ISO 27001 Internal Audit: How to Plan and Run It, and What a Certification Auditor Checks

Two weeks before Stage 2, the head of security runs the company's first internal audit. She audits the access control process she wrote herself, finds nothing wrong, and files a one-page report. At Stage 2, the certification auditor reads it and asks the obvious question: how can anyone audit their own work objectively?

That is one of the most common internal audit findings we see, and one of the easiest to avoid. This guide explains the requirement, a practical method, and how a certification body reviews the result.

Quick answer: An ISO 27001 internal audit is a planned, independent check, required by clause 9.2 of ISO/IEC 27001:2022, that your ISMS meets your own requirements and the standard, and that it works in practice. You need an audit programme that sets frequency, methods and responsibilities, auditors who stay objective and impartial, results reported to relevant management, and documented evidence. Certification auditors expect at least one completed internal audit and a management review before Stage 2.

ISO 27001 Internal Audit Requirements: Clause 9.2

Internal audit findings then feed the management review in clause 9.3 and corrective action in clause 10.2. For the full set of clauses, see our guide to ISO 27001 requirements.

How to Conduct an ISO 27001 Internal Audit in 7 Steps

ISO 19011:2018, the guidance standard for auditing management systems, describes the same cycle that most ISMS teams follow.

1. Build the audit programme

Map every ISMS clause and every control in your Statement of Applicability to a planned audit over the year. Audit high-risk or recently changed areas more often, and areas with earlier findings sooner.

2. Choose objective auditors

No one audits their own work. Use a trained colleague from another team, swap audits between departments, or bring in an independent external auditor. Keep a record of each auditor's competence, such as internal auditor training.

3. Plan each audit

Set the scope, the criteria (ISO 27001, your policies and your Statement of Applicability), the people to interview, the records to sample and the dates. Share the plan with the auditees in advance.

4. Collect evidence

Interview the people who run each process, observe how work is done, and sample real records: access reviews, change tickets, backup tests, supplier assessments, training logs. Test that controls work, not just that documents exist.

5. Grade the findings

Record each finding against the requirement it relates to, and grade it as a nonconformity, an observation or an opportunity for improvement. A nonconformity needs objective evidence, not an opinion.

6. Report to relevant management

Write the report and send it to the managers responsible for the areas audited and to top management. The results become an input to the management review under clause 9.3.

7. Follow up corrective actions

For each nonconformity, find the root cause, fix it, and check that the fix worked, as clause 10.2 requires. Check the corrective actions at the next audit.

ISO 27001 Internal Audit Checklist

Use these questions as a starting point, then add the controls in your own Statement of Applicability.

• Context and scope (clause 4). Is the ISMS scope documented and still accurate? Have issues, interested parties and climate change relevance been reviewed?
• Leadership (clause 5). Is the information security policy approved, communicated and current? Are roles and responsibilities assigned?
• Risk (clause 6). Was the risk assessment repeated as planned? Do risks trace to controls and to the Statement of Applicability? Are objectives set and tracked?
• Support (clause 7). Are competence, awareness and training records complete? Is documented information controlled?
• Operation (clause 8). Is the risk treatment plan being carried out? Are changes planned and controlled?
• Performance evaluation (clause 9). Are monitoring results recorded? Is the internal audit programme on schedule? Did management review take place with all required inputs?
• Improvement (clause 10). Are nonconformities recorded with root cause and verified corrective action?
• Annex A controls. Sample the controls in your SoA: for example access rights (5.18), supplier security (5.19 to 5.22), cloud services (5.23), incident management (5.24 to 5.28), backup (8.13) and logging (8.15). Is there evidence they operate?

Not sure how the controls are described? Our guide to ISO 27001 vs ISO 27002 explains where the implementation guidance for each control lives.

Internal Audit vs Certification Audit

What a Certification Auditor Checks in Your Internal Audit

At Stage 1, our auditors confirm that internal audits and management review are planned and being carried out. At Stage 2 and at every surveillance audit, they review the programme and the results. Typical checks include:

• A programme that covers the whole ISMS scope, including every applicable Annex A control, over the planned period.
• At least one completed internal audit before Stage 2, with a report and evidence of what was sampled.
• Objective auditors, with a record of their competence, who did not audit their own work.
• Findings that are evidence-based and graded consistently.
• Results reported to management and discussed in the management review.
• Corrective actions with root cause, owners, dates and proof they worked.

See the full audit path in how to get ISO 27001 certified. Much of this review can run online, see our guide to remote ISO audits.

Common Internal Audit Findings at Certification

• The person who owns a process also audited it.
• The internal audit covered clauses 4 to 10 but skipped the Annex A controls.
• A "clean" report with no evidence of what was sampled.
• No audit programme, just a single audit with no plan for the year.
• Findings raised but never closed, or closed without checking the fix worked.
• Internal audit results missing from the management review.
• No record of the internal auditor's competence.

Who Should Carry Out the Internal Audit?

Your own trained staff, or an independent auditor you appoint. An accredited certification body cannot run internal audits for an organization it certifies, because ISO/IEC 17021-1 requires it to stay impartial. Accredify Global reviews your internal audit as part of the certification audit, and your customers can check every certificate we issue on our certificate verification page.

ISO 27001 Certification with Accredify Global

ISO 27001 Internal Audit FAQ

Is an internal audit mandatory for ISO 27001?
Yes. Clause 9.2 of ISO/IEC 27001:2022 requires internal audits at planned intervals to check that the ISMS meets your own requirements and the standard, and that it is effectively implemented and maintained. You must also keep documented information as evidence of the audit programme and the audit results.

How often should an ISO 27001 internal audit be done?
ISO 27001 does not set a fixed frequency. It requires audits at planned intervals, set in your audit programme based on the importance of each process and the results of earlier audits. Many organizations cover the whole ISMS at least once a year, either in one audit or in smaller audits spread across the year, and audit higher-risk areas more often.

Who can perform an ISO 27001 internal audit?
Anyone competent who can stay objective and impartial. In practice, that means auditors do not audit their own work. Small teams often use a trained colleague from another department, or an independent external auditor. Training such as an ISO 27001 internal auditor or lead auditor course helps build the competence the auditor will ask about.

Can our certification body do our internal audit?
No. An accredited certification body must stay impartial under ISO/IEC 17021-1, so it cannot carry out internal audits for an organization it certifies. Accredify Global reviews your internal audit programme and results as part of the certification audit. The internal audit itself is done by your team or an independent auditor with no link to the certification body.

Can the ISO 27001 internal audit be outsourced?
Yes. You can outsource it to an independent auditor or consultant, as long as they are competent and objective. You stay responsible for the audit programme, for acting on the findings, and for reporting the results to relevant management.

What should an ISO 27001 internal audit report include?
The audit scope and criteria, the auditor or audit team, the dates, the areas and records sampled, findings graded as nonconformities, observations or opportunities for improvement, the audit conclusion, and who the report went to. Each nonconformity should lead to a corrective action under clause 10.2.

Do we need an internal audit before the certification audit?
Yes. At Stage 1, the certification auditor checks that internal audits and management review are planned and being carried out. Before Stage 2, they expect to see at least one completed internal audit and a management review, with findings followed up. A first internal audit run a few weeks before Stage 2 is common.

What is the difference between an internal audit and a management review?
The internal audit checks, with evidence, whether the ISMS conforms and works. The management review, under clause 9.3, is where top management looks at the results, including internal audit findings, and decides on changes, resources and improvements. The audit feeds the review.

Does every internal audit have to cover all Annex A controls?
No. Each audit can cover part of the ISMS, as long as the audit programme as a whole covers all the clauses and the controls in your Statement of Applicability over the planned period. Before Stage 2, certification auditors look for evidence that the programme covers the whole ISMS scope.