Bottom Line Up Front
Your ISO 27001 internal audit is the mechanism that proves your information security management system (ISMS) actually works — not just on paper, but in daily practice. This guide walks you through planning, conducting, and reporting an internal audit that will hold up when your external certification auditor comes knocking.
For a first-time internal audit covering a full ISMS scope, expect 2-4 weeks of elapsed time: roughly 3-5 days of planning, 5-10 days of fieldwork depending on your organization’s size, and 2-3 days for reporting and follow-up. A 30-person SaaS startup can move faster; a multi-site healthcare organization with complex scope will take longer.
The internal audit isn’t a formality you rush through to check a box. It’s your best opportunity to find and fix gaps before an external auditor does — and before a real incident does.
Before You Start
Prerequisites
You’ll need:
- A documented ISMS with policies, procedures, and your current risk register
- Your Statement of Applicability (SoA) identifying which Annex A controls are in scope and why
- Access to systems, logs, and personnel across every department in scope
- An internal audit program (your multi-year audit schedule) and this specific audit plan
- A GRC platform or, at minimum, structured spreadsheets for tracking findings and evidence
Stakeholders to Involve
- Executive sponsor / top management: reviews audit scope and results, owns the management review input
- ISMS manager or security lead: coordinates logistics, owns corrective actions
- Department heads (IT, HR, Engineering, Legal, Facilities): provide access and answer auditor questions
- The internal auditor(s): must be independent of the process being audited — your IT manager shouldn’t audit their own change management controls
Scope
This guide covers the full internal audit lifecycle: planning, fieldwork, nonconformity documentation, and reporting into management review. It does not cover building your ISMS from scratch or writing your initial risk assessment — those are prerequisites, not steps within this process.
Frameworks This Satisfies
The internal audit is a mandatory clause requirement in ISO 27001 itself. It also generates evidence useful for SOC 2 (control testing documentation), HIPAA risk analysis updates, and any framework requiring demonstrated continuous monitoring — so if you’re managing multiple frameworks simultaneously, structure your internal audit program to capture overlapping evidence once.
Step-by-Step Process
Step 1: Establish Independence and Competence
What to do: Assign auditors who did not design or operate the controls they’re testing. For small organizations, this often means bringing in an external internal auditor (a common and acceptable practice) or having department leads audit each other’s areas.
Why it matters: Auditor independence is a specific clause requirement. External certification auditors will ask who conducted your internal audit and verify they weren’t auditing their own work.
What can go wrong: Startups with a five-person security team often have the same person who wrote the access control policy also “auditing” it. This is a textbook nonconformity waiting to happen.
Time estimate: 1-2 days to identify and brief auditors.
Step 2: Build the Audit Plan
What to do: Define scope (which locations, departments, and controls), audit criteria (your ISMS documents plus the standard itself), and a schedule. Map every Annex A control in your SoA to an audit activity so nothing gets missed.
Use a simple audit plan template:
| Control Area | Auditor | Date | Evidence Source |
|---|---|---|---|
| Access Control (A.9) | J. Rivera | June 3 | IAM logs, access review tickets |
| Supplier Security (A.15) | J. Rivera | June 4 | Vendor contracts, DPAs |
| Incident Management (A.16) | M. Chen | June 5 | IR plan, ticket history |
Why it matters: An unstructured audit misses controls and leaves gaps that surface later — usually during your external audit, which is the worst time to discover them.
What can go wrong: Teams scope the audit too narrowly, covering only technical controls and skipping HR security, physical security, or supplier management — all common weak spots.
Time estimate: 1-2 days.
Step 3: Notify Stakeholders and Request Evidence
What to do: Send department heads a heads-up with the schedule and a list of evidence you’ll need — access review records, training completion logs, change tickets, vendor risk assessments, firewall configs, incident tickets.
Why it matters: Surprise audits generate defensiveness and scrambling, not useful evidence. A heads-up window (typically 1-2 weeks) gets you better-prepared interviewees and cleaner evidence.
What can go wrong: Vague evidence requests (“show me your security stuff”) produce vague, unusable responses. Be specific: “Export the last quarter’s privileged access review from your IAM tool.”
Time estimate: 1 day to send, 3-5 days lead time before fieldwork begins.
Step 4: Conduct Fieldwork — Interviews, Document Review, and Technical Testing
What to do: This is the core of your internal audit. For each control area:
- Review the documented policy or procedure
- Interview the control owner to confirm the process matches the document
- Sample evidence (e.g., pull 10 access review records, not all 200) to test whether the process was actually followed
- Note any gap between documented policy, stated practice, and observed evidence
For technical controls, this may include reviewing SIEM alert configurations, testing whether MFA is enforced for all privileged accounts, or confirming vulnerability management scan cadence matches policy.
Why it matters: This is where you find the gap between “we have a policy” and “we follow the policy” — which is exactly what external auditors test for.
What can go wrong: Auditors accept verbal assurances without evidence (“yeah, we do access reviews quarterly”) instead of requesting the actual review record. Always ask: “show me.”
Time estimate: 5-10 days depending on scope and organization size.
Step 5: Document Findings
What to do: Classify every finding as a major nonconformity (systemic failure or missing control), minor nonconformity (isolated lapse in an otherwise working control), or observation (opportunity for improvement, not a failure).
Why it matters: This classification drives urgency and corrective action timelines. Major nonconformities typically need resolution before certification; minor ones get tracked with a remediation deadline.
What can go wrong: Internal auditors soften findings to avoid friction with colleagues. Resist this — a diluted internal audit report is worse than no audit at all, because it creates false confidence.
Time estimate: 1-2 days.
Step 6: Report and Route to Management Review
What to do: Compile findings into a formal internal audit report: scope, methodology, findings by control area, and overall conclusion on ISMS effectiveness. Present this to top management as input to your management review meeting.
Why it matters: The standard requires that internal audit results feed into management review, where leadership makes resourcing and risk-acceptance decisions.
What can go wrong: Reports get filed and forgotten instead of driving a tracked corrective action plan with owners and deadlines.
Time estimate: 1-2 days.
Step 7: Track Corrective Actions to Closure
What to do: For every nonconformity, assign an owner, root cause, corrective action, and deadline. Re-test closed items in your next audit cycle or sooner for major findings.
Why it matters: An open finding with no owner is functionally the same as no audit at all.
Time estimate: Ongoing until closure; verify within 30-90 days depending on severity.
Verification and Evidence
To confirm your internal audit was done correctly, check for:
- A signed audit plan showing scope, criteria, and auditor assignments
- Interview notes and evidence samples for every control area in your SoA
- A findings log with classification, root cause, and corrective action status
- Meeting minutes showing the internal audit report was presented at management review
- Evidence of corrective action closure, including re-tested evidence where applicable
When your external auditor asks to see your internal audit program, they’ll want all of the above — plus proof that this wasn’t your first and only internal audit. Certification requires a sustained audit program, not a one-time event.
Common Mistakes
- Using the same person to design and audit a control. Fix: rotate auditors across departments or bring in an external resource for independence.
- Treating the audit as a documentation review only. Fix: always sample live evidence and interview control owners — don’t just read policies.
- Softening findings to avoid internal conflict. Fix: separate the audit report’s objectivity from the relationship management needed to fix issues.
- Scoping the audit too narrowly around IT controls. Fix: map every Annex A domain in your SoA, including HR, physical security, and supplier management.
- Letting findings sit open with no deadline. Fix: require an owner and date at the moment a finding is logged, not after the report is finalized.
Maintaining What You Built
Run your internal audit program on at least an annual cycle, covering your full ISMS scope across the certification period (many organizations split scope across two or more audits per year rather than one giant annual event).
Trigger an out-of-cycle audit when you have a significant change: new product launch, acquisition, major vendor change, or after a security incident. Review and update your audit program and templates whenever your SoA or risk register changes materially. Keep audit records for your full certification cycle — your external auditor will ask to see audit history across multiple years at recertification.
FAQ
How often is an ISO 27001 internal audit required?
At minimum once per certification cycle, but most organizations run it annually, and many split scope into multiple smaller audits throughout the year. Your audit program should ensure every control in your SoA gets reviewed before each surveillance or recertification audit.
Can we use the same person for internal audit every year?
Yes, as long as they remain independent of the specific controls they’re auditing each cycle. Rotate assignments so no auditor repeatedly reviews their own area of responsibility.
Does a minor nonconformity block certification?
Usually not — minor nonconformities typically require a documented corrective action plan with a deadline, not immediate resolution. Major nonconformities generally must be resolved before certification can proceed.
Can we outsource our internal audit entirely?
Yes, and many small organizations do, since it solves the independence problem without requiring a full internal audit team. Just ensure the external party understands your ISMS documentation and industry context well enough to test meaningfully.
What’s the difference between internal audit and management review?
The internal audit tests whether controls work and documents findings; management review is where leadership evaluates those findings alongside risk, resources, and strategy to decide on changes. The internal audit report is one of several required inputs into management review.
Conclusion
A well-run ISO 27001 internal audit turns your ISMS from a binder of policies into a system you can actually trust — and it’s the single best predictor of how your external certification audit will go. Organizations that treat internal audit as a genuine test, not a formality, walk into certification with far fewer surprises.
If you’re staring down your first internal audit without a dedicated compliance team, you don’t have to build this from scratch alone. SecureSystems.com helps startups, SMBs, and scaling teams get audit-ready without the enterprise price tag — whether that’s ISO 27001 implementation, SOC 2 readiness, HIPAA compliance, or hands-on penetration testing. Book a free compliance assessment and find out exactly where your ISMS stands before your auditor tells you.
