Back to internal audit questions

Can our certification body run our ISO 27001 internal audit?

Updated 1 min read

No. Certification bodies work under ISO/IEC 17021-1, which treats a body running internal audits for its own certified clients as a threat to impartiality: a body that performed your internal audits is not allowed to certify that ISMS for at least two years afterwards. The ISMS-specific rules in ISO/IEC 27006-1 go further and require the certification body to be independent of whoever provides your internal ISMS audit, with no time limit. At the certification audit they would otherwise be judging work they had done themselves.

Your certification auditor can tell you that the internal audit is missing or too thin and record it as a finding. They cannot fill the gap for you.

That leaves two options. One is an employee who is trained and impartial, meaning someone outside the ISMS team who did not build or run the controls. The other is an independent auditor from an outside firm.

When choosing an outside firm, it helps to pick auditors who also audit for certification bodies. They know which evidence a Stage 2 auditor asks for and where companies usually fall short, so the internal audit tests the same things the certification audit will. The one limit is that the person who runs your internal audit cannot also be on the certification body's team for your certification.

Related service

Have a question?

Required