Control 9.2.1General
Conduct internal audits at planned intervals to provide information on whether the ISMS conforms to the organisation’s own requirements and to the requirements of the standard, and whether it is effectively implemented and maintained.
Two separate questions, and the second is the harder one. Conformity is checkable against documents; effective implementation is checkable only by looking at what happens in practice.
The internal audit is the organisation’s own assurance mechanism, not a rehearsal for the certification body. An audit programme that tests only what the external auditor tested last time inherits that auditor’s sampling and finds nothing new. The most useful internal audits are the ones that go where the organisation is least comfortable — the outsourced process, the exception that has been open for a year, the control whose owner has changed three times.
A clean internal audit report across a whole ISMS invites the question of whether the audit looked.
How to put this in place
Internal audits tell you, before an outsider does, whether the ISMS meets your own requirements and the standard's and is working in practice. They must be planned and carried out against defined criteria.
- Define the audit criteria: the standard, your own documents and the scope.
- Choose competent and independent auditors.
- Plan each audit from the programme in 9.2.2 and agree dates with the people audited.
- Carry out audits, report results to the relevant managers and keep the reports.
- Follow the findings through to closure.
Evidence an auditor usually looks for: audit plans, independence statements, reports and evidence that findings were followed up.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 5 (Check) of the implementation plan, which sets out the work and the gate that closes the phase.
ISMS Internal Audit Programme & ProcedureWord
Covers what is audited, auditor independence and the stages of an audit.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.