Back to internal audit questions

Is an ISO 27001 internal audit required for certification?

Updated 1 min read

Yes. Clause 9.2 requires internal audits at planned intervals, and certification bodies do not certify a company that has not completed at least one.

The check comes early. At Stage 1 the certification auditor asks for the audit programme, the internal audit report and the minutes of the management review, because the rules for certification bodies (ISO/IEC 17021-1) require them to evaluate at that stage whether internal audits and management reviews are planned and performed. If the internal audit is missing, the auditor records it as an area of concern that would become a nonconformity at Stage 2, so it has to be done before Stage 2 goes ahead. The same check returns at every surveillance audit and at recertification.

The standard leaves a lot of room on the details. It does not say how often, how long the audit takes or whether an employee or an outside firm does it. Two points are firm. Before the first certification, certification bodies expect the audit to have covered the whole ISMS: clauses 4 to 10 and every Annex A control marked as applicable. And the audit has to be objective and impartial, which in practice means the auditor did not build or run what they audit.

A small company that skips the internal audit to save time usually loses that time again. Stage 1 finds the gap, Stage 2 moves, and the internal audit happens anyway, later and under more pressure.

Related service

Have a question?

Required