Internal audit
An internal audit is an audit you arrange of your own management system, to check it meets the standard and your own rules and is working as written. Your staff or a contractor can run it, as long as nobody audits their own work. Its findings feed corrective action and the management review.
- Clauses
- ISO 27001:2022 9.2 · ISO 9001:2015 9.2 · ISO 13485:2016 8.2.4 · ISO 42001:2023 9.2 · SOC 2 CC4.1
Where the term appears
ISO 27001:2022 9.2, ISO 9001:2015 9.2 and ISO 42001:2023 9.2 ask for audits at planned intervals under a programme you design, with defined criteria and scope, auditors chosen for objectivity and impartiality, results reported to management, and evidence kept. ISO 13485:2016 8.2.4 adds a documented procedure and requires that auditors do not audit their own work. SOC 2 has no clause by that name: SOC 2 CC4.1 asks you to evaluate whether controls are working, and an internal audit or a readiness assessment is one way to show it. The ISO 27001 internal audit page covers the programme in detail.
Internal or certification
The two are often confused. An internal audit is yours: you set the scope and use the findings to improve. A certification audit is the certification body’s, and one of the things it checks is that your internal audits happened and were impartial.
How Sted uses it
- For ISO 27001 clause 9.1 and 9.2 Sted’s knowledge base carries the Internal Auditing Procedure (PRC-IAP) with its Internal Audit Schedule (REC-IAS), Internal Audit Plan (REC-IAP) and Internal Audit Report (REC-IAR), and the Monitoring and Measurement Procedure (PRC-MMP) with its Monitoring and Measurement Framework Record (REC-MMFR) and Monitoring and Measurement Record (REC-MMR).
- Records are part of the Full Management System plan.
- Audit readiness is the share of done items per adopted standard: approved documents, adopted requirements, records and training.
- Audit readiness is visible to administrators only for now.
Audit readiness counts what is recorded in Sted. It is not an internal audit and does not replace one.
Related terms
- Certification audit: often confused with an internal audit; run by the certification body.
- Nonconformity: what an internal audit finds.
- Evidence: what an auditor samples.
- Management review: where the results go.
- How to plan and run an internal audit: building the programme and running each audit.