What is an internal audit?

An internal ISO 27001 audit involves a detailed assessment of your organization’s Information Security Management System (ISMS) to ensure it complies with the standard's criteria. Unlike an external certification audit done by a certification body, an internal audit is carried out by employees who are independent of the ISMS and have auditing expertise or qualifications. Alternatively, you can also use an external service provider who can conduct these audits for you. 

The assessment will identify areas that require attention, helping you meet ISO 27001 requirements and enhance your organization’s operations. Record these observations and analyze the audit results at regular management review meetings.

What is covered under ISO 27001 clause 9.2?

ISO 27001 has several clauses that companies must follow if they want to be certified. One example is clause 9.2, which states that the organization must conduct internal audits at predetermined (planned) intervals to assess whether their ISMS:  

• Complies with internal requirements

• Meets the ISO 27001 standard 

• Is implemented and maintained properly 

To meet those objectives, the Certification Body (CB) auditor checks whether:  

• An audit programme was planned, executed, and maintained 

• The audit criteria for each audit and scope were defined 

• Audits were reported to the appropriate management 

• Documented information was kept as evidence
  

You should also consider the following requirements to aid in being compliant to clause 9.2: 

• Auditors must be unbiased and impartial to the audit process, ensuring an objective review that meets high standards 

• Auditors can be internal or external, as long as they don’t audit areas they helped create or implement 

Internal audits are commonly outsourced to ensure expertise and maintain impartial, objective reviews. External experts support you on your way to ISO 27001 certification and beyond.

Why do organizations need to audit their ISMS?

Internal audits in line with ISO 27001 ensure that the ISMS and its procedures comply with the standard's criteria. The benefits of conducting an internal audit include: 

• Finding out about nonconformities before they can hinder you from passing the external certification audit 

• Identifying areas requiring attention to protect your organization from a security incident 

• Educating management about the organization’s current security level 

• Encouraging continuous improvement in the organization’s information security efforts 

• An additional benefit is that an ISMS compliant with ISO 27001 covers a large part of the requirements of the new NIS2 Directive

ISO 27001 internal audit checklist

Navigate your internal audit process with this five-step checklist. 

1. Examining the documentation 

Start by reviewing the documentation prepared during your ISMS implementation. This ensures that the audit’s scope is aligned with your circumstances, establishing clear outlines for what needs to be audited. 

Next, identify the key stakeholders of the ISMS. Having these contacts defined will make requesting any necessary documents easier. 

2. Consulting with management 

The audit activity starts to take shape at this point. Before drafting a thorough audit plan, consult with management to determine the audit's timeline and resources. 

Establishing goals on which you submit progress updates to the board is a common part of this. At this early stage, meeting with management allows both sides to align on expectations. 

3. Field review

Typically, this will be the practical evaluation of your ISMS. Organizational sectors identified as critical during the ISO 27001 risk assessment should be given more attention at the start of the internal audit process. You will often need to:

• Talk to employees about how the ISMS works in practice (i.e. information regarding policies and procedures they should know and be following). 

• Validate evidence while conducting audit tests 

• Complete audit reports to keep track of each test's outcomes 

Examine any ISMS documents, printouts, and other relevant information

4. Analysis

The evidence gathered during the audit should be processed and examined against your organization’s risk treatment plan and security goals. This approach can reveal gaps in the evidence or indicate the need for further testing. 

5. Report

The audit findings must be recorded, typically in a report, and presented to management. The following items should be included in your ISO 27001 internal audit report: 

• The scope, objectives, and timeline of the work completed 

• The individuals who were part of the audit process and their role in the organization 

• An executive summary including key findings, high-level analysis, and a conclusion 

• The report's intended recipients, along with categorization and distribution guidelines, if applicable 

• An in-depth analysis of the results with conclusions and opportunities for improvement

• A statement outlining any scope suggestions or constraints 

The report usually includes management agreeing to an action plan. Therefore, further review and amendments may be necessary.