Preparing an ISO 27001 internal audit

This guide leads you through an audit in eight steps, with a sample programme, audit questions from industry and a checklist. All examples are invented.

What clause 9.2 requires

• Planned intervals. The standard names no fixed cycle; the programme sets it.
• Audit programme. It covers frequency, methods, responsibilities, planning and reporting. It takes into account the importance of the processes and the results of previous audits.
• Criteria and scope. You define both for each individual audit.
• Objectivity and impartiality. The choice of auditors and the conduct of the audit must ensure both.
• Report to management. The results go to the relevant management.
• Evidence. You keep the implementation of the programme and the audit results as documented information.

The standard does not describe how an audit runs in detail. Guidance exists for that: ISO 19011 for management systems in general and ISO/IEC 27007 in addition for the ISMS. Both are aids, not requirements.

The audit programme over three years

A programme across the three-year certification cycle has proved its worth. Every clause and all applicable Annex A controls appear in it at least once, and important areas every year. The table is an invented example.

Who can audit

Nobody audits their own work. The standard does not require external auditors; impartiality and competence are what count. Three routes have proved themselves in mid-sized companies:

• Internal auditors from quality management. They know audit methods and often ISO 19011. Information security expertise can be added.
• Mutual audits between sites. A colleague from plant A audits plant B and vice versa.
• External auditor. This makes sense when nobody internal is independent, or for special topics such as OT.

Eight steps to your internal audit

1. Approve the programme. Set the cycle, the topics per year, resources and responsibilities.
2. Choose scope and criteria. Decide on clauses, controls, sites and the period. The criteria are the standard and your own rules.
3. Name the audit team. Check that nobody assesses their own work.
4. Send out the audit plan. Tell the auditees about dates, topics and interview partners in good time.
5. Review the records. Read policies, the risk register, earlier reports and open findings, and prepare a checklist.
6. Audit on site. Hold interviews, take samples and go into production as well. Compare what is described with what actually happens.
7. Classify the findings. Word each finding with evidence and a reference to the standard, and discuss them at the close.
8. Report and follow up. The report goes to the relevant management, and the findings go into corrective action and the management review.

Audit questions for your checklist

Good questions ask for something that can be shown. The examples are in our own words and are not the text of the standard.

Classifying findings

The split into major and minor nonconformities comes from certification practice; ISO/IEC 27001 does not set it. You can still use it for your internal audit.

Example from an industrial company

This example is invented. A quality auditor at a valve manufacturer audits access and remote maintenance at the second site.

1. Sample. She compares the active remote accounts with the list of service providers and finds two accounts of former service technicians.
2. Finding. She records a nonconformity, with a reference to the company's own policy and a screenshot of the account list.
3. Immediate correction. IT locks both accounts the same day.
4. Cause. The end of a maintenance contract reaches IT only by email, and that message got lost during the holidays.
5. Corrective action. Purchasing now reports contract ends through a fixed process, and a monthly comparison is added.
6. Effectiveness. A sample after three months shows no more orphaned accounts.

Before the certification audit

ISO/IEC 27001 names no point in time. In practice, however, certification bodies expect internal audits and a management review to have taken place beforehand.

The first internal audit should therefore cover the entire ISMS, meaning clauses 4 to 10 and a representative sample of Annex A. Plan it about two to three months before the stage 2 audit so there is time for corrections.

Typical mistakes

• The builder audits their own work. The information security officer audits the ISMS they built, which breaks impartiality.
• Pure desk review. Reading paper alone does not show whether the rules are lived in the plant.
• No proof of reporting. There is no evidence that the results reached management.
• Correction without a cause. The symptom is gone, and the fault returns in the next audit.
• A clean audit as the goal. An honest audit with findings is more credible than one with no results.

Checklist

• The audit programme states frequency, methods, responsibilities and reporting.
• The importance of processes and earlier results are taken into account.
• Scope and criteria are set for this audit.
• The auditors do not audit their own work.
• The audit plan has been sent, and interview partners are informed.
• A checklist with audit questions is ready.
• Production is included in the plan where it lies in the scope.
• Open findings from earlier audits are part of the audit.
• The report goes to the relevant management and into the management review.

The internal audit in Complass

Spreadsheets, emails and a report in Word rarely show what has already been audited in the cycle. In Complass, programme, audit and correction run as one process:

• Audit programme. You plan the three-year cycle per topic. "Propose plan" fills in the table, with controls that have open findings first. The programme is approved.
• Audit plan. You record objectives, scope, criteria, lead auditor and team. The lead auditor confirms personally that they are not auditing their own work.
• Checklist per clause and control. For each topic you enter the result and a note on the evidence. The results count towards the coverage in the programme.
• Findings and correction. A row becomes a finding. Corrective actions are tasks with reminders, and nonconformities get an effectiveness check.
• Audit report. You download the report as a PDF and file it as evidence in the step for the internal audit.
• Management review. The management report contains audits and open findings as input.

For audits from outside you invite your auditor to an audit free of charge, time-limited and with a log of every access. Certification itself is carried out by an accredited certification body; Complass prepares you for it.

Frequently asked questions

How often do we have to carry out an internal audit?

The standard requires planned intervals and names no fixed cycle. At least one audit a year is common, partly because the management review needs the results. The programme spreads the topics over three years.

May the information security officer carry out the internal audit?

Not for what they built or implemented themselves. They can own the programme and organise the audit. The auditing should be done by someone independent of the area.

Does the auditor need a certificate?

The standard does not ask for a particular certificate. Auditors need the necessary competence and must be impartial. Training helps, and you should be able to show the competence.

Does every audit have to cover all controls?

No. The programme spreads the topics over the cycle. Before initial certification, though, the first audit should cover the entire ISMS, with a representative sample of Annex A.

Can we combine the audit with the ISO 9001 audit?

Yes, this works well in practice, because both standards require an internal audit. Keep the ISMS part clearly identifiable, though, and plan in enough information security expertise.

In a demo we show you how programme, checklist and findings come together in Complass.

Request a demo Try it for 14 days

Read more

• Whitepaper "ISO 27001: the road to certification – for companies in every sector"
• ISO/IEC 27001 in Complass: from project mandate to certification audit
• Compliance management: catalogues, action plan and evidence

Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The wording of your licensed copy of the standard is authoritative.