ISO 27001 internal audit

ISO 27001:2022 asks you to measure how well your security works (9.1) and to audit your own ISMS at planned intervals (9.2.1) through a programme you design (9.2.2). Audits must be objective and impartial, results go to relevant management, and you keep evidence of both the programme and its findings.

The requirement in plain English

Monitoring and measurement (ISO 27001:2022 9.1). You decide what to monitor and measure, including the processes and controls of the ISMS, how, when, who does it, and when the results are analysed and by whom. The methods should give comparable, reproducible results. You keep the results and use them to judge both security performance and whether the ISMS is effective.

Internal audit (ISO 27001:2022 9.2). The 2022 edition splits this clause in two.

General (ISO 27001:2022 9.2.1). You audit at planned intervals to find out whether the ISMS meets your own requirements and the standard’s, and whether it is effectively implemented and maintained.
Audit programme (ISO 27001:2022 9.2.2). You plan the programme: how often, which methods, who is responsible, how audits are planned and reported. It takes account of how important each process is and what earlier audits found. Each audit has defined criteria and scope. Auditors are chosen and audits run so the result is objective and impartial. Results are reported to relevant management. You keep documented information on the programme and the results.

Findings feed corrective action (ISO 27001:2022 10.2). ISO 19011 gives guidance on auditing management systems but is not a requirement.

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 25-person B2B software company keeps a one-page audit programme for the three-year certificate cycle. It splits the ISMS into eight areas (clauses 4 to 10, then the Annex A themes grouped by owner), audits the riskiest areas every year and the rest at least once per cycle, and reschedules after any major incident.

The head of operations and the lead engineer audit each other’s areas, after a short auditor course. An external auditor covers the security lead’s own work, because nobody in-house is independent of it, and that engagement is also scoped to serve as the independent review the Annex A controls ask for (ISO 27001:2022 Annex A 5.35).

Each audit has a plan with criteria, scope, sample size and interviews. The report records conformities as well as findings, graded as nonconformities or opportunities for improvement, each with evidence. Every nonconformity becomes a corrective action with an owner and a date, and the report goes to the leadership team before management review.

Monitoring runs alongside: five or six security measures, such as patching within target, access reviews completed, phishing-test results and incident response times, reported monthly with a target for each.

Evidence an auditor expects

Audit programme (required documented information): the certification auditor checks frequency, coverage over the cycle and the risk basis for it.
Audit plans and reports (required as results): sampled for criteria, scope, evidence behind each finding and who received the report.
Auditor independence: the auditor checks nobody audited their own work, and asks how auditors were chosen.
Corrective actions from findings: traced from the report into the corrective action record and checked for closure.
Monitoring and measurement results (required): the auditor asks what you measure, the latest figures and what you did about a figure off target.

Common mistakes

The security lead audits the security lead

In small companies the person who wrote the ISMS also audits it. That fails the impartiality test in 9.2.2, and certification auditors check it. Swap areas between colleagues or buy in an external auditor for the parts nobody else can audit.

A checklist that only reads the standard back

Questions such as “Is there an access control policy?” find documents, not practice. Audit against your own procedures as well as the standard, and sample real records: a leaver’s access removal, a supplier review, a change approval.

Programme without a risk basis

Auditing every area every year in the same order wastes effort on stable areas and under-audits risky ones. The clause asks you to consider importance and previous results. Weight the programme and say why in it.

No conformities recorded

A report that lists only findings gives management nothing to judge effectiveness by. Record what you checked and found working, with the evidence, so the next audit can sample differently.

Measuring activity, not effectiveness

Counting tickets closed says little about security. Choose measures that show whether a control works, such as time from a critical patch release to deployment.

How Sted helps

For ISO 27001 clause 9.1 and 9.2 Sted’s knowledge base carries the Internal Auditing Procedure (PRC-IAP) with its Internal Audit Schedule (REC-IAS), Internal Audit Plan (REC-IAP) and Internal Audit Report (REC-IAR), and the Monitoring and Measurement Procedure (PRC-MMP) with its Monitoring and Measurement Framework Record (REC-MMFR) and Monitoring and Measurement Record (REC-MMR).
Records are part of the Full Management System plan.
33 periodic record types come with a suggested frequency, but nothing is scheduled until you pick a first due date.
Audit readiness is the share of done items per adopted standard: approved documents, adopted requirements, records and training.
Audit readiness is visible to administrators only for now.
Readiness counts four kinds of item per adopted standard (each linked document approved; its requirements for that standard adopted or excluded with a reason; at least one closed record per record template; each assigned person’s training completed), counts an item shared by two standards once overall, and reads 0% for a standard with nothing linked.
Only evidence from the last 12 months counts towards readiness.

Audit readiness counts what is done; it is not an internal audit. Sted does not audit your ISMS; a competent, impartial person you choose does, and records it here.

Internal audit guide: planning and running an audit step by step.
Management review: where audit results go next.
Improvement, nonconformity and corrective action: what happens to each finding.
Audit readiness: how Sted counts the evidence that is in place.
Internal audit: the term, and how it differs from a certification audit.

Frequently asked questions

Can a small company audit itself for ISO 27001?

Yes, as long as nobody audits their own work. In a small team two people can audit each other’s areas, or you can bring in an external auditor for the parts nobody independent can cover. Whoever audits needs enough knowledge of the standard and of auditing to do it properly.

Does the internal audit have to cover everything before stage 2?

Certification bodies expect at least one internal audit and one management review before stage 2, and most expect the audit programme to have covered the whole ISMS by then. Over a three-year certificate cycle, every clause and every applicable control should have been audited at least once.

Is internal audit the same as the independent review in Annex A 5.35?

No. Internal audit checks the ISMS against the standard and your own rules. Annex A 5.35 asks for an independent review of your whole approach to information security at planned intervals or after significant change; an external internal auditor can often provide both, if you scope it that way.