May the information security officer audit the ISMS internally?

Only the parts they neither own nor built. Clause 9.2 makes auditor independence a condition. The audit programme therefore assigns the parts they built to another auditor, for example from another department or engaged externally. They can audit the other parts if the audit programme names them as the auditor for those parts.

How often does internal auditing have to take place?

The standard requires audits at planned intervals but sets no fixed cycle. The organisation sets the frequency in its audit programme, taking into account the importance of the processes and the results of previous audits. On that basis, an area with open nonconformities from the last audit can come back into the programme sooner than an area without findings.

Does the internal audit replace the certification audit?

No, and the reverse does not hold either. The internal audit is a requirement of ISO/IEC 27001 and takes place independently of the external audit. In the certification audit, the certification body also checks conformity with clause 9.2, meaning whether internal audits were planned, carried out, reported and followed up. A missing internal audit is therefore a finding in itself.

What separates the internal audit from the management review?

The internal audit gathers evidence and establishes whether requirements are met. The management review under clause 9.3 is where top management decides whether the ISMS is still fit for purpose and working. Under the core text, audit results are one of its inputs. The audit supplies the basis, and the management review takes the decisions.

What belongs in an audit report?

The audit objective, criteria and scope, the audit team, the areas and periods examined, the evidence gathered, the findings with their classification, and open points from previous audits. Clause 9.2 also requires the results to reach management and to be evidenced. Without the evidence, a finding can later be neither traced nor closed.

Internal Audit: ISO 27001 Clause 9.2 Requirements

What is an internal audit?

An internal audit is a management system's self-examination by the organisation that runs it. For an ISMS, ISO/IEC 27001:2022 prescribes it in clause 9.2.

It is a precondition for certification, as the guide to ISO 27001 certification shows.

What does ISO 27001 clause 9.2 require?

Clause 9.2 covers two levels: the audit programme, which plans audits over a period, and the individual audit. Its core text comes from the harmonized structure that ISO sets for management system standards. An auditor looks mainly at three points:

The programme explains which areas are audited when, and takes earlier results into account.
The auditors are independent of what they audit.
The results have reached management and are evidenced.

An organisation running several standards built on this structure can keep one audit programme; each standard adds its own criteria and any discipline-specific requirements.

How does an internal audit work?

An internal audit runs in seven steps. Guidance on planning and conduct is given in ISO 19011:2026.

Step	Content
Planning	Set audit objective, criteria, scope and dates; send the audit plan to the auditees
Opening	Agree the process, confidentiality and how findings are handled
Fieldwork	Interviews, review of records, samples, observation on site
Evaluation	Evaluate the evidence against the criteria; classify findings
Closing	Discuss results and classification with the auditees
Report	Findings, underlying evidence, evaluation, open points
Follow-up	Agree corrective actions and check that they work

Without the last step, an audit produces documentation but no improvement. The internal audit checklist lists the planning and fieldwork points.

Independence: nobody audits their own work

The duty of objectivity and impartiality rules out anyone auditing their own area or a procedure they built. Smaller organisations can solve this through mutual audits between departments or by engaging external auditors. An audit carried out by an engaged external auditor remains an internal audit, as long as the organisation commissions it and is responsible for it. How internal audits and certification audits differ is set out in the comparison of internal vs external audits.

Audit questions that demand evidence

A document shows whether a policy exists. Whether it is followed only shows in samples from day-to-day operations. Useful audit questions therefore name the evidence up front:

Instead of asking	Ask
Is there an access control concept?	Show me the last three leavers and when their access was removed.
Are changes approved?	Show me the last five production changes and the related approval.
Is there a supplier assessment?	Show me the assessment of the most recently engaged critical supplier.
Are incidents recorded?	Show me the last incident and when it was reported to whom.

The left column can be answered with a document, the right only with records. The selection of audit points can be derived from the Statement of Applicability and the risk treatment.

How are audit findings classified?

The BSI audit scheme for ISO 27001 certification on the basis of IT-Grundschutz sets out a public classification (chapter 4.6). The scheme is published by Germany's Federal Office for Information Security (BSI) and distinguishes three levels:

Level	Meaning	Consequence in the certification audit
Recommendation	Suggestion for improvement with no binding effect	Given a deadline for review
Minor nonconformity	Individual aspects of a requirement are missing, but its purpose is achieved	A certificate may still be issued
Major nonconformity	A shortcoming that significantly endangers the effectiveness of the ISMS	No certificate can be issued or maintained

Several minor nonconformities can together amount to a major one. The terms are explained in the entry on nonconformity.

Five patterns that devalue internal audits

The audit programme covers the same low-risk areas year after year.
Auditors check documents instead of operational records.
Findings are toned down to avoid conflict.
The audit report reaches management only with the management review, when there is no time left for corrections.
Auditors check areas they helped to build.

What an internal audit finds in Rizzqo

For the internal audit, Rizzqo carries each requirement answer with its rationale and evidence files on the asset the requirement applies to. Finalised answers are recorded with name and timestamp, so the auditor examines confirmed statements.

The coverage logic helps with sampling. An asset counts as fully covered only when every assigned requirement has been finalised as fulfilled or not applicable. An answer that has not been finalised counts as open. The audit programme can therefore be aimed at the open requirements.

Browse all entries Back to top

Internal Audit