An ISO 27001 internal audit is a planned check of your information security management system (ISMS) against two yardsticks: the requirements of the standard and your own policies and procedures. Someone who had no hand in building or running the controls carries it out, either a trained employee from another team or an external auditor.
The auditor works from evidence. They read the scope statement, the risk assessment and the Statement of Applicability, then pick samples and trace them. A typical sample: five people who left the company last year, checked one by one to see whether their accounts were closed on the day the policy requires. The auditor also interviews the people who run the controls, from the IT lead to a recently hired engineer. Everything found goes into a report, with each finding graded as a major nonconformity, a minor nonconformity or an observation.
The audit serves two purposes. Clause 9.2 requires internal audits at planned intervals, and the certification body checks at Stage 1 and at every surveillance audit that one took place. It also shows you the gaps while fixing them is still your own business. A missing backup test found in March, in your own audit, is a task on a list. The same gap found by the certification auditor in May is a nonconformity on their report.
The results go to top management and feed the management review (Clause 9.3), where leadership decides what changes.