Back to Ask the AuditorISO 27001 internal audit,
ISO 27001 internal audit,
explained
What companies ask about the internal audit, from the first one before certification to the yearly ones after it.
The basics
For anyone running the internal audit for the first time: what it is, how it runs, what it leaves you with.
- What is an internal audit, and what is it for?A check, by someone impartial, of whether your ISMS meets ISO 27001 and works the way your policies describe. Clause 9.2 requires it, and it lets you find and fix gaps before the certification auditor sees them.
- How is it different from the certification audit?You run the internal audit yourselves, with an auditor you choose, and the findings stay with you. The certification audit is run by an accredited certification body, and its findings decide whether you get and keep the certificate.
- Is it required for certification?Yes. Clause 9.2 requires it, and before Stage 2 the certification body checks that a complete internal audit of the whole ISMS has taken place.
- How often do we need one?Once a year in practice, six to ten weeks before each certification, surveillance or recertification audit. The standard only says "at planned intervals" and leaves the schedule to your audit programme.
- How is the internal audit structured, and what should we expect?Four steps over two to three weeks: planning the scope and schedule, interviews and evidence checks, a closing meeting on the preliminary findings, and the report with a remediation plan. Expect a handful of findings.
- Which documents should it leave us with?Five: the audit programme, the audit plan, the audit report, a corrective action log, and a record of the auditor's competence and impartiality.
- Is the internal audit the same as the management review?No. The internal audit (Clause 9.2) checks whether the ISMS works and produces findings. The management review (Clause 9.3) is top management deciding what to change, based on those findings and other inputs. You need both before every external audit.
- Can our certification body run it?No. The accreditation rules for certification bodies (ISO/IEC 17021-1 and ISO/IEC 27006-1) keep the body that certifies your ISMS apart from whoever runs your internal audit. The audit has to come from your own trained staff or from an independent firm.
Before the audit
For teams heading to their first certification and planning when to audit and how to prepare.
- How do we know we're ready for our first internal audit?When the scope, risk assessment, risk treatment plan, Statement of Applicability and policies are approved, and the controls have run for a few weeks, so there are records to check.
- How do we prepare for it?Fix the problems you already know about, send the auditor your core documents and system access a week ahead, book 30 to 60 minutes with each control owner, know where your records live, and leave existing records unchanged.
- Can we run it before every control is in place?Yes. Missing controls show up as findings, which is useful. Before Stage 2 the whole ISMS still has to be audited and the gaps closed, so plan a short follow-up audit of the late controls.
- Does it have to happen before Stage 1 or before Stage 2?Plan it before Stage 1. The Stage 1 auditor checks whether an internal audit and a management review are planned and have been performed, and both have to be complete before Stage 2. Some certification bodies accept the audit between the stages, which leaves little time to close findings.
- Does our first internal audit have to cover the whole standard, or can we do it in stages?It has to cover everything before certification: clauses 4 to 10 and every applicable Annex A control. You can split the work into several sessions, as long as all of them are done before Stage 2.
- Which documents does the auditor need from us before it starts?The scope statement, Statement of Applicability, risk assessment and treatment plan, approved policies and procedures, findings from earlier audits, read access to the systems that hold evidence, and a list of control owners with interview times.
- If someone external runs it, do we still write the audit programme and procedure ourselves?Yes. The audit programme and the internal audit procedure belong to your ISMS, so you own them. The external auditor writes the audit plan and the report for the audit they carry out.
- Our certification audit is in six weeks and we haven't done the internal audit yet. Is it too late?No, but the schedule is tight: audit in the first two weeks, report and management review in week three, then about three weeks to close the majors. If several majors can't be fixed in time, move the certification date.
Who does it
For deciding who runs the audit: an employee, a consultant or an outside auditor.
- Who in our company is allowed to be the internal auditor?Anyone who knows the standard and how to audit, and who is impartial towards the area audited: they did not build, run or own the controls they check.
- Do they need a certificate or a qualification?The standard names no specific certificate, but you have to show the auditor is competent. An ISO 27001 internal auditor or lead auditor course certificate is the usual proof.
- Does the auditor have to be technical?Some technical understanding helps, but audit method and knowledge of the standard matter more. For deep technical areas such as cloud configuration, the auditor can bring in a technical expert.
- Can the consultant who built our ISMS also run the internal audit?No. Clause 9.2 requires an impartial auditor, and the person or firm that built your ISMS would be checking their own work. The certification body records this as a nonconformity.
- Is a checklist enough to do the audit ourselves?No. A checklist shows that documents exist. An audit also has to show that the controls work, which takes sampling records and interviewing people.
During the audit
What the audit days look like for your team, and what the auditor looks at.
- How long does the internal audit take, and how much of our team's time does it need?For 20 to 50 people on one site with cloud infrastructure: two to three auditor days of fieldwork over one to two weeks, plus the report. Your ISMS owner joins most of the fieldwork, and six to ten control owners give 30 to 60 minutes each.
- Who gets interviewed, and should we prepare our people for it?The owner of each control, plus a few employees picked on the day, such as an engineer or a recent joiner. Tell your team what the audit is for and that findings are normal, and skip rehearsing answers.
- What counts as evidence?Records a process created while it ran, such as approved tickets, dated access reviews, training logs, backup restore tests and signed risk acceptances. A policy only shows what should happen.
- What are the most common findings in a first internal audit?A risk treatment plan that doesn't match the risk assessment, access reviews that were skipped, backups never test-restored, key suppliers never assessed, and no evidence of a management review.
After the audit
Reports, findings and what the certification body does with them.
- What does the report need for the certification body to accept it?The scope and criteria, who audited and when, the methods and samples used, each finding with its requirement, evidence and grade, what was found to conform, and the corrective actions with owners and dates.
- How do we close findings in a way that holds up at the next external audit?For each finding: fix the immediate problem, find the root cause, change what caused it, and keep a record from after the change that shows it worked. Track all four steps in a corrective action log with an owner and dates.
- Can we share the report with a customer or investor who asks?Yes, nothing in the standard prevents it. A one-page summary with the audit date, scope and findings by grade and status usually satisfies them. Share the full report only under NDA, with the corrective action status attached.
- How much does an internal audit cost?For 20 to 50 people on one site, expect two to three auditor days of fieldwork plus the report. The price depends mainly on headcount, number of sites, on-premises infrastructure and whether the audit is remote or on site.
Surveillance and recertification
For certified companies in years two and three of the certificate cycle.
- Do we need an internal audit before every surveillance audit?Yes. The surveillance auditor expects an internal audit carried out since their last visit, usually six to ten weeks before the surveillance date, with its findings logged and handled.
- Does it have to cover the whole standard in a surveillance year?No. After certification the audit programme can spread the Annex A controls over the three-year cycle, weighted by risk and recent changes. By recertification every clause and applicable control must have been audited at least once.
- Do we need one in the recertification year, and is it different?Yes. Most companies make it a full audit of the whole ISMS, because the recertification audit reviews everything and checks that the programme covered every control during the cycle.
- Is the surveillance audit the same as the internal audit, or do we need both?You need both. The surveillance audit is the certification body's yearly visit that keeps your certificate valid. The internal audit is your own check beforehand, and the surveillance auditor reviews it.
- We're certified and skipped the internal audit this year. What happens at the surveillance audit?The auditor records a nonconformity against Clause 9.2: usually minor if the audit is late but planned, major if the audit programme has stopped altogether. The fix is a short internal audit before the surveillance date, even two weeks before.
- What changes the second time round?The scope narrows to the parts the programme schedules for this year, plus anything that changed and last year's findings. The method stays the same, and both auditors compare this year's results with last year's.
- Do we need an internal audit after a major change?No, the standard doesn't require one. It requires you to plan changes (Clause 6.3), control them (Clause 8.1) and cover them in the management review (Clause 9.3). An extra or earlier audit of the changed area is still worth doing after big changes, such as a new cloud provider or an acquisition.
If you'd rather have an auditor run it
- ISO 27001 Internal Audit
- By active auditors
- Findings in 5 business days
- Remediation plan included
Didn't find the answer?
Ask us directly. We answer by email.