Back to internal audit questions

Do we need an ISO 27001 internal audit before every surveillance audit?

Updated 1 min read

Yes. Clause 9.2 requires internal audits at planned intervals, and at each yearly surveillance audit the certification body checks that one has taken place since its last visit.

Expect the surveillance auditor to ask for three things early on the first day: the current audit programme, the latest internal audit report, and the corrective action log with the status of each finding. They then compare the three. Did the audit cover what the programme planned for this year? Were the findings handled? Did last year's findings stay closed?

The surveillance-year audit can be smaller than the first one. Following the programme, it might cover clauses 4 to 10 plus a third of the Annex A controls, focused on areas that changed. It still has to happen. The rules for certification bodies require every surveillance audit to look at your internal audits and management review, so a year without one is a nonconformity against Clause 9.2.

Six to ten weeks before the surveillance date is the usual timing. That leaves room to close findings and hold the management review, and the evidence is still recent when the certification auditor arrives.

Related service

Have a question?

Required