ISO 27001 internal audit: requirements, process and best practice

An ISO 27001 internal audit is one of the most important activities within an Information Security Management System (ISMS). It helps organisations assess whether their controls, processes and policies meet ISO 27001 requirements and are operating effectively.

Despite being a mandatory requirement of the standard, many organisations find the ISO 27001 internal audit process confusing, particularly when preparing for certification for the first time.

This guide explains everything you need to know about conducting an ISO 27001 internal audit, including audit requirements, planning, auditor responsibilities, reporting and common challenges.

Let’s start with the basics…

What is an ISO 27001 internal audit?

Internal audits are a mandatory requirement under Clause 9.2 of ISO 27001, but they are also an important way to verify that your Information Security Management system (ISMS) is functioning as required and to identify opportunities for improvement.

Whilst internal auditing will be new businesses without existing certifications, they are actually more straightforward and valuable than you might think.

  Learn about our internal audit services here.

Why are internal audits required under ISO 27001?

It is a mandatory requirement of the ISO 27001 standard to conduct and document internal audits “at planned intervals” to validate the suitability and adequacy of the ISMS.

The generally accepted interpretation of the requirement is that an organisation will conduct internal audits against all clauses and controls of the standard over the three-year certification cycle.

The audits should be run according to a documented schedule that prioritises high-risk areas, and with the assumption that no less than two internal audits will have been completed and documented ahead of the Stage 2 certification assessment.

On rare occasions, a certification auditor may ask an organisation to conduct and document internal audits against all clauses and controls of the standard prior to the Stage 2 certification assessment.

The auditor may quote other standards in support of their request, although this comes down to interpretation and is certainly not an explicit requirement of ISO 27001.

To prevent any last-minute surprises and potential delays in certification, it is useful to ask the selected Certification Body for a written confirmation of their expectations regarding internal audits during your implementation project.

To learn about ISO 27001 certification stages and other FAQs, read and download our FREE Guide To ISO 27001.

Work in Human Resources? Read our latest blog on HR Security in ISO 27001.

When should ISO 27001 internal audits be conducted?

As is often the case, the ISO Standard specifies that audits must be conducted at planned intervals but leaves it to the organisation to decide what this means. Indeed, a company may decide to spread the load by scheduling audits on a monthly or even a weekly basis.

Alternatively, it may elect to conduct audits less often, such as on a quarterly basis or to cram them all during a period of lower activity over two to three weeks.

Furthermore, an organisation may justifiably decide to prioritise, and if required, repeat audits where a clause or control may have highlighted improvement opportunities or gaps in compliance previously.

Creating an ISO 27001 audit schedule

Whatever the approach, audit dates must be documented in an audit schedule, although this does not mean that the dates are set in stone. Indeed, they can be moved to reflect changes to the organisation’s risk landscape or appetite, or simply to allow competing activities to take priority.

However, having a documented and approved audit schedule demonstrates your organisation’s commitment to compliance and, importantly, to continual improvement.

Who should conduct an ISO 27001 internal audit?

As for all employees within the organisation, ISO expects that the members of staff who have been selected as internal auditors will have received training that is appropriate to their role.

In this instance, this may be achieved by them attending an internal, external or online auditing course. Numerous training providers offer ISO 27001 Internal Auditor and Lead Auditor training courses.

In a small organisation where staff may wear more than one hat, internal auditing may be an unwanted burden, both in terms of resourcing and from a cost perspective.

It may also be difficult to maintain both impartiality and objectivity as the nominated auditor may be required to audit their own area of responsibility or their own managers.

Consequently, small organisations may decide to outsource their internal auditing to a qualified third party like Evalian, who will act as their external ISO 27001 consultant and be able to provide an independent review of their compliance with the standard and with their own policies and processes.

The use of a third party is, of course, not reserved for small companies. Larger organisations may also choose this option as they may not wish, or indeed be able to justify maintaining a team of auditors, or simply to avoid any internal conflict of interest.

In addition, an audit report produced by a specialist organisation may carry more weight and be more readily accepted if coming from outside of the organisation and away from internal politics.

ISO 27001 internal auditor competence requirements

The person conducting an ISO 27001 internal audit should have the knowledge, skills and experience necessary to assess the effectiveness of the organisation’s Information Security Management System (ISMS).

While ISO 27001 does not ask for a specific qualification, auditors are expected to receive appropriate training in auditing techniques, ISO 27001 requirements and the organisation’s own policies and procedures.

Many organisations choose to provide formal Internal Auditor or Lead Auditor training to ensure auditors can carry out assessments consistently and effectively.

As well as technical knowledge, it is important that the auditor is independent and objective. Internal auditors should, wherever possible, avoid auditing their own work or areas for which they are directly responsible. This helps ensure findings are unbiased and credible.

In larger organisations, this may involve auditors reviewing departments outside their normal responsibilities. Smaller organisations often overcome potential conflicts of interest by using an external ISO 27001 internal auditor.

Auditors who have completed recognised ISO 27001 Lead Auditor qualifications can also bring additional expertise, particularly when assessing complex controls, identifying non-conformities and preparing the organisation for certification audits.

Can internal audits be conducted remotely?

ISO audits used to be conducted on-site. However, COVID restrictions proved that remote audits can be carried out just as successfully. Understandably, the benefits of increased flexibility and lower costs appeal to many organisations.

In most cases, auditors can view the evidence they require in screen-sharing sessions. Physical security audits may be a little trickier, but not necessarily impossible, so long as the audited organisation is happy for an employee to act as the auditor by walking around the site with a camera.

Auditors often accept this as a compromise, with the caveat that physical security arrangements will be verified in person at a subsequent onsite surveillance audit.

ISO 27001 internal audit process: step-by-step

The following high-level steps should be considered when approaching an internal audit.

Step 1: Define the audit scope

Before the audit begins, the scope should be clearly defined and agreed upon. This helps ensure that all relevant areas of the ISMS are assessed and that sufficient time and resources are allocated to the audit. The scope should identify which departments, processes, locations, systems and controls will be reviewed, as well as any exclusions that may apply.

Defining the audit scope often requires discussions with key stakeholders across the organisation, including process owners, department managers and members of the ISMS team. These conversations help the auditor understand how information security is managed in practice and ensure that important areas are not overlooked.

A well-defined scope provides a clear framework for the audit, reduces the risk of gaps in coverage and helps ensure that audit findings accurately reflect the effectiveness of the ISMS.

Step 2: Review the ISMS documentation

AN important part of the ISO 27001 internal audit process involves reviewing the documentation that supports the ISMS. The documentation will include things like policies and procedures, risk assessments, and the Statement of Applicability (SOA), as well as training records and audit findings.

The goal here is to make sure that all documentation is complete, with no loose ends and gaps, and it’s up to date according to the ISO 27001 standard. From there, you can move confidently onto the evidence gathering and interviews.

Step 3: Prepare the ISO 27001 internal audit plan

The auditor should prepare an audit plan based on the approved Audit Schedule. The audit plan should confirm the scope of the audit, the date, the time, the duration, the audit criteria, and whether the audit will be conducted on-site or remotely.

It should also clarify that the audit will be sample-based. The plan should be submitted to the auditee for approval so that there is no misunderstanding on the day.

The audited organisation should ensure that resources are available on the day and that they have been briefed appropriately

Step 4: Conduct interviews and gather evidence

The auditor should confirm to the auditee the purpose and scope of the audit, that he is on a fact-finding mission and aims to be impartial and objective and should explain the objectives of each interview. They should record facts and supporting evidence presented by the auditee.

Areas of improvement and non-compliance should be summarised at the end of each audit, ensuring that there are no doubts about the key issues, and the next steps and timelines should be clearly stated.

Step 5: Record findings

Any findings throughout the audit should be documented clearly and supported by evidence to back them up. Non-conformities, or opportunities for improvement, should be tracked against the relevant ISO 27001 requirement. This will help the organisation understand where actions may need to be taken to strengthen its ISMS.

Step 6: Produce the ISO 27001 internal audit report

The audit report should reiterate the purpose and scope of the audit and provide an overall summary of compliance and the findings. It should also clearly state Opportunities for Improvement and non-Conformities.

Once completed, the report should be issued to the auditee for review and comment. The final report should document agreed actions with individual action owners, deliverables, timescales and measures of effectiveness.

Audit actions should be logged, tracked to completion and reported against as per the Non-Conformity and Corrective Action Management process and/or the Continual Improvement process.

Step 7: Track corrective actions

Once the audit is complete, any agreed actions should be assigned to an owner and tracked through to completion. Organisations should verify that corrective actions have addressed the root cause of identified issues and assess their effectiveness to support continual improvement and ongoing compliance.

ISO 27001 internal audit checklist

Documentation	Operational Evidence	Governance
> ISMS scope > Risk assessment > SoA > Policies	> Training records > Incident records > Supplier reviews	> Management review > Previous audits > Corrective actions

Common ISO 27001 internal audit findings

It doesn’t matter how mature your ISMS is, issues can till be uncovered during an ISO 27001 internal audit. In many cases, this isn’t due to bad security practices, but often gaps in documentation, evidence collection or ongoing management of the ISMS. y identifying the issues early, you can address them before they become larger issues during the certification process or a surveillance audit.

Missing evidence: to demonstrate that controls are operating effectively

Outdated policies: no longer reflecting current processes within the organisation

Incomplete risk assessments: that fail to capture new or emerging threats

Corrective actions: that haven’t been fully implemented or closed out

Lack of staff awareness: unfamiliar with security policies, reporting procedures or their own responsibilities within the ISMS.

Whilst one or two of these issues may seem minor in isolation, they can show weaknesses in your organisation’s approach to improving and maintaining its management system.

Benefits of an ISO 27001 internal audit

The whole point of internal auditing is to uncover issues early. This will allow your organisation to strengthen its compliance and ultimately reduce risk. Not only does it support your security framework, but it also demonstrates your commitment to continual improvement.

It also puts you in good standing for the external audit, and finally, your goal is to successfully pass the ISO 27001 certification.

Final thoughts on internal audits

Undoubtedly, while internal audits will help ascertain that the ISMS is effectively implemented and appropriately maintained, their main benefit is their contribution to a company’s commitment to continual improvement.

Indeed, an internal audit helps identify opportunities for improvement as well as non-conformities. A typical audit report will contain actions that must be addressed by the auditee.

The auditor will review previous reports at their next visit and will want to see that opportunities for improvement have been considered and that nonconformities have been corrected. But also, for the latter, ensure that a root cause analysis has taken place to at least reduce the risk of recurrence.

Properly managed, internal audits should lead to increased levels of compliance, reduced risk exposure, reinforced security and maintained integrity. They offer a way to identify gaps in compliance, opportunities for improvements and potential risks to the organisation.

People are often in fear of auditors and, in doing so, fail to realise that the auditor can be a valuable resource! They provide an independent view of how your management system is managed, and their findings should help you promote improvement, and may also help you justify training, authorise recruitment and more generally leverage investment.

Need help with your internal auditing?

If you are thinking of gaining ISO accreditation, we’re here to help wherever you are on your decision path.

We can help with an initial workshop, carry out a full gap analysis, help you with integrating ISO 27001 and ISO 9001 into one management system, support your ISO project or manage your management system for you.

We can also help you understand what to look for when choosing an ISO 27001 certification body.

If you operate a remote gambling product in the UK market, you need to be licensed by the Gambling Commission (UKGC) under sections 89 and section 97 of the Gambling Act 2005. Learn more here about the Gambling Commission RTS Security Audit. 

If you’d like to understand more about our ISO services, we’d be delighted to hear from you. You can find out more about our iso consultancy services here.

Find out how CadDo, a SaaS organisation based in London, successfully certified to ISO 27001 first time, with expert support from their Evalian lead auditor. Watch the full case study here.

ISO 27001 internal audit FAQs

Is an ISO 27001 internal audit mandatory?

Yes. Internal audits are a mandatory requirement under Clause 9.2 of ISO 27001. Organisations must conduct audits at planned intervals to determine whether their Information Security Management System (ISMS) conforms to both the organisation’s own requirements and the requirements of the ISO 27001 standard.

How often should ISO 27001 internal audits be conducted?

ISO 27001 does not prescribe a specific frequency for internal audits. Instead, organisations are expected to establish an audit programme based on their risks, objectives and operational needs. Many organisations conduct internal audits annually, while others spread audits throughout the year to review different areas of the ISMS on a rolling basis.

Who can perform an ISO 27001 internal audit?

An ISO 27001 internal audit can be performed by a trained internal auditor, a qualified employee from another department, or an independent external consultant. Whoever conducts the audit should be competent, objective and, where possible, independent of the area being audited to avoid conflicts of interest.

What is included in an ISO 27001 internal audit checklist?

An ISO 27001 internal audit checklist typically includes a review of the ISMS scope, risk assessments, Statement of Applicability (SoA), policies and procedures, training records, management reviews, corrective actions and evidence that security controls are operating effectively. The checklist should be tailored to the organisation’s specific ISMS and audit objectives.

Can an ISO 27001 internal audit be outsourced?

Yes. Many organisations choose to outsource their internal audits to experienced ISO 27001 consultants or specialist auditing firms. This can provide an independent assessment, reduce the burden on internal teams and help maintain objectivity, particularly in smaller organisations where staff may have multiple responsibilities.

How long does an ISO 27001 internal audit take?

The duration of an ISO 27001 internal audit depends on the size, complexity and scope of the organisation’s ISMS. Smaller organisations may complete an audit in a single day, while larger organisations with multiple sites, departments or complex information security controls may require several days to complete a thorough assessment.

What happens if an internal audit identifies non-conformities?

If non-conformities are identified, the organisation should investigate the root cause, implement corrective actions and monitor their effectiveness. Non-conformities do not necessarily indicate a failed management system. Instead, they provide an opportunity to address weaknesses, improve compliance and strengthen the effectiveness of the ISMS before an external audit takes place.