Skip to main content
All measures

Measure · ISO 27001 and other standards

Plan and conduct internal audits

Connect the audit programme, individual audits and actual results. Keep criteria and scope specific and link findings to the existing corrective action process.

Accountable: Audit coordinator with competent impartial auditorsReviewed

Reuse existing records

Use the ISMS handbook, existing audit records and existing finding or task records. The template is an alternative when these do not yet contain the necessary information.

What to do

  1. 1

    Plan the programme and each audit

    Plan frequency, methods, responsibilities and reporting according to process importance and previous audit results. Define the scope and criteria of each audit. Include the organisation's own ISMS requirements, ISO requirements and actual operation. Select competent auditors so that objectivity and impartiality are maintained.

  2. 2

    Evidence the work and conclusion

    Examine the planned subject using appropriate records, interviews and actual processes. Record the assessed state, relevant samples, traceable evidence and findings. Explain the conclusion on conformity with the audited requirements and on effective implementation and maintenance. State the limits of the actual audit scope.

  3. 3

    Report and connect follow-up work

    Report results to the relevant management and retain evidence of that step. Update the programme entry with the actual report or a justified change. Connect nonconformities to the existing corrective action process in handbook chapter 10. Assign responsibility, deadlines and result checks there rather than creating a second findings list.

Worked example

An internal audit examines an access review

Fictitious example: the programme includes an audit of one team's access management process. The auditor is not responsible for the grants being examined.

Criteria and evidence
DecisionThe audit compares current internal rules with selected access grants, revocations and recorded access reviews.
EvidenceIdentified rule version, sample and traceable findings in the audit report.
Open finding
DecisionA missing review is handled in the existing finding record and reported to relevant management.
EvidenceReport, ownership and traceable correction with result verification.

Record the result

  • Audit programme and specific plan with criteria, scope, method and competent objective auditors.
  • Evidence of actual execution, traceable results and reporting to relevant management.

Common implementation mistakes

Only ticking Annex A fields

An internal audit also examines management requirements, the organisation's own requirements and their effective application in operation.

Treating a plan as a completed audit

A date or completed plan does not replace an audit. Record actual execution and its evidence.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards

  • ISO/IEC 27001 · 9.2.1

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    The individual plan identifies the organisation's own ISMS requirements and ISO requirements. The report connects the actual scope, objective evidence and conclusion on conformity, effective implementation and maintenance. Competent auditors must actually conduct the audit; a prepared or completed file alone does not demonstrate this.

    Reference

  • ISO/IEC 27001 · 9.2.2

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    Programme fields prepare frequency, methods, responsibilities, planning and reporting and take account of process importance and earlier results. Individual plans record criteria, scope and the selection of objective impartial auditors. The report and programme status can evidence execution and reporting. The user must implement the plan, ensure impartiality, actually inform relevant management and retain the result records.

    Reference

Templates for your implementation

Sources and further reading