ISO 27001 internal audit: how to plan and run one in a small business

An internal audit is your own check that the ISMS does what the standard and your own policies say it should, before the certification body checks it for you. It isn't a pass-or-fail event. Its job is to find problems while they're cheap to fix.

Certification bodies expect to see at least one full internal audit of the ISMS before the stage 2 audit, and a programme of them every year after.

Why it matters

Internal audit is clause 9.2 of ISO/IEC 27001:2022. In summary, you must:

• Audit at planned intervals to check the ISMS conforms to your own requirements and to the standard, and that it's effectively implemented and maintained.
• Plan an audit programme: how often, which methods, who's responsible, and how results are reported. Base it on the importance of the processes and the results of earlier audits.
• Define the criteria and scope of each audit.
• Choose auditors who are objective and impartial. People shouldn't audit their own work.
• Report results to relevant management and keep evidence of the programme and results.

What an auditor looks for

The certification auditor will audit your internal audit. They'll check:

• A programme exists covering clauses 4 to 10 and the applicable Annex A controls over the cycle, usually a year.
• Audits actually happened, with a plan, notes of what was checked, and a report.
• The auditor was independent of the area audited. In a small organisation this often means an external auditor for some areas, or two people auditing each other's work.
• Findings were followed up. Each finding has a nonconformity or improvement with an owner, and actions were completed.
• Results reached management and appear in the management review.

Common reasons it fails: an audit that only reviewed documents and never sampled records; the ISMS owner auditing their own work; findings that were never closed; or no audit at all in the months before stage 2.

A simple audit plan

Illustrative plan for a small organisation, split into two sittings:

• Audit 1: governance and risk. Clauses 4 to 6 and 9 to 10: scope, policy, roles, risk assessment and treatment, objectives, management review, nonconformities. Sample: three risks from register to treatment to SoA to evidence.
• Audit 2: operations and controls. Clauses 7 and 8 and a sample of Annex A: access control, backup, supplier security, incident management, awareness training. Sample: two leavers' access removal, last quarter's restore test, one supplier's assessment.

For each item, record what you looked at, what you found, and whether it conforms.

Common mistakes, and how to keep it manageable

• Auditing the paperwork only. Pick a sample and follow it through to the evidence. "Show me" beats "tell me".
• Trying to audit everything at once. Spread the programme over the year by topic, so each sitting takes a morning, not a week.
• Writing findings nobody can act on. State the requirement, what you found, and the evidence, in one or two sentences.
• Losing the follow-up. Every finding needs an owned, dated action, or the next audit finds the same thing.

How to do it in ClearIMS

1. Plan the programme. Open Internal audits and set up the audits for the year, with a recurring task so each one comes round on time.
2. Record each audit: its scope, the auditor, what was sampled and the results. ClearIMS asks for the results and a record of the auditor's independence before an audit can close.
3. Raise findings. A finding can raise a linked nonconformity, so follow-up work has an owner and a date.
4. Approve and report. A named person approves the audit record, and the results feed your next management review.

Related pages

• Nonconformities: what audit findings turn into.
• Management reviews: where audit results are reported.
• Audit rehearsals: practising for the certification audit.
• Readiness: where you stand overall.