ISO 27001 clause 9.2.2: Planning the internal audit programme
ISO 27001 clause 9.2.2 concerns the programme through which internal audits are planned and carried out. The organisation needs suitable frequency, methods, responsibilities, planning and reporting arrangements, taking account of process importance and previous audit results. Each audit also needs defined criteria and scope.
What clause 9.2.2 requires in practice
Clause 9.2.2 describes the audit programme and how it is run. The organisation must plan, establish, implement and maintain a programme covering frequency, methods, responsibilities, planning needs and reporting. In setting it up, it weighs how much the processes involved matter and what earlier audits found. For each audit it defines criteria and scope. It picks auditors and conducts audits in a way that secures objectivity and impartiality, and it makes sure results reach relevant management.
Documented information must exist as evidence that the programme was put into effect and of what the audits found. The standard does not set a number of audits per year or a particular team size; coverage should reflect risk and history. The outputs are a programme that is maintained rather than written once, individual audit plans, reports to management and retained evidence. Impartiality does not necessarily require an outside firm, but it does require that people do not audit their own work.
Plan coverage around the system
Map the relevant processes, locations and services so the programme does not repeatedly examine the easiest office while missing important operations. Consider significant findings and changes when deciding attention and timing. A recurring weakness can justify a focused follow-up rather than waiting for an unchanged annual cycle.
The programme is broader than a calendar. It explains how audits will provide useful information across the ISMS, who is responsible and how results reach relevant management. Individual audit plans then define the specific scope and criteria. A standard clause checklist can assist, but should not prevent auditors from following real process interactions.
Protect objectivity and impartiality
Select auditors and conduct audits in a way that supports objectivity and impartiality. Relevant competence matters too. A person with deep technical knowledge can still be poorly placed to impartially evaluate their own decisions. Identify conflicts and choose suitable arrangements rather than relying on a statement that everyone will be fair.
A small organisation may use cross-review or an external auditor where appropriate. External status alone does not prove independence of judgement; examine prior involvement, incentives and scope. If a consultant helped design the process, consider how an objective evaluation will be achieved for that work.
ISO 27001 does not mandate a specific internal-auditor certificate or require all audits to be outsourced. Demonstrate suitable capability and a credible audit arrangement. Learning in audit principles can help, but the organisation needs to evaluate the actual competence for its audit context.
Why the audit programme matters to the business
A well-run programme gives the business confidence at modest cost, because attention goes where risk and change are greatest. A fixed checklist repeated each year can miss new services or recurring weak spots while appearing orderly. Impartial auditors give management findings it can trust, and reporting to relevant managers turns findings into decisions. Programme records are also among the first items an external assessor requests, since they show how the organisation checks itself. Gaps here, such as areas never audited or the same person reviewing their own function, are common causes of external findings and can weaken confidence in the whole ISMS.
How to implement clause 9.2.2
The programme should be a living plan, adjusted by importance and results. One way to set it up follows. Give the programme an owner who maintains it through the year, so coverage responds to incidents, changes and findings as they arise.
- Define the audit universe: processes, sites, suppliers and controls, with a note of why each matters.
- Score or rank each by importance and by findings from earlier audits, and use that ranking to set depth and frequency.
- Fix methods and responsibilities, including who plans, who audits, who approves reports and who tracks follow-up.
- Name auditors for each audit with a check that they have no stake in the area, or arrange a swap with another team.
- Prepare a plan for each audit stating criteria, scope, sampling approach and timing.
- Report to the managers responsible and to top management in an agreed format, then record agreed actions.
- Revise the programme after each round, recording why coverage changed.
Illustrative examples
The programme covers shared governance and samples client-specific operations across locations. Previous findings show recurring handover gaps on one shift, so a follow-up examines whether corrective actions operate there. The programme does not assume that an audit of the daytime head-office team represents every service arrangement.
The person maintaining the ISMS also operates several controls. Management brings in suitable independent support for areas where self-review would undermine objectivity, while retaining internal responsibility for the programme and action decisions. The audit scope and evidence access are agreed rather than treating a purchased report as a complete programme.
Report and retain useful evidence
Report results to relevant management and retain documented evidence of programme implementation and audit results. Plans, scope and criteria, auditor assignments, reports and follow-up records can support that evidence. Records should explain what was actually covered, not merely what the calendar intended.
Track the response to findings through appropriate processes. Corrective action addresses requirement failures and their causes, while the audit programme can include appropriate verification. Closing a finding because an owner promises to act is different from evidence that the necessary action is complete and effective.
Common weaknesses
Watch for audits repeatedly postponed, major scope areas omitted, auditors reviewing their own work without safeguards and reports never reaching the people who can resolve issues. A fixed list of questions that ignores previous findings is another warning sign.
Review programme effectiveness. Did audits reveal useful information? Were important processes evaluated with adequate evidence? Were limitations reported accurately? A programme that produces many pages but few reliable conclusions is not necessarily providing the intended assurance.
Frequently asked questions
Must we audit every process on the same annual date?
No universal schedule is prescribed. Plan suitable coverage and intervals, considering process importance and previous results, and adjust where the organisation’s needs justify it.
Can we outsource internal audits?
Yes, with suitable competence, objectivity, scope and evidence access. The organisation retains responsibility for its audit programme and response to results.
What records are needed for the programme?
Keep documented evidence of programme implementation and audit results. The format can vary, but it should show what was planned, what was performed and what was concluded.
Build an audit programme around what matters
Talk to Sterling to prioritise the audit programme using process importance and previous results, then establish competent reviewers, reporting and retained evidence. Build the relevant knowledge through ISO 19011 Auditing Management Systems at Sterling Academy. We can also assess whether Effivity ISO & GRC automation software suits the agreed workflow and programme. Certification decisions remain with an independent certification body.