ISO 27001 internal audit
The internal audit is a mandatory requirement of ISO 27001 (clause 9.2) and one of the smartest investments in your ISMS. You discover for yourself what is wrong before the external auditor sees it. The NEN version of the standard states that you carry out internal audits at planned intervals to check whether the ISMS meets the requirements and works effectively. The full audit process, including the external certification audit, is described on the audit process page.
The external auditor expects evidence of internal audits. No internal audit report means a major nonconformity. Plan the internal audit well ahead of the certification audit or surveillance audit, so you have time to resolve findings.
What does the internal audit check?
The internal audit checks whether the ISMS meets:
- The requirements of ISO 27001: clauses 4 to 10
- The organisation’s own requirements: policies, procedures and objectives that you have set yourself
- The selected Annex A controls: whether the controls in your SoA have demonstrably been implemented
The audit checks both conformity (do you meet the requirement?) and effectiveness (does it work?). A procedure that exists but is never followed is a finding.
Planning the internal audit
Set up an audit programme
The audit programme describes all the internal audits you plan for the coming year. ISO 27001 does not necessarily require one audit a year, but it does require that all parts of the ISMS are audited regularly. Many organisations spread the audits across the year, for example half in quarter 2 and the other half in quarter 3.
Include in the audit programme which parts are audited, when, by whom and on the basis of which criteria. Keep the programme, because the external auditor will want to see it.
Set audit criteria
The audit criteria are the standards you test against: the standard itself, your own policies, procedures and the selected Annex A controls. Describe the criteria per audit area in the audit plan.
Appoint an independent auditor
The internal auditor may not audit their own work. This is a firm requirement. The IT manager does not audit their own IT processes. The ISMS owner does not audit the ISMS they have built.
For small organisations, this often means one of the following options:
| Option | Suitable for | Point of attention |
|---|---|---|
| Employee from another department | Organisations with 20 or more employees | Training in audit techniques needed |
| External internal auditor | All organisations | Cost; no trusted employees needed |
| Partly external | Hybrid approach | Flexible, popular with small and medium-sized businesses |
Set up an audit plan for each audit
The audit plan describes the scope, the purpose, the criteria, the planned activities and the duration. Send the plan to the auditees in advance, so they know what is expected and which documents need to be ready.
Carrying out the internal audit
Document review
Start by reviewing the documentation: is the scope up to date, is the information security policy current, are the procedures available and of the right version? Check whether the documents have been approved and are properly version controlled.
Interviews
Speak with employees who are responsible for ISMS processes. Ask open questions: “How do you handle a security incident?”, “When did you last update a risk assessment?”, “How do employees know which data they must not forward?” The answers show whether processes are actually being followed.
Observation and evidence
Ask for evidence. Training records, incident logs, access logs, backup reports. If a procedure says backups are checked weekly, you want to see the check record. If it is missing, that is a finding.
Use the checklist below as a guide.
Internal audit checklist for ISO 27001
| Clause or control | Check | Finding |
|---|---|---|
| 4.3 Scope | Is the scope documented and up to date? | |
| 5.2 Policy | Is the policy approved, dated and communicated? | |
| 6.1.2 Risk assessment | Is the risk assessment recent and have risk owners been assigned? | |
| 6.1.3 SoA | Does the SoA cover all Annex A controls with justification? | |
| 7.2 Competence | Is training documented for relevant employees? | |
| 7.3 Awareness | Do employees know the policy and how to report? | |
| 9.2 Internal audit | Are previous audit results available and have findings been resolved? | |
| 9.3 Management review | Are minutes available and have actions been followed up? | |
| A.6.3 Awareness | Is there an awareness programme and are participants recorded? | |
| A.5.24-5.28 Incidents | Is there an incident register? Are incidents analysed? | |
| A.8.5 Authentication | Is MFA used for systems with sensitive access? |
Reporting the internal audit
The audit report records the findings. ISO 27001 does not prescribe how extensive the report must be, but it must contain at least:
- The date and scope of the audit
- The processes and people audited
- The criteria used
- Findings per clause or control (conformity, observations, nonconformities)
- A corrective action per nonconformity, with an owner and a deadline
Share the report with management and use it as input for the management review. The external auditor will request the report at the certification audit. A worked example with findings and actions is available on the internal audit report page.
A report without findings is suspicious. A well-functioning ISMS always has areas for improvement. Auditors value honesty: a report with three minor findings that have been resolved is stronger than an empty report.
Do it yourself or outsource?
| Do it yourself | Outsource |
|---|---|
| Cheaper | More independent judgement |
| Requires internal knowledge of the standard | External party knows the standard well |
| Independence is a challenge in small teams | Ready to deploy immediately |
| Builds internal competence | Less transfer of knowledge |
For a first certification, many organisations choose external support for the internal audit. After certification, you build internal audit capacity so you can lower the costs of later cycles.
Internal audit and the step-by-step plan
The internal audit belongs in phase 8 of the step-by-step plan: after building the ISMS and implementing controls, but well before the external certification audit. Plan at least four to six weeks between the internal audit and the certification audit, so you have time to resolve findings and gather evidence.
Repeat the internal audit every year as part of your maintenance strategy after certification.
More information
- The audit process: the external certification audit and surveillance
- Step-by-step plan: the internal audit within the overall route
- Maintenance after certification: the yearly internal audit cycle
- Requirements of the standard: clause 9.2 explained
- Statement of applicability: what the auditor checks