Knowledge Hub
Practical insights on information security and compliance,
from active auditors
Articles and guides
- ISO 27001 clause 7: the clause that keeps your ISMS running when people leave
Clause 7 is where ISO 27001 asks who has to be competent, who has to be aware, and what you write down. Here is what an auditor checks and how to get it right.
ISO 27001 · October 29, 2026
- ISO 42001: who actually needs an AI management system, and who is being sold one
ISO 42001 certifies how you govern AI, not whether your AI is legal. Here is who the certificate actually helps, and who is being sold one they do not need.
ISO 42001 · October 22, 2026
- ISO 27001 internal audit: the one audit where findings cost you nothing
The internal audit is the one check you run yourself, and the cheapest place to find a gap. Here is what auditors look at and what you get out of it.
ISO 27001 · October 15, 2026
- See all articles in the Knowledge HubAll articles
Ask the Auditor
ISO 2700136 questionsISO 27001 internal audit
- ISO 27001 preparationComing soon
- SOC 2 preparationComing soon
Most asked
- Is an ISO 27001 internal audit required for certification?Yes. Clause 9.2 requires it, and before Stage 2 the certification body checks that a complete internal audit of the whole ISMS has taken place.
- Does the ISO 27001 internal audit have to happen before Stage 1 or before Stage 2?Plan it before Stage 1. The Stage 1 auditor checks whether an internal audit and a management review have been scheduled and held, and both have to be complete before Stage 2. Some certification bodies accept the audit between the stages, which leaves little time to close findings.
- Can the consultant who built our ISMS also run the ISO 27001 internal audit?No. Clause 9.2 requires an impartial auditor, and the person or firm that built your ISMS would be checking their own work. The certification body records this as a nonconformity.