ISO 27001 Internal Audit: Follow the Evidence

What clause 9.2 requires in practice

Clause 9.2 sets out how the organisation obtains independent assurance about its own ISMS. Internal audits are carried out at planned intervals to tell management two things: whether the system conforms, both to the organisation's own requirements for it and to ISO 27001, and whether it is effectively implemented and maintained. The second subclause adds the machinery for this. A programme covers frequency, methods, responsibilities, planning and reporting, takes account of the importance of processes and previous results, and sets criteria and scope for each audit. Auditors are chosen and audits run so that objectivity and impartiality are protected, and results go to relevant management. Documented information must show that the programme was carried out and what the audits found. The outputs are a living programme, audit reports and the evidence behind them.

9.2.1: define what the audit needs to establish

The audit considers both stated requirements and actual operation. The organisation's own requirements can include approved processes, policies and other commitments within the ISMS. The audit criteria should make clear what evidence will be compared against; vague expectations produce vague findings.

A security test and an internal ISMS audit serve different purposes. Technical testing can provide evidence relevant to a control, while an audit also examines management-system requirements, responsibilities and implementation. One does not automatically substitute for the other. Likewise, an external certification audit does not remove the organisation's requirement for internal audit.

9.2.2: build a programme around importance and experience

The audit programme addresses frequency, methods, responsibilities, planning and reporting. It considers the importance of the processes concerned and previous audit results. Individual audits need defined criteria and scope, and auditor selection and conduct need to preserve objectivity and impartiality. Results are reported to relevant management, with documented evidence of programme implementation and results retained.

As a suggested approach, give more attention to a newly introduced service with significant information dependencies or a process with repeated findings. Explain why particular coverage was chosen. A fixed annual checklist copied unchanged may miss important developments, even when the schedule looks orderly.

Why internal audit matters to the business

Internal audit finds problems while the organisation can still correct them quietly. It tests whether policies reach practice, whether owners know their duties and whether controls work as described. For management it is the most direct check on the ISMS between external assessments, and a strong programme often prevents findings from arising later. Customers and external assessors also read the audit record as a sign of maturity: an organisation that finds and fixes its own gaps is easier to trust than one that has never found any. A weak audit, one that only confirms a policy exists, wastes time and gives false comfort that can be costly when an incident follows.

How to implement clause 9.2

A good programme is risk-led, impartial and followed through. One workable way to build it is below. Use a mix of interviews, observation and records, since each reveals different weaknesses, and avoid auditing only from documents on a shared drive. Keep reports factual and short.

1. List the processes, locations and controls within scope, and rank them by importance and past problems.
2. Plan coverage across the cycle, giving new or changing areas earlier and deeper attention.
3. Define criteria for each audit, naming the requirements and internal rules the evidence will be compared against.
4. Select auditors who are competent and do not audit their own work.
5. Audit by following evidence through the actual process, including interviews and observation, not only reading policies.
6. Report findings clearly to the managers responsible and to top management, with enough detail to act on.
7. Track follow-up, and use results to shape the next round of the programme.

Example: a BPO employee moves between customer accounts

Example: a manufacturer's supplier maintenance access

Another audit examines remote maintenance for a production system. Procurement holds the supplier agreement, engineering arranges visits and IT enables access. Following a recent maintenance event reveals whether those responsibilities connect in practice, including approval, supervision, closure and handling of exceptions.

This cross-functional trail is often more useful than auditing each department in isolation. It can show that every team completed its own task while the overall access remained open. That finding concerns the process interaction, which a document-only review might overlook.

Preserve impartiality and report useful findings

A small organisation may have limited options for auditor assignment. It still needs arrangements that protect objectivity, such as suitable cross-functional or external support. Competence includes understanding the audit method, applicable criteria and enough of the process to evaluate evidence. Seniority alone does not establish auditing competence.

A clear finding distinguishes the criterion, observed evidence and the conclusion. It should avoid unsubstantiated accusations and should not prescribe one consultant's preferred solution as if it were the standard's requirement. Management then considers correction and corrective action through the relevant process.

An audit report should also make its boundaries understandable. Sampling, unavailable evidence and exclusions from the agreed audit scope affect how confidently readers can interpret the result. “No findings” is not a guarantee that no weaknesses exist.

Evidence and common mistakes

Explore each numbered part