The first internal audit covers everything, because the certification body needs full coverage before the first certificate. From the second year, three things change.
- Scope. The audit covers what the programme schedules for this year, plus areas that changed, such as a new product, a new office or a new key supplier, plus the controls behind last year's findings.
- Focus. Last year's findings are checked first. The auditor looks at whether each corrective action held, for example whether the quarterly access reviews really happened four times.
- Comparison. Both the internal auditor and the surveillance auditor read this year's report next to last year's. A finding that returns is treated more seriously the second time, because it shows the corrective action did not work.
The method stays the same: samples, interviews and records. The audit is usually shorter in days, since the documentation is established and people know the process, and it goes deeper on follow-up.
Companies also tend to get more out of the second audit. With the basics in place, the auditor can spend time on how well the controls work, for example whether the incident response plan would hold up in a real incident.