Your certification audit is booked. Somewhere on the preparation list is a line that says internal audit, and nobody in the company has run one before. It usually gets treated one of two ways. Either it sounds like an inspection you can fail, or it gets waved through as an internal formality, a box to tick on the way to the real thing.
It is neither. It is the one audit you control: you choose when it happens, who runs it, and what gets looked at. Everything it finds is something you can fix quietly, on your own schedule, before anyone outside the company sees it. Run properly, it is the most useful week of the whole certification year.
What an internal audit is
An information security management system (ISMS) is the set of processes you run to keep information safe. ISO 27001 asks you to check that system yourself, at planned intervals. That check is the internal audit, and it sits in Clause 9.2 of the standard.
Four things it is not:
- It is not the certification audit. That one is run by an external certification body and decides whether you get your certificate.
- It is not a technical test. A penetration test checks your systems. An internal audit checks whether your organisation does what it says it does.
- It is not a one-off. It repeats, normally once a year, and again when something big changes: a new product, a move to a different cloud provider, a merger, a reorganisation that changes who does what.
- It is not a formality. Clause 9.2 asks for a real check, with planned scope, impartial auditors and recorded results.
Clause 9.2 asks for two answers. Does your ISMS match the rules you wrote for yourself and the requirements of the standard, and is it actually working in practice. Both matter. A perfect policy nobody follows fails the second question.
Who is allowed to run it
One rule decides this: nobody audits their own work. The standard calls that objectivity and impartiality, and it is the thing certification auditors check first when they look at your internal audit.
In practice, three options work:
- Someone from another team. Your operations lead audits the joiner and leaver process. The person who owns that process audits something in operations. Neither is marking their own homework.
- Someone from the group. A colleague from a sister company or another site.
- An auditor from outside. Independent of your company entirely.
The honest problem with the first two is friendly findings. A colleague who has to sit next to you tomorrow will round things up, skip the awkward sample and write "minor" where an outsider would write something stronger. That is not dishonesty, it is human. An outsider has nothing riding on the answer, so what they write down is what a certification auditor would also see.
You do not need a certified lead auditor to run it. You need someone competent who did not build the thing they are checking.
What the auditor actually checks
An internal auditor works through three questions, in this order.
Does it exist? Is there a written process, for example an access control policy that says who approves access and how often it is reviewed.
Does it match? The process has to meet what the standard asks for, and what you promised elsewhere. If your policy says access is reviewed quarterly and your customer contract says monthly, something is wrong before anyone opens a system.
Do people do it? This is where most of the time goes, and it runs on evidence rather than explanations. Evidence means a record that something happened: a dated ticket, a signed review, an export from a system.
A typical evidence request looks like this:
- the last four access reviews, with dates and who ran them
- three joiners and three leavers, with the tickets showing when access was granted and removed
- the risk treatment plan, showing which actions are done and which slipped
- supplier checks for the two newest suppliers
- training completion for everyone who joined in the last six months
- the minutes of the last management review
Nobody checks everything. Auditors take samples, which means a small set chosen to represent the rest. Three leavers out of thirty tells them enough. If all three are clean, they move on. If one is not, they ask for five more.
What a finding is
A finding is the auditor writing down a difference between what should happen and what did. There are three levels, and the distance between them is bigger than people expect.
Observation, sometimes called an opportunity for improvement. Nothing is broken, but something could be better or clearer. Example: your policy says quarterly access reviews, you actually do them monthly, so the document is out of date. No rule was broken. The paperwork just does not describe reality.
Minor nonconformity. A nonconformity is a requirement that was not met. Minor means a single slip in something that otherwise works. Example: your rule says a leaver's access is closed within two working days, and for one leaver out of eight it took eleven days.
Major nonconformity. The requirement is missing altogether, or it fails everywhere rather than once. Example: no access reviews have ever been run, or there is no risk treatment plan at all. In a certification audit, a major stops the certificate until it is fixed and verified.
Your internal audit can use these same three labels. It is worth doing, because the team gets used to the language before the certification auditor uses it on them.
What to do with a finding
Two different things, and mixing them up is the most common mistake we see.
A correction fixes the instance. Close the account that stayed open.
A corrective action fixes the reason it happened, which is what the standard actually asks for. That means finding the root cause: not the failure itself, but what made it possible. In the leaver example, the account was closed late because offboarding only starts when HR sends an email on payroll day. The correction is closing the account. The corrective action is starting offboarding from the HR system on the day notice is given, so the next leaver is handled in two days without anyone chasing it.
Our article on nonconformity and corrective action covers how to work out the root cause and record the fix step by step.
Why findings are good news
Findings written in your own internal audit do not affect your certificate. Nothing is reported to anyone. You get a list of things to fix and the time to fix them.
That is the whole trade. The same gap found at the certification audit becomes a nonconformity on the record, a corrective action plan with a deadline set by someone else, and in the case of a major, a wait while the auditor verifies your fix before the certificate is issued. Found internally, it is simply a task with an owner and a date.
There is a second benefit that surprises people. A report full of findings is not an embarrassment, it is evidence that your system is working: you looked, you found things, you fixed them, and you can show all three. A clean report with nothing in it has the opposite effect. Experienced certification auditors treat zero findings as a sign that the audit was shallow or the auditor was not independent enough to write anything down.
Which is why it is worth having the audit done by someone who will actually find things. An auditor from outside your company samples the way a certification body samples, writes up what they see without worrying about Monday morning, and gives you a realistic preview of your certification audit while there is still time to act on it. You have to run an internal audit anyway. The only question is whether it tells you something you did not already know.
Where to start
- Write a one page audit programme: what gets audited, when, and by whom. The whole ISMS has to be covered across the cycle, usually a year, but not all of it in one sitting. Access and suppliers in spring, incidents and backups in autumn works fine.
- Pick an auditor who did not build what they are checking. If that person does not exist in your company, bring in an auditor from outside.
- Set the criteria and the scope before you start. Criteria means what you are checking against: the standard, your own policies, your customer commitments. Scope means which parts of the business this audit covers.
- Ask for evidence rather than explanations, take samples, and write down what you saw, including the parts that were correct.
- Report the results to management, turn the findings into corrective actions with owners and dates, and keep the records. The certification auditor will ask for all three.
What's next?
Every internal audit ends in a list of findings, so the next thing to get right is what you do with them. Nonconformity and corrective action covers the difference between fixing the instance and fixing the cause. And because the results have to go to the people running the company, what the standard requires from management explains what they are expected to do with them.
- Global
- Governance & Compliance
- ISO 27001