What is an internal audit?
An internal audit is a review of the management system by someone independent of the area being audited. ISO 27001 and ISO 42001 both require internal audits at planned intervals, and the certification body expects at least one before certification.
What clause 9.2 asks for
Both standards require internal audits at planned intervals to check two things: whether the management system conforms to the standard and to the organisation’s own requirements, and whether it is effectively implemented and maintained.
The audits are run as a programme. The organisation decides how often, by what methods and by whom, taking account of how important each process is and what earlier audits found.
- Criteria and scope. Each audit states what it checks against and what it covers.
- Objective auditors. Auditors are chosen so the audit is objective and impartial, which in practice means nobody audits their own work.
- Reported results. Findings go to the relevant management.
- Kept records. The programme and the results are retained as documented information.
Who can carry it out
The auditor does not have to be external or hold a certification, but must be objective. In a small company that rules out the compliance lead who built the ISMS auditing their own controls. Common choices are a colleague from another team with audit training, or an outside auditor hired for the job.
Hiring the consultant who implemented the system to audit it raises the same problem. Certification auditors check who carried out the internal audit, and a reviewer who audited their own work can lead to a finding.
What happens to the findings
Internal audit findings are handled like any other nonconformity. Under clause 10.2 the organisation reacts to it, finds the cause, takes corrective action and checks that the action worked. The results also feed the management review under clause 9.3.
A common approach is to plan audits so that every clause and every applicable Annex A control is covered at least once in the three-year certification cycle, with higher-risk areas audited more often.
Certifyi lets you plan your internal audit calendar in the same workspace as the controls being audited, which makes a coverage plan like this easier to keep track of across the cycle.
Questions
Internal audit, answered
Can we outsource the internal audit?
Yes. Many small companies hire an outside auditor for it. The organisation still owns the programme, the follow-up of findings and the records.
How often do we need an internal audit?
The standards say “at planned intervals” and leave the frequency to you. An annual cycle is common, and the certification body expects an internal audit to have been completed before the Stage 2 audit.
Is this the same as a corporate internal audit function?
No. A corporate internal audit function usually reports to the board’s audit committee and covers financial and operational controls. An ISO internal audit is narrower: it checks the management system against the standard.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them