ISO 27001 internal audit report with example
An internal audit report records what your internal audit checked, what you found and what you are doing about it. ISO 27001 requires you to carry out internal audits in clause 9.2, but it does not prescribe what the report looks like. A usable report contains at least the scope, the criteria, the findings per requirement or control and, for each finding, a corrective action with an owner and a deadline. You can read how to plan and carry out the audit itself on the internal audit page. The outcome then goes to the management review.
The standard requires documented information as evidence of the audit programme and the audit results. In practice, having no internal audit report means a nonconformity at the external audit. See the audit process for how the certification body weighs this.
What must an internal audit report contain?
An auditor reading the report must be able to establish, without speaking to you, what was checked, by whom, with what evidence and what the result was. That gives the minimum structure:
| Section | What you write | Why the auditor wants to see it |
|---|---|---|
| General details | Date, auditor, department or process audited | Traceability over time |
| Scope | Which parts of the ISMS and which locations | Showing the report fits the scope |
| Criteria | Clauses from ISO 27001 and your own policy documents | The assessment framework was set in advance |
| People interviewed | Roles, not only names | Showing the right people were spoken to |
| Findings | Per clause or control: conforming, observation or nonconformity | The core of the report |
| Corrective actions | Action, owner, deadline, status | Evidence that you resolve nonconformities (clause 10.2) |
| Conclusion | Does the ISMS work in this area, yes or no, with explanation | Input for the management review |
Example: an internal audit report
Below is a fictional example for a small software company, “Example Ltd”. Use it as a template and replace the sample entries with your own findings.
Internal ISMS audit report, Example Ltd
- Date: 14 October 2026
- Auditor: E. Bakker (internal, independent of IT management)
- Process audited: access management and onboarding
- Scope: production environment and Microsoft 365, Utrecht office
- Criteria: ISO 27001:2022 clauses 5.2, 7.2, 7.5 and Annex A.5.15 to A.5.18, plus the access policy version 2.1
Summary
The access policy is up to date and known to the team. For three of the five new employees examined, the access request was approved on time. For two, it was not. One departed employee still had access to a shared folder for 11 days. There are two nonconformities and one observation.
Findings
| No | Requirement or control | Finding | Classification | Corrective action | Owner | Deadline | Status |
|---|---|---|---|---|---|---|---|
| 1 | A.5.18 access rights | Departed employee had access to a shared folder for 11 days | Nonconformity | Link the offboarding checklist to the HR leaver notification | IT management | 15 November 2026 | Open |
| 2 | A.5.18 access rights | Access request for 2 of 5 new employees was not approved before their start date | Nonconformity | Make approval mandatory in the request form | Team lead | 31 October 2026 | Closed |
| 3 | 7.5 documented information | Access policy has no approval date in the header | Observation | Add the header at the next revision | Security officer | 30 November 2026 | Open |
Conclusion
The process works in broad terms. The two nonconformities have an owner and a deadline. At the next internal audit, point 1 will be checked again using a sample of the employees who left in the past quarter.
Classifying findings
ISO 27001 itself only uses the term nonconformity. Conforming and observation are common terms in audit practice. Many certification bodies also use the terms major and minor. That classification is not in the standard, so ask your certification body which one it uses.
- Conforming: the requirement is demonstrably met. No action needed, but keep the evidence.
- Observation: the requirement is met, but there is a risk or room for improvement. No mandatory action, but follow it up.
- Nonconformity (minor): a requirement is not fully met, but the ISMS as a whole functions.
- Nonconformity (major): a requirement is missing or not working, or the system as a whole does not function. This can put the certification at risk.
Note: an observation you ignore often becomes a nonconformity at the next audit.
How do you write a finding?
A good finding has four parts: what you saw, which requirement or control it concerns, what evidence you saw and what the consequence is. Compare:
Poor finding
“Access management is not in order.”
This says nothing. The owner does not know what needs to change, and the auditor cannot check it.
Good finding
“For 2 of the 5 onboardings examined (A.5.18), the access request was only approved after the start date. Evidence: ticket numbers HR-2026-0412 and HR-2026-0419. Consequence: two employees worked with rights for a week without formal approval.”
The difference lies in the evidence. Without a ticket number or file, every finding is an opinion.
What does the auditor ask?
At the certification audit, the external auditor almost always asks for the internal audit report, the internal audit plan and the evidence that nonconformities have been resolved. They want to see that you were critical of yourself. A report without a single finding raises questions, especially if the ISMS shows many areas for improvement in practice. See also the audit questions and checklist for what the auditor checks per role.
Common mistakes
- A copy of the previous report. The same text in three consecutive years shows that nobody is looking.
- Findings without a corrective action. A nonconformity without an owner and a deadline is not resolved.
- No scope or criteria. Then it is unclear what you did and did not check.
- Auditor and auditee are the same person. Clause 9.2 requires objectivity and impartiality in the audit process. An owner checking their own work rarely raises a nonconformity.
- The report sits in a folder nobody shares. It must go to top management, because it is input for the management review.
From report to management review
The findings and the status of corrective actions are a standing input for the management review. So take the report to management within a few weeks of the internal audit. That way, top management can make decisions about resources and priorities, and the report shows that the cycle is running.
If you have not yet set up the ISMS, start with the baseline measurement. There is nothing to audit internally while the basic documents are missing. See the step-by-step plan.
Frequently asked questions
How long must an internal audit report be kept? The standard does not give a fixed period. Keep it at least until the next external audit, and check the period in your own documentation policy.
Must the report be signed by an external party? No. You must show, however, that the auditor was independent of the process audited. A signature from management on receipt helps.
Can a short report of one page be enough? Yes, provided all the sections in the table above are included. Length says little; traceability and follow-up are what count.
More information
- Standard: NEN-EN-ISO/IEC 27001 (Dutch publication)
- Internal: ISO 27001 internal audit, the audit process, management review