In brief
ISO 27001 Clause 9.2 requires a planned internal audit programme. Learn what it demands, who may run the audit and which records your team must keep.
An ISO 27001 internal audit is a planned, impartial check of your own ISMS, required by clause 9.2 of ISO/IEC 27001:2022. It must show whether the ISMS meets your own requirements and the standard's, and whether it is effectively implemented and maintained. You need at least one complete audit cycle, reported to management review, before the Stage 2 certification audit.
What does ISO 27001 clause 9.2 require?
Clause 9.2 requires internal audits at planned intervals and a managed audit programme. In the 2022 edition it has two parts: 9.2.1 sets what every audit must answer, and 9.2.2 sets how the programme is planned, run and recorded.
Under 9.2.1, each audit must tell you whether the ISMS:
- conforms to your organization's own ISMS requirements, such as policies and procedures;
- conforms to the requirements of ISO/IEC 27001; and
- is effectively implemented and maintained.
The third point is the one most teams underestimate. A policy that exists but is not followed is a nonconformity, so the audit has to test practice, not just read documents.
Under 9.2.2, you must plan the programme (frequency, methods, responsibilities, planning requirements and reporting), take into account the importance of the processes and the results of previous audits, define criteria and scope for each audit, select auditors who ensure objectivity and impartiality, report results to relevant management, and retain documented information as evidence of the programme and its results.
How often do you need to run an internal audit?
ISO/IEC 27001 sets no fixed interval; you decide it in the audit programme based on how important each process is and what earlier audits found. In practice certification bodies expect the programme to cover the whole ISMS within the three-year certificate cycle and expect at least one audit before each surveillance or recertification audit.
A common pattern is one full audit a year, with high-risk or recently changed areas such as access control, supplier management or a new product line audited again when they change. Whatever you choose, write the reasoning into the programme so the external auditor can see it was a decision.
Who can perform the ISO 27001 internal audit?
Anyone competent who can be objective and impartial about the area audited. The 2022 text does not name a qualification; it requires objectivity and impartiality (9.2.2 b) and competence of the people doing the work (clause 7.2).
In practice that rules out people auditing their own work. Options that usually satisfy auditors:
- an employee from another department, for example the HR lead auditing IT controls;
- an external consultant engaged only for the internal audit, not the one who built the ISMS;
- staff from a sister company or another office.
Lead auditor or internal auditor training against ISO/IEC 27001 and the audit guidance in ISO 19011 is a credible way to show competence, though the standard does not require a certificate.
What records must the internal audit produce?
Clause 9.2.2 requires documented information as evidence of the audit programme and the audit results. Certification auditors usually ask to see four things.
| Record | What it contains | Why the auditor asks for it |
|---|---|---|
| Audit programme | Areas, frequency, methods, responsibilities and timing across the cycle | Shows audits are planned, not ad hoc |
| Audit plan per audit | Scope and criteria for that audit | Shows each audit has a defined target |
| Audit report | Conformities, nonconformities, observations and opportunities for improvement, with evidence sampled | The result that feeds management review |
| Corrective action records | Root cause, actions, owners, due dates and effectiveness check for each nonconformity | Proves clause 10.2 is working |
How do internal audit findings become corrective actions?
Every nonconformity found in the internal audit goes into the nonconformity and corrective action process of clause 10.2. The cycle certification bodies look for is:
- record the nonconformity with the evidence that showed it;
- find the root cause, not just the symptom;
- define corrective actions with an owner and a due date;
- check that the actions worked before closing the finding.
Results then go to management review under clause 9.3, which must consider audit results and the status of actions. An audit with no follow-up actions and no management review record is a common Stage 2 finding.
How do you run a first internal audit, step by step?
For a first audit cycle, keep the process simple and documented.
- Write the programme. List ISMS clauses 4–10 and the Annex A controls in your Statement of Applicability, and assign each to an audit window.
- Plan the audit. Set scope (teams, systems, locations), criteria (the clauses and controls to test) and the auditor.
- Build the checklist. Turn each requirement into a test: what record to sample, who to interview, what to observe.
- Collect evidence. Sample records across the period, for example access reviews, change tickets, training records and incident logs, rather than asking "do you do this?".
- Write the report. Classify findings as conformity, nonconformity or observation and attach the evidence.
- Open corrective actions for each nonconformity under clause 10.2.
- Present to management review (clause 9.3) and minute the decisions.
Schedule the audit early enough that nonconformities can be closed, or at least have credible action plans, before the certification body arrives. The overall timing of certification is covered in how long ISO 27001 certification takes.
How is an internal audit different from the certification audit?
The internal audit is your own check; the certification audit is the independent assessment that leads to a certificate.
| Internal audit | Certification audit | |
|---|---|---|
| Performed by | Competent, impartial internal staff or a hired auditor | An accredited certification body |
| Purpose | Find and fix gaps; give management assurance | Decide whether to grant or maintain certification |
| Basis | Clause 9.2 and your audit programme | ISO/IEC 27001 in full, under ISO/IEC 17021-1 rules for certification bodies |
| Output | Internal audit report and corrective actions | Audit report, nonconformities and the certification decision |
| Timing | As set in your programme, typically at least yearly | Stage 1 and Stage 2, then surveillance audits in years 2 and 3 |
What commonly goes wrong in ISO 27001 internal audits?
- No findings, year after year. A programme that never finds anything suggests a shallow audit; external auditors look harder.
- Document review only. Clause 9.2.1 asks whether controls are effectively implemented, which needs sampled evidence.
- Too late in the calendar. Running the audit the week before Stage 2 leaves no time for corrective action and management review.
- Auditing your own work. The person who wrote the access control procedure should not audit it.
- Verbal results. Without a written report and action records, there is no evidence that the audit happened.
How does pTrackly support the internal audit?
In pTrackly you can create an audit of type Internal audit with a period, build its request list, link each request to controls and evidence, and assign owners. The same evidence tasks your team completes for ISO 27001 throughout the year are what the internal auditor samples, and the audit can be locked at the end, freezing the evidence with SHA-256 fingerprints. Planning the programme, choosing an impartial auditor, judging conformity and running management review stay with your team. See pTrackly for ISO 27001 and the ISO 27001 risk assessment guide, whose outputs the internal audit will test.
Frequently asked questions
Is an internal audit mandatory for ISO 27001 certification?
Yes. Clause 9.2 is a mandatory requirement, and certification bodies expect at least one completed internal audit, with results reviewed in management review, before the Stage 2 audit.
Can we outsource the ISO 27001 internal audit?
Yes. An external auditor can run it, provided they are competent and impartial. The consultant who designed your ISMS is a poor choice, because they would be auditing their own work.
Does the internal audit have to cover all Annex A controls every year?
No. The programme must cover the whole ISMS over the audit cycle, and you decide the frequency per area based on importance and past results. Many teams audit high-risk controls every year and rotate the rest.
What is the difference between a nonconformity and an observation?
A nonconformity is a failure to meet a requirement of the standard or your own ISMS and needs corrective action. An observation is a weakness or risk that is not yet a failure; record it and decide whether to act.
References:
- ISO/IEC 27001:2022, Information security management systems (iso.org/standard/82875.html)
- ISO 19011:2018, Guidelines for auditing management systems (iso.org/standard/70017.html)
- ISO/IEC 17021-1:2015, Requirements for bodies providing audit and certification of management systems (iso.org/standard/61651.html)
