ISO 27001 clause 9.2.1: Purpose of the internal audit
ISO 27001 clause 9.2.1 establishes the purpose of internal audit: providing information on whether the ISMS meets the organisation’s own requirements and ISO 27001, and whether it is effectively implemented and maintained. The audit should test reality against relevant criteria. It is more than checking that documents have been produced.
What clause 9.2.1 requires in practice
Clause 9.2.1 states why the organisation audits itself. Audits at planned intervals must provide information about two matters. The first is conformity, which has two reference points: the organisation's own requirements for its ISMS, such as the policies, procedures and commitments it has set, and the requirements of ISO 27001 itself. The second is whether the system is effectively implemented and maintained, meaning that it works in practice and stays working over time.
This framing has consequences. Auditing against the standard alone is not enough, because the organisation's own rules are also part of the yardstick. A conforming system on paper that is not applied fails the second test. The clause names the purpose rather than the method, so audit style, team structure and timing are for the organisation to design. The output is reliable information for management about the state of the ISMS, not a certificate or a pass mark.
Understand the two kinds of criteria
The standard supplies requirements, while the organisation’s own system can include policies, procedures, commitments and selected control arrangements. An auditor needs to identify which criterion applies to the issue being examined. A preferred technique from an external guide is not automatically a mandatory requirement.
For Annex A, consider the organisation’s control-selection process, Statement of Applicability and actual applicable arrangements. Do not mechanically assume every control is mandatory for every organisation. Equally, an unjustified exclusion or a necessary control missing from treatment can be an important finding.
Test implementation and maintenance
Read the declared process, then follow representative transactions. Interview people who perform the work and inspect suitable records. A procedure describing prompt access removal is not persuasive if departed users still have active access. A one-time demonstration before certification does not show continuing maintenance.
Sample across relevant scope, locations, services and time periods in a way appropriate to the audit. Sampling provides evidence, not certainty that every transaction is correct. Record the basis and limitations sufficiently for a reader to understand the conclusion. A remote audit can be useful when methods provide adequate access to relevant evidence.
Clause 9.2.1 calls for audits at planned intervals. The detailed programme requirements are in clause 9.2.2. There is no universal rule here that every organisation must use exactly one annual audit of identical length and coverage.
Why the purpose of internal audit matters to the business
Clarity about purpose prevents wasted audits. When people see audits as a hunt for faults, they hide problems; when they understand the aim is to give leaders accurate information, they cooperate. Measuring against both internal rules and the standard exposes a common trap, where a team follows the standard but ignores its own procedure, or vice versa. Knowing whether the system is effective, not just present, also helps decide where to spend limited security effort. External assessors and customers value this clarity because it shows the organisation is not relying on them to find its gaps, and that audit findings are treated as input to improvement.
How to implement clause 9.2.1
Define what each audit is meant to establish before the work begins. A practical sequence is shown below. Keep the wording of purpose and criteria simple, because auditees who understand the aim give more open and useful answers.
- State the purpose of the audit round in a sentence leaders will recognise, such as confirming that access removal works across all sites.
- List the internal requirements to be tested, such as approved procedures and customer commitments, alongside the relevant parts of the standard.
- Decide what counts as effective for the area, for example outcomes observed in records and interviews, not only a procedure on file.
- Brief auditees on the aim so that they expect questions about how work is done.
- Keep technical testing, such as scanning, distinct from the audit, and use its results as one input rather than a substitute.
- Make clear that an external assessment does not replace the internal audit.
- Summarise conclusions for management in terms of conformity and effectiveness, with the evidence behind each.
Illustrative examples
The auditor compares approved criteria with a sample of normal and urgent releases. One urgent change lacks a required review. The finding links the evidence to the applicable organisational requirement rather than criticising the team for not using the auditor’s favourite delivery tool.
The organisation’s treatment plan requires controlled vendor access to a relevant system. The auditor follows authorisation, provisioning, use and removal for a representative support activity. A supplier’s security certificate is considered, but it does not replace checking the manufacturer’s own responsibilities and actual interface.
Evidence and conclusions
A useful finding identifies the criterion, objective evidence and nature of the issue. Distinguish a requirement failure from a potential improvement. Avoid overstating a sample as proof of universal failure, but also investigate whether an observed problem suggests a wider systemic weakness.
Audit results should help management understand conformity and effectiveness, including where evidence is limited. Reports should not be written solely to create an all-green pre-certification story. Clear findings give the organisation a chance to correct weaknesses before they cause greater harm.
Common mistakes
Document-only audits, interviews limited to the ISMS coordinator and findings based on unsupported opinion weaken the result. So does treating a lack of incidents as proof that controls operate effectively. Select evidence that relates to the process and the requirement under review.
An internal audit is distinct from the certification body’s independent assessment. It is an organisational management activity, not a promise of certification. Link findings to corrective action where appropriate and use the programme to verify that improvements are sustained.
Frequently asked questions
Does internal audit only check ISO 27001 wording?
No. It also considers the organisation’s own ISMS requirements and whether the system is effectively implemented and maintained.
Can an auditor raise a finding because they prefer a different tool?
Preference alone is not an audit criterion. A finding needs an applicable requirement and objective evidence of the issue.
Is an internal audit the same as a certification audit?
No. Internal audit supports the organisation’s management system. Certification is decided through the independent certification body’s assessment process.
Make internal audit answer the conformity question
Talk to Sterling to define audit criteria and evidence that assess both your own ISMS requirements and the applicable standard, with suitable objectivity. Build the relevant knowledge through ISO 19011 Auditing Management Systems at Sterling Academy. Certification decisions remain with an independent certification body.