteria are written for each audit, that the auditor was independent of the area, that reports went to the managers who own the processes, and that records exist for the programme itself, not just the reports. They look for the programme adapting: an incident in access management should pull the next access audit forward.

Typical evidence

Audit programme (schedule over the certification cycle) with frequency rationale; individual audit plans with scope, criteria, auditor and date; auditor assignment showing independence; audit reports distributed to relevant management; programme reviews and changes after incidents or findings; records retained per 7.5.3.

How to comply — recommendations

Build a three-year programme on one page: rows for clauses 4–10 and the four Annex A themes, columns for the quarters, with the high-importance areas (access, change, backup, suppliers, incident response) appearing every year and the rest at least once per cycle. Record the rationale in a sentence per row. Assign auditors who do not own the area and note that on the plan. Issue each audit report to the process owner and the ISMS lead, and review the programme at management review, pulling audits forward where incidents or findings justify it. The Audit Manager carries the programme, the plans and the findings in one place.

Common nonconformities

No documented audit programme, or one with no frequency rationale; previous audit results and process importance not considered; scope and criteria not defined per audit; auditors auditing their own areas; reports not reaching the responsible managers; programme not adjusted after incidents or findings; programme records missing.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• ArticleHow to write an ISO 9001 audit nonconformity that won't get thrown out
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadNC Writing ChecklistWrite audit nonconformities that hold: requirement, evidence, statement — in that order, checked before the finding is issued.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free course moduleInternal Auditor course — Managing an Audit Programme (Clause 5)
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.