Internal audit: general

What the requirement asks

Internal audits must be carried out at planned intervals to give information on whether the ISMS conforms to the organization's own ISMS requirements and to this standard, and whether it is effectively implemented and maintained.

What the guidance adds

The internal audit is expected to be conducted at planned intervals against defined criteria, by people who can be objective. The guidance asks for the scope, the criteria, the method, the findings and the report. An audit that only checks documents will miss the operation.

What good looks like

Keep internal audit reports assessing conformity to the organization's requirements and to ISO/IEC 27001 with the clause record, and give it an owner and a review date.

Evidence an assessor asks for

• Internal auditInternal audit reports assessing conformity to the organization's requirements and to ISO/IEC 27001
• Internal auditEvidence audits covered implementation and maintenance, not only documentation
• Internal auditAn audit schedule showing planned intervals
• Internal auditCoverage of all clauses and applicable Annex A controls over the audit cycle

The question an assessor will ask

An assessor will ask for internal audit reports assessing conformity to the organization's requirements and to ISO/IEC 27001. The test for 9.2.1 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.

Common gaps

• Audits check documents only, not implementation
• Parts of the ISMS are never audited
• Audits are not carried out at the planned intervals
• Audits test against the standard but not the organization's own requirements

Before the next audit

Before the next audit, test this against one live record: audits check documents only, not implementation.