The internal audit is the ISMS checking itself. It is also the requirement most likely to be done late, done shallow, or done by the person who built the thing being audited. Each of those makes it less useful to you and more likely to draw a finding from your certification body.
A good internal audit finds real problems while they are still cheap to fix. That means it has to be planned, independent of the work it examines, and specific enough that its findings can be acted on. None of that requires an external firm or a large team.
This article covers what clause 9.2 of ISO/IEC 27001:2022 requires, who can audit, how to build an audit program that covers the ISMS, and how to run a single audit from scoping to report.
What clause 9.2 requires
Clause 9.2 has two parts.
9.2.1 General requires internal audits at planned intervals, to provide information on whether the ISMS:
Conforms to your own requirements for the ISMS
Conforms to the requirements of ISO/IEC 27001
Is effectively implemented and maintained
9.2.2, on the internal audit program, requires you to plan, establish, implement, and maintain an audit program, including frequency, methods, responsibilities, planning requirements, and reporting. The program must take into consideration the importance of the processes concerned and the results of previous audits. For each audit you must:
Define the audit criteria and scope
Select auditors and conduct audits so that objectivity and impartiality are ensured
Ensure the results are reported to relevant management
Documented information must be available as evidence of the implementation of the audit program and of the audit results.
Note the first bullet in 9.2.1. The internal audit checks your ISMS against your own policies and procedures as well as against the standard. A procedure that says access is reviewed quarterly is an audit criterion, and a missed quarter is a finding.
Who can do the auditing
The standard requires objectivity and impartiality. It does not require the auditor to be external, certified, or full time. The practical rule, consistent with the guidance in ISO 19011, is that auditors should not audit their own work.
For a small organization, that leaves a few workable options:
Staff from another function. A finance or operations lead, trained in audit basics, can audit the security team's processes. The security lead can audit areas they do not run, such as HR's onboarding records.
An external internal auditor. A consultant or firm engaged to perform the internal audit. This is common for first certifications. It cannot be your certification body, which is not permitted to consult on the system it certifies.
A mix. An external auditor for areas the internal team built, and internal staff for the rest.
Whoever audits needs to understand both the standard and how to audit. ISO 19011 gives general guidance on auditing management systems, and ISO/IEC 27007 gives guidance specific to auditing an ISMS. Neither is mandatory; both are useful training material.
Building the audit program
The audit program is the plan for all internal audits over a period, usually a year or the three-year certification cycle. It answers which parts of the ISMS are audited, when, by whom, and how.
Two requirements in 9.2.2 shape it. Frequency should reflect the importance of each process, so high-risk areas are audited more often. And it should respond to previous results, so an area with findings last time is revisited sooner.
A hypothetical program for a small organization might look like this:
| Quarter | Area | Criteria | Auditor |
|---|---|---|---|
| Q1 | Clauses 4 to 6: context, leadership, risk | ISO/IEC 27001 clauses 4 to 6, risk method | External |
| Q2 | Access and identity controls, people controls | Access control policy, Annex A 5.15 to 5.18, 6.1 to 6.6 | Operations lead |
| Q3 | Technological controls: change, vulnerability, logging, backup | Relevant procedures, Annex A 8 sample | External |
| Q4 | Clauses 7, 9, 10; supplier and incident controls | Clauses 7, 9, 10, Annex A 5.19 to 5.28 | Security lead |
Many organizations instead run a single annual audit covering everything. That is acceptable if it is planned and has the depth to find problems. Before initial certification, certification bodies generally expect the internal audit program to have covered the whole ISMS; confirm the expectation with yours.
Running a single audit
Each audit in the program follows the same sequence.
Set the scope and criteria. Write down which processes, controls, locations, and period are in scope, and which documents and clauses are the criteria.
Plan. Prepare a short audit plan with dates, people to interview, and records you will ask for. Share it with the people involved.
Review documents. Read the relevant policies and procedures before interviewing anyone, so you know what the organization says it does.
Gather evidence. Interview control owners, observe activities where possible, and sample records. Pick samples yourself, from complete populations, rather than accepting examples offered by the auditee.
Evaluate. Compare the evidence with the criteria. Record conformities as well as nonconformities, since evidence that something works is also useful.
Hold a closing meeting. Present findings to the people responsible, and agree the facts before the report is written.
Report. Issue the report to relevant management, with findings, evidence, and scope.
Follow up. Findings go into your corrective action process under clause 10.2, with owners and dates.
Sampling is where internal audits most often go wrong. An auditor who asks for "an example of a completed access review" will receive the best one. An auditor who exports the list of systems in scope and picks three will see what the certification auditor will see. The article on types of audit evidence explains why records from the system outweigh screenshots and statements.
Writing findings people can act on
A finding has three parts: the requirement, the evidence, and the gap between them. Written well, it lets the owner fix the problem without asking the auditor what was meant.
A weak finding reads: "Access reviews not performed consistently."
A stronger version reads: "The access control procedure requires quarterly review of production database access. Review records exist for Q1 and Q3. No record exists for Q2. Requirement: access control procedure section 4.2; clause 9.2.1 a)."
The stronger version names the criterion, states the evidence, and is specific enough to verify once corrected. It also avoids the root cause. The auditor's job is to establish the facts; the owner investigates why it happened as part of corrective action.
Grade findings consistently, using the same categories your certification body uses, so internal results and external results can be compared.
Mistakes that weaken the audit
Auditing your own work. The most common independence problem, and the easiest for a certification auditor to spot.
Running it the week before stage 2. There is no time to fix what it finds, so the findings become the certification body's findings.
A checklist with no evidence. "Yes" against each clause, with no records referenced, shows the audit happened but not what it examined.
Clean results every time. An internal audit that never finds anything is rarely a sign of a perfect ISMS.
Findings with no follow-up. Every finding should be traceable to a corrective action and its closure.
Prepare control owners for interviews the same way you would for the certification audit; the guide to preparing control owners for auditor interviews applies to both. Internal audit results feed the management review and are examined at every surveillance audit. For the standard itself, see the ISO 27001 framework page.
How TrustLynce helps
TrustLynce collects control evidence on a schedule from your systems through evidence collection, so an internal auditor can sample complete populations rather than asking for examples. The readiness dashboard shows gaps per clause and control, which helps decide where the next audit should look.