Internal audit programme
The organization must plan, establish, implement and maintain one or more audit programmes that set out how often and how audits are done, who is responsible, what planning they need and how they are reported, taking into account the....
What the requirement asks
The organization must plan, establish, implement and maintain one or more audit programmes that set out how often and how audits are done, who is responsible, what planning they need and how they are reported, taking into account the importance of the processes involved and the results of earlier audits. Each audit gets defined criteria and a defined scope, choose auditors and run audits so the process is objective and impartial, and make sure results reach the relevant managers. Documented information must be available as evidence of the programme's implementation and of audit results.
What the guidance adds
The audit programme is expected to be planned with frequency, methods, responsibilities, requirements and reporting. The guidance asks the organization to consider the importance of the processes and the results of previous audits. A programme that audits the same three clauses every year is not risk based.
Status of the guidance. The guidance lens for 9.2.2 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Keep the internal audit programme with frequency, methods, responsibilities, planning and reporting, weighted by process importance and prior results with the clause record, and give it an owner and a review date.
Evidence an assessor asks for
- Audit programmeThe internal audit programme with frequency, methods, responsibilities, planning and reporting, weighted by process importance and prior results
- Audit programmeAudit plans stating criteria and scope for each audit
- Audit programmeEvidence of auditor objectivity and impartiality, such as auditors not auditing their own work
- Audit programmeAudit reports and their distribution to relevant management
The question an assessor will ask
An assessor will ask for the internal audit programme with frequency, methods, responsibilities, planning and reporting, weighted by process importance and prior results. The test for 9.2.2 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.
Common gaps
- Auditors audit their own areas
- The programme ignores previous audit findings when setting priorities
- Audit criteria and scope are not stated
- Results are not reported to management
Before the next audit
Before the next audit, test this against one live record: auditors audit their own areas.