For a small or mid-sized company, an ISO 27001 internal audit takes two to three weeks from kick-off to report and runs in four steps.
- Planning. The auditor agrees the scope, the audit criteria and the schedule with your ISMS owner, and reads the core documents in advance: scope statement, risk assessment, Statement of Applicability, policies.
- Fieldwork. Over one or more days the auditor interviews control owners and checks evidence in your systems, remotely by screen share or on site. For access management, for instance, they might take five new joiners and five leavers from the HR tool and check each against the identity provider.
- Closing meeting. The auditor presents the preliminary findings. You can correct misunderstandings and point to evidence that was missed, so the report holds no surprises.
- Report and remediation plan. Each finding is described against the requirement it fails, with the evidence and a grade. The remediation plan lists what to fix, who owns it and by when.
A first internal audit usually turns up a handful of minors and observations, and finding them is the purpose of the exercise. A report with no findings at all tends to raise questions at Stage 1, because it suggests the auditor sampled too little.