Control 9.2.2Internal audit programme

Plan, establish, implement and maintain an audit programme including frequency, methods, responsibilities, planning requirements and reporting; the programme must take into consideration the importance of the processes concerned and the results of previous audits. The organisation must define the audit criteria and scope for each audit, select auditors and conduct audits in a way that ensures objectivity and the impartiality of the audit process, ensure results are reported to relevant management, and retain documented information as evidence of the programme and results.

The risk-based element — importance of the processes, and previous results — is what distinguishes a programme from a rota. Auditing everything equally every year spreads effort evenly across areas that do not deserve it evenly.

Objectivity and impartiality is the requirement small organisations struggle with honestly. Auditors must not audit their own work. Where the organisation is too small for that, the usual answers are an external auditor, a reciprocal arrangement, or somebody from an unrelated function — and the constraint should be recorded rather than quietly ignored.

How to put this in place

A programme makes audits regular and covers the whole ISMS. Audits that cover only Annex A, or auditors who check their own work, are common weak points.

Write the programme: frequency, methods, responsibilities, criteria and scope.
Cover every clause and applicable control across the cycle, and audit higher-risk areas more often.
Assign auditors who do not audit their own work.
Get the programme approved.
Complete one full cycle and report results to top management before the Stage 2 audit, which is the CISO Times implementation pack's own rule; its plan finishes it before Stage 1, so ask your certification body what it expects.

Evidence an auditor usually looks for: the approved programme, audit reports covering clauses 4 to 10 and controls, and results presented at the management review.

What is in the packs for this

From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.

ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 5 (Check) of the implementation plan, which sets out the work and the gate that closes the phase.
Mandatory ISMS Documentation ChecklistExcel
Required Documents sheet, item MD-14: the typical form, what auditors accept instead and the gaps they reliably find.
Certification Readiness Self-AssessmentExcel
A blocking item in the readiness assessment, which treats it as needing to be operating before a Stage 2 audit.
ISMS Internal Audit Programme & ProcedureWord
Covers how often each area is audited, how the programme is planned, the records it produces and a worked example.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.