Back to internal audit questions

Does our first ISO 27001 internal audit have to cover the whole standard, or can we do it in stages?

Updated 1 min read

Before the first certification, certification bodies expect the internal audit to have covered the whole ISMS: every requirement in clauses 4 to 10 and every Annex A control marked as applicable in the Statement of Applicability. The standard leaves the coverage to your audit programme; the full-coverage expectation comes from the certification body, which has to see evidence that the whole system works before it issues a certificate.

How you organise that work is up to you. Several sessions over a few weeks are fine, as long as the audit programme shows they add up to full coverage and all of them finish before Stage 2. A 40-person software company might audit the management clauses and HR controls in week one, IT operations and access in week two, and development and suppliers in week three, with one combined report at the end.

Partial audits become possible after certification. From then on the programme can spread the Annex A controls over the three-year cycle, as long as each has been audited once by recertification.

The certification auditor checks this at Stage 1 by comparing the internal audit report with the Statement of Applicability. A control marked as applicable that appears nowhere in the audit is a gap they will record.

Related service

Have a question?

Required