ISO 27001 clause 9.2 requires internal audits of the information security management system at planned intervals, by people who do not audit their own work. Findings feed corrective action and management review.
Internal audits do not replace the external audit, but they find problems before it does.
Read more
Related terms
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.
- Nonconformity
- A nonconformity is a failure to meet a requirement of a management system standard or of the organization's own documented management system.
- Management review
- Management review is the recurring review in which top management assesses whether the management system is still suitable, adequate and effective.