No. Clause 9.2 asks for internal audits at planned intervals. When you set up the audit programme, the standard asks you to consider how important each process is and what earlier audits found. A change in the company does not by itself trigger an extra audit.
Changes are handled by other clauses. Clause 6.3 requires changes to the ISMS to be planned. Clause 8.1 requires planned changes to operations to be controlled, and the effects of unintended ones to be reviewed. Clause 9.3 puts changes in internal and external issues on the agenda of the management review.
An extra audit is often worth doing anyway. Typical triggers:
- a move to a new cloud provider or a major change in infrastructure
- an acquisition or merger that brings new people and systems into scope
- a new office or site
- a new product that processes personal or customer data
- a serious security incident
In these cases, a short audit of the changed area, or bringing the next planned audit forward, shows early whether the controls still work. After a migration from on-premises servers to AWS, for example, the auditor would check access management, logging, backups and the supplier assessment for the new provider. Record the decision in the audit programme, so the surveillance auditor can see why the schedule changed.
Your certification body is a separate matter. Most certification contracts require you to inform the body of significant changes, such as a new scope, a new site or a change of ownership. The body may then add a short audit of its own, which does not replace your internal audit.