Clause 9.2 requires internal audits at planned intervals to check that the ISMS conforms to your own requirements and to ISO 27001, and that it is implemented and maintained. You need an audit programme that sets frequency, methods, responsibilities and reporting; auditors who are objective and impartial, which means nobody audits their own work; and results reported to management and kept as records. Once a year is the usual floor, with larger or fast-changing organisations auditing more often or spreading areas across the year. The certification body confirms at Stage 1 that an internal audit has been planned and performed, and examines its findings at Stage 2 and at every surveillance audit.
The internal audit is the ISMS checking itself before anyone else does. Done well, it finds the gaps months before the certification body would, at a fraction of the cost, and gives management a picture of the system they are accountable for. Done badly, as a form filled in by the person who runs the ISMS the week before Stage 1, it is the most common cause of a Stage 1 concern and a Stage 2 finding.
What clause 9.2 requires
- Internal audits at planned intervals, to provide information on whether the ISMS conforms to the organisation's own requirements and to the standard, and whether it is effectively implemented and maintained (9.2.1).
- An audit programme, or several, that sets the frequency, methods, responsibilities, planning requirements and reporting, and that takes into account the importance of the processes and the results of previous audits (9.2.2).
- Defined audit criteria and scope for each audit.
- Auditors selected and audits conducted so that objectivity and impartiality are preserved.
- Results reported to relevant management, and the programme and results kept as documented information.
Who can do it
The standard asks for objectivity and impartiality, not for an outsider. A colleague from another team who has had some audit training can audit areas they are not responsible for; an outside auditor or a consultancy that did not build the ISMS can audit all of it; the ISMS owner can audit nothing they own. ISO 19011 is the usual guidance on auditor competence and how to run an audit, and certification bodies look for evidence that whoever audited knew what they were doing. Small companies with one security person usually buy a day or two of external audit a year for this reason.
The programme
- Frequency: once a year is the floor the standard's wording supports and what most certification bodies expect; large organisations, or those with many changes, audit twice a year or quarterly.
- Coverage: every clause and every applicable control at least once in the certification cycle, and the clauses 4 to 10 material every year. Spread the Annex A themes across the year if you audit more than once.
- Risk-based weighting: audit sooner and deeper where risks are high, where the last audit raised findings, and where something changed.
- Follow-up: an area with an open nonconformity is audited again at the next opportunity to confirm the corrective action worked.
- Planning: each audit has a documented scope, criteria, auditor, date and the people to interview, agreed in advance with the areas audited.
What to check, clause by clause
| Clause | Questions to ask | Evidence to sample |
|---|---|---|
| 4 Context | Is the scope still accurate? Have issues and interested parties changed? | Scope statement and its last review; the issues and parties register |
| 5 Leadership | Is the policy approved, current and communicated? Are roles filled? | Policy version and approval; acknowledgement records; role assignments |
| 6 Planning | Was the risk assessment repeated on schedule? Do the treatment plan and the SoA agree? Are objectives measured? | Risk register and approvals; SoA versions; objective measurements |
| 7 Support | Are people in ISMS roles competent and trained? Is documentation controlled? | Competence and training records; document versions and approvals |
| 8 Operation | Did the controls in the SoA operate throughout the period? | Operating records for a sample of applicable controls across the Annex A themes |
| 9 Performance evaluation | Is monitoring happening? Was the last management review complete? | Measurement results; previous audit reports; management review minutes against the 9.3 inputs |
| 10 Improvement | Were nonconformities analysed and corrected? Did the actions work? | Nonconformity log; corrective actions and their verification |
For the Annex A controls, the evidence list gives what to sample per control area. Interview the control owner, ask them to show the control running in the live system, and compare what you see with the policy and the Statement of Applicability.
Findings and the report
Use the same grading the certification body uses so nobody is surprised later: a major nonconformity where a requirement is missing or a control has broken down, a minor one for an isolated lapse, and an opportunity for improvement where the requirement is met but weakly. Each nonconformity gets a corrective action under clause 10.2: the correction, the root cause, the action, an owner, a date and a later check that it worked. The report records the scope, criteria, auditor, dates, the people interviewed, the evidence sampled, the findings and the conclusion, and goes to management as an input to the next management review.
How the certification body uses it
At Stage 1 the certification body confirms the internal audit has been planned and performed; at Stage 2 and at every surveillance audit it examines the programme, the reports, the findings and what was done about them. An internal audit that found nothing in a first-year ISMS draws more scrutiny, not less, because it suggests the audit was not independent or not thorough. The Stage 1 versus Stage 2 article and the surveillance guide cover what each visit tests.
Running the internal audit in Noru
Noru keeps an audit programme per framework, with the frequency, the next due date and who runs it, and suggests the least the framework asks for at your size: once a year for ISO 27001, run by an outside auditor where the team is too small to audit its own work. Each audit has a checklist with one row per control in scope, showing what Noru's records say about the control, how to test it and what to ask its owner; the auditor records a result per control, raises findings, and finalises a report that can be exported for the management review and the certification body. The product documentation describes the flow.