ISO 27001 Internal Audit: What Clause 9.2 Requires and How to Run One

The ISO 27001 internal audit is the organisation checking its own information security management system before anyone else does. It is a clause 9.2 requirement, the certification body will ask to see it before Stage 2, and done properly it is the most useful improvement tool in the whole system. Done as a box-ticking exercise, it finds nothing and changes nothing.

Short answer

ISO/IEC 27001:2022 clause 9.2 requires internal audits at planned intervals to check two things: that the ISMS conforms to the standard, and that it conforms to the organisation’s own requirements. The audits run under an audit programme that sets frequency, methods, responsibilities and reporting. Auditors must be objective and impartial, results go to relevant management, and the records are kept as evidence. ISO 19011 gives the guidance on how to audit.

What clause 9.2 actually requires

The two checks, and the trap in the second

The first check is the obvious one: does the system meet ISO 27001? The second is the one that catches people out: does the system meet its own requirements? Whatever the ISMS says it does becomes auditable. If a procedure says access is reviewed monthly, a quarterly review is a nonconformity, even though the standard never asked for monthly.

The fix is to write only the requirements the business actually needs and will actually keep. If a commitment adds no value, take it out. If it does add value, keep it and make sure it happens. The organisation decides what its system requires, not the external auditor.

Building the audit programme

A small organisation does not need a separate, elaborate audit programme document. A single management system calendar showing when each clause and control area is audited, alongside management reviews, risk reviews and other recurring activities, meets the requirement and is far more likely to be followed. Larger or higher-risk systems benefit from a more detailed programme that weights audit frequency by risk.

• Cover every clause from 4 to 10 and every applicable Annex A control across the cycle.
• Audit higher-risk areas more often: access management, supplier controls, incident management, change management.
• Revisit areas where earlier audits found problems.
• Line up audits before management review so the results feed into it.
• Make sure a full cycle is complete before the certification audit.

How an ISO 27001 internal audit runs

1. Plan. Set the scope, criteria and the people and records to sample.
2. Review the documents. Policies, procedures, the risk register and the Statement of Applicability for the area being audited.
3. Interview and observe. Talk to the people doing the work and watch the process in action.
4. Sample evidence. Access reviews, joiner and leaver records, change approvals, backup restore tests, supplier assessments, incident records.
5. Report. Nonconformities, opportunities for improvement and what is working well, reported to the people who can act on them.
6. Follow up. Corrections, root cause analysis and corrective actions, tracked to closure and verified.

What a good finding looks like

A useful finding states the requirement, what was found, and the evidence. “Access review not done” is too vague to act on. Compare it with “The access control procedure requires quarterly reviews of privileged accounts; no review records exist for the last two quarters for the finance system”. When a finding comes back, look at the process before the person: if the review keeps getting missed, the process probably does not make it easy to do, assign it clearly or prompt it.

Who should do it

Internal auditors need to understand ISO 27001, understand auditing, and be independent of the area being audited. In a large organisation that can be an internal team auditing each other’s areas. In a small one, the people who built the system are usually the only ones who know it, which is exactly why they should not audit it. That is where an external internal auditor earns their fee.

Internal audit is a different job from the ISO 27001 gap analysis, which happens before the system is built. Both are covered on our internal auditing page, and our ISO 27001 audit guide explains how the internal audit fits with the certification audits.

How Streamline helps

Our Lead Auditors act as consultants who develop, implement and internally audit management systems, so internal audits are part of the consulting service rather than a separate engagement. We can run the whole programme, audit the areas your own people cannot audit objectively, or mentor your team to run it themselves. Read about our ISO 27001 consulting, or talk to us about your internal audit programme.

Frequently asked questions

How often does ISO 27001 require an internal audit?

At planned intervals. The standard does not set a frequency, but every part of the ISMS in scope should be audited across the certification cycle, and certification bodies expect to see at least one complete internal audit before the Stage 2 audit and audits continuing each year after.

Can our own staff do the ISO 27001 internal audit?

Yes, as long as they are competent and objective. The standard requires auditors who are objective and impartial, which in practice means people do not audit their own work. Small businesses often use an external auditor for this reason.

Does the internal audit have to cover all of Annex A?

The audit programme should cover the whole ISMS over the cycle, including the clauses and the controls marked applicable in the Statement of Applicability. Each individual audit can focus on part of it, prioritised by risk and by the results of earlier audits.

What is the difference between an internal audit and a certification audit?

An internal audit is carried out by or for the organisation to check its own system. A certification audit is carried out by an accredited certification body to decide whether to issue or maintain the certificate. The certification auditor will review the internal audit records as evidence that clause 9.2 is working.