ISO 27001 internal audit: clause 9.2 and how to run it

What ISO 27001 internal audit requires before your certification body arrives

A customer or contract now asks for ISO 27001, and your certification body will ask for internal audit evidence at stage 1. Clause 9.2 requires an internal audit programme, and clause 1 of the standard says no requirement in clauses 4 to 10 can be excluded for a conformity claim. The organization owns that programme. Neither the certification body nor an implementation partner can run it on your behalf and call it compliant. The effort is not fixed. It depends on three things you control: the ISMS scope, which sets how many people, locations and processes must be audited; the number of qualified internal auditors you can field; and whether those auditors are independent of the people who designed the controls. Independence matters doubly here. The certification body must be independent of whoever performs your internal audit, including freelance auditors, and a certification body's preliminary audit is not an internal audit by definition. Confirm with your certification body in writing how it will treat any internal audit work carried out by a consultant it might later certify.

For method, use ISO 19011 as the general guidance on auditing management systems, and ISO/IEC 27007 for ISMS-specific guidance on managing the audit programme, conducting audits and assessing auditor competence. Check the edition you adopt, since ISO 19011 was replaced by a 2026 edition and ISO/IEC 27007 is under systematic review. Before stage 1, you should be able to show a written programme with audit criteria, scope, frequency, auditor assignments and records of findings, plus evidence that nonconformities feed into management review under clause 9.3 and into corrective action under clause 10.2. DeployOpen can prepare the systems, control records and evidence that internal auditors will examine, and can help define the audit programme as scoped work. It does not perform your internal audits as an independent party, and it does not issue audit reports or certificates. Those come from your internal auditors and, for certification, from an independent certification body.

How to run an internal ISMS audit programme step by step

This sequence turns clause 9.2 into a repeatable cycle: objectives and criteria are set, audits are planned and run against the ISMS, and findings drive corrective action and management review. Each step ends with a record that a certification body can sample.

Set audit programme objectives and criteria
The organization, through its management representative or ISMS owner, defines what the internal audit programme must show: conformity with clauses 4 to 10 and the Annex A controls in the Statement of Applicability, and whether the ISMS is effectively implemented and maintained. Criteria are written down, usually as the ISO/IEC 27001 requirements plus the organization's own policies and procedures. The output is a documented audit programme with stated objectives and criteria. The step is complete when someone outside the audit team could read the programme and understand what a passing audit means.
Define scope and frequency from risk and change
Using the ISMS scope, the risk assessment results and recent changes to systems, sites, suppliers or the Statement of Applicability, the owner decides which areas are audited, how often and in what depth. Clause 9.2.2 requires the programme to consider the importance of processes, changes affecting the organization and results of earlier audits. The output is an annual programme schedule that covers every requirement in clauses 4 to 10 and every control in scope over time. You know the step is done when each in-scope process appears on the schedule with a stated reason for its frequency.
Select competent and independent auditors
The owner assigns auditors who can assess the ISMS objectively and are not responsible for the work they audit. Guidance in ISO/IEC 27007 and ISO 19011:2026 covers auditor competence and the evaluation of it. Where the organization uses an implementation partner or a consultant for the ISMS build, the people who designed or ran the controls should not be the only auditors of those controls. The output is a list of named auditors with recorded competence and the audit areas each may cover. The step is complete when the record shows why each auditor is suitable for their assignment.
Plan each internal audit
The lead auditor prepares an audit plan for each engagement, stating the objectives, criteria, scope, sites or systems, the processes and controls to sample, the interviews and records to examine, and the schedule for opening and closing meetings. The audit plan is shared with the auditee before fieldwork. The output is a written audit plan. The step is done when the auditee has confirmed the plan and the evidence to be requested is listed.
Conduct the audit against the criteria
The audit team gathers objective evidence through interviews, document review, configuration checks, log samples and observation, following the methods in ISO 19011:2026 and the ISMS-specific guidance in ISO/IEC 27007:2020. Each finding is traced to a clause or a control, and the team records what it examined and how. Auditors should test whether controls operate, not only whether a policy exists. The output is working papers with evidence references. The step is complete when each planned sample has been examined or a reason for not examining it has been recorded.
Report findings and classify nonconformities
The lead auditor issues an audit report that separates conformities, observations and nonconformities, each linked to the requirement or control and the evidence behind it. The auditee reviews the factual accuracy of the report before it is final. The output is a signed internal audit report. The step is done when the auditee acknowledges each nonconformity and a responsible owner is named for it.
Track corrective action under clause 10.2
For each nonconformity, the organization investigates the root cause, decides on a correction, takes corrective action to prevent recurrence, and checks that the action worked. Clause 10.2 requires the organization to retain documented information as evidence of the nature of the nonconformities, the actions taken and their results. The output is a corrective action record for each finding, with the root cause, action, owner, due point and effectiveness check. The step is complete when each record shows verified closure or an accepted, documented reason for remaining open.
Feed results into management review
The programme results, open and closed nonconformities, audit trends and the status of corrective actions become inputs to management review under clause 9.3.2. Management review produces decisions and actions about ISMS changes and resources, recorded under clause 9.3.3. The output is minutes of the management review meeting that show the internal audit results were considered and what was decided. You know the cycle is working when the decisions from one review appear as scheduled items in the next audit programme.

Who does what: your team, an implementation partner and the certification body

Clause 9.2 of ISO/IEC 27001:2022 places the internal audit inside the organization's own management system, so the organization owns it. Leadership sets the programme's purpose, appoints the people who run audits, and decides what happens to the findings at management review under clause 9.3. None of those duties can be handed to an outside party without the organization still being accountable for them.

Programme ownership: Your management system owner approves the internal audit programme, its frequency and the criteria for each audit.
Auditor appointment: You select internal auditors on objectivity and competence, and you record why each person was chosen.
Independence in practice: Auditors should not audit their own work. Where the team is small, document how you achieved separation.
Management review decisions: Leaders decide which nonconformities get corrective action under clause 10.2 and which risks change.
Records: Audit plans, reports and follow-up actions stay in your control and are available to the certification body.

Before you engage anyone, confirm in writing which of these decisions your own people will make.

Why the certification body cannot run your internal audit

Clause 9.2 of ISO/IEC 27001:2022 makes the internal audit the organization's own first-party check on its ISMS. The cards below cover the independence rules that keep the certification body and its people out of that role, and the controls that show an assessor the separation is real.

The certification body cannot be your auditor

An internal audit is a first-party activity that the organization performs on itself, while the certification body's audits are third-party assessments. A certification body that carries out your internal audit has put itself on both sides of the same review. Before engaging a certification body, ask in writing whether it, or anyone in its group, will perform any part of your internal audit programme. Record the answer in the audit programme file.

Freelance auditors with a certifier

Individual freelance auditors who also work for a certification body create the same conflict as the body itself, because ISO/IEC 27006-1 covers them too. Your internal auditor may be a contractor, so check each person's current and recent engagements with the certification body you plan to use. Keep a declaration of independence on file for every internal auditor and refresh it before each audit cycle.

Preliminary audits are not internal audits

A certification body's preliminary audit is a third-party activity, so it cannot count as the clause 9.2 internal audit. European Accreditation's guidance (FAQ 48.11) explains that an internal audit is a first-party audit by definition. Your internal audit must still happen independently, on its own schedule, and produce its own records, even if a preliminary audit took place earlier.

Using a preliminary audit as the internal audit

European Accreditation's FAQ 49.2 describes a certification body that used its preliminary audit as the client's internal audit, which raises impartiality risks. The fix is to keep the two activities separate in the plan, the report and the people involved. Ask the certification body how it records preliminary audit findings, and confirm that none of them are presented as internal audit results.

No two-year mitigation under 27006-1

ISO/IEC 17021-1 allowed a two-year mitigation period after a conflict arose from certain past relationships. ISO/IEC 27006-1 clause 5.2.2 has no such period, as European Accreditation's FAQ 49.4 explains. A relationship that once existed can therefore block a certification body from the engagement, so disclose any past work with your internal audit provider and ask the body to confirm its position in writing.

Keep audit records under internal control

Independence is also a matter of who holds the evidence. The internal audit plan, checklists, sample selections, findings and management review inputs should sit in your own document system, owned by your ISMS owner. A certification body may read these records during the audit, but it should not prepare them. Confirm the record ownership before stage 1.

How internal audit findings flow into management review

Internal audit findings do not stop at the audit report. ISO/IEC 27001:2022 expects the results to feed the management review under clause 9.3, where top management looks at the performance of the ISMS and decides what happens next. The audit results are one of the required inputs to that review (clause 9.3.2 lists the inputs), and the review must produce decisions about improvement opportunities, changes to the ISMS and resource needs (clause 9.3.3 lists the results). Any finding that is a nonconformity also enters clause 10.2, which requires the organization to react, decide whether action is needed to eliminate the cause, implement it, and review its effectiveness. The chain is audit report, then corrective action record, then management review minutes, and each link must point to the next.

Illustrative example: an internal auditor finds that three of ten sampled leavers still had active accounts in the access system two days after exit. The audit report records the nonconformity against the access control requirement and the relevant Annex A control. The ISMS owner opens a corrective action record that states the root cause (the offboarding ticket did not trigger account removal), the containment step (accounts disabled that day), the change to the process, and a date for checking that the change worked. At the next management review, the minutes show the finding as an input, the corrective action status as an input, and a decision to fund an automated deprovisioning workflow. Each record carries the same identifier so an assessor can follow it in either direction.

The certification body will sample these records. Stage 2 and surveillance audits routinely ask to see the internal audit report, the programme that scheduled it, the corrective actions raised from it and the minutes of the management review that considered them. Before you schedule the first audit, confirm with your certification body which records it expects in what format, and check that your corrective action log, audit reports and review minutes can be retrieved by date and finding. Records that exist but cannot be traced will be treated as weak evidence.

Questions buyers ask about ISO 27001 internal audit

Can our own staff perform the ISO 27001 internal audit?

Yes, in most cases. ISO/IEC 27001:2022 requires the organization to run internal audits at planned intervals, and the standard does not require an outside firm to perform them. What matters is competence and objectivity: auditors should understand the standard and the controls they test, and should not audit their own work. Staff who build or run a control are a poor choice to audit that control. Many organizations use people from another team, or a rotation, and document how each auditor was chosen. Confirm with your certification body how it reads the competence evidence you keep for each internal auditor before you rely on this approach.

Can a consultant perform our internal audit for us?

A consultant can perform the internal audit, but the organization still owns the programme, the findings and the decisions that follow. The main constraint is independence from the certification body. Under ISO/IEC 27006-1, the certification body must be independent of whoever performs the client's internal ISMS audit, and that rule covers individual freelance auditors as well as firms. A consultant who also prepared your ISMS may have a self-review problem, so ask whether the same person designed the controls they will test. Put the consultant's role, deliverables and independence statement in writing before work starts.

How independent must our internal auditor be from the certification body?

The internal auditor must be independent of the controls being audited, and the certification body must be independent of the internal auditor. These are two separate tests. For the second, European Accreditation FAQ 49.4 explains that clause 5.2.2 of ISO/IEC 27006-1 forbids the certification body from being the party that performs your internal audit, and it does not allow the two-year mitigation period that ISO/IEC 17021-1 once offered. In practice, the firm that audits your ISMS internally should not also be the firm that certifies it. Ask any candidate certification body to confirm in writing which roles it has already taken on for you.

Will a certification body accept our internal audit report?

A certification body reviews your internal audit records during the certification audit and checks whether the programme meets clause 9.2. It does not accept a report simply because it exists. Expect it to ask for the audit programme, the plan for each cycle, auditor competence and selection records, the audit scope and criteria, the reports, and evidence that findings led to corrective action. A certification body that performed a preliminary audit for you cannot treat that visit as your internal audit. European Accreditation FAQ 48.11 notes that a preliminary audit is a third-party activity, while an internal audit is a first-party audit. Ask the body how it will review your records before the stage 1 visit.

What do ISO/IEC 27007 and ISO 19011 add to the internal audit?

They add practical guidance on how to run the audit, and they do not change what clause 9.2 requires. ISO 19011 covers general principles for auditing management systems, including managing an audit programme, planning and conducting audits, and evaluating auditor competence. ISO/IEC 27007 applies that guidance specifically to ISMS audits and covers the audit programme, the conduct of audits and the competence needed for information security work. ISO 19011 was replaced by a 2026 edition, and ISO/IEC 27007:2020 is under systematic review. Check which editions your certification body and your auditors refer to, and record the edition you used in your programme documents.

How often must internal audits run for an ISO 27001 ISMS?

Clause 9.2 requires internal audits at planned intervals, and the organization sets those intervals in its audit programme based on the importance of processes, changes and previous results. The standard does not state a fixed frequency in the text supplied here, so confirm the expected cadence with your certification body. Auditors will look for a programme that covers the full scope over time, with the frequency justified by risk and change. Separately, the certification cycle requires a certification audit in every calendar year, so plan internal audits to finish before those external visits.

What does the internal audit need from our team day to day?

The work needs named owners, time in calendars, access to evidence and a path for findings. Someone must maintain the audit programme, select auditors, prepare audit plans and checklists, and keep records of competence and independence. Auditors need time to review evidence, interview control owners and write reports. Control owners must respond to findings and show corrective action under clause 10.2, and management must receive the results as an input to management review under clause 9.3. Ask your implementation partner or internal lead to estimate these hours for your scope, and treat the figures as your own planning inputs rather than fixed quotes.

What will the certification body check about our internal audit?

The certification body will check that the programme exists, covers the whole ISMS scope, runs at planned intervals and is effective. It will sample reports and follow findings through to corrective action and management review. It will also test whether auditors are competent and independent, and whether results feed into improvements. Gaps usually appear when the programme lists audits that never happened, when findings are not closed, or when management review does not discuss audit results. Prepare a short evidence file that shows the full chain from plan to audit to finding to management decision, so the assessor can trace it quickly.

What usually weakens an internal audit before the certification body sees it

Most weak internal audits fail for structural reasons, not because auditors missed a detail. The cards below cover the decisions that erode independence, scope and follow-through, and the practical check for each one before the certification body arrives.

Implementation consultant as the only auditor

When the same people who built the ISMS also audit it, the internal audit cannot show that the system works as written. The consultant's judgment is already tied to the design they produced. Before the audit, check that the auditor did not write the policy, control or procedure under review, and that the audit team is separate from anyone the certification body has engaged for the client's audit. Record who audited what and why that person was independent of it.

Auditing without an approved scope

An internal audit that does not start from the scope approved by management can miss in-scope sites, systems and people, or test out-of-scope areas that later confuse the record. Confirm that the audit plan cites the current ISMS scope statement and the Statement of Applicability version in use. Any change to scope since the last audit should be reflected in the plan, with the date of the change written down.

Audits that only check policies

Reviewing documents shows what the organization intended, not what staff and systems actually do. Auditors who stop at the policy library miss gaps such as unreviewed access, missed patch records or incidents handled outside the documented process. For each control sampled, ask for operating evidence from the period under review, such as tickets, logs, approvals or training records, and compare it against the written requirement.

Findings that never reach management review

Internal audit results count toward the ISMS only when management sees them and decides what to do. If audit findings sit in an audit file, the management review inputs will look incomplete and the review outputs will not reflect real risk. Before the management review meeting, confirm that every finding, its severity and its status are summarized in the agenda, and that the review minutes record decisions on each open item.

Nonconformities closed without root cause

Correcting the single instance an auditor found does not stop the same failure from recurring. Under the corrective action requirement in clause 10.2, the organization must determine why a nonconformity happened and whether similar issues exist elsewhere. Check that each closed nonconformity records a root cause, a corrective action, evidence that the action worked, and a review of whether the same cause affects other processes or sites.

Preliminary audits used as the internal audit

A certification body's preliminary audit is not an internal audit, because an internal audit is a first-party audit conducted by the organization. Using the certification body's pre-audit as the client's internal audit creates an impartiality risk, and it leaves the organization without its own evidence that clause 9.2 is working. Schedule a separate internal audit run by the organization, and keep its records apart from any pre-audit report.

How ISMS scope and risk shape the audit programme

The internal audit programme has to cover the whole ISMS as it is scoped under clause 4.3, and the controls that are actually in force according to the Statement of Applicability. An audit plan that samples only the parts of the business that are easy to reach will not hold up when a certification body checks the programme. Start by listing every process, site, business unit and system inside the boundary, then map each one to the clauses and Annex A controls that apply to it. That map becomes the basis for deciding what each audit covers and how often.

Scope also sets the workload. The more people, locations and systems inside the boundary, the more audit time the programme needs, and the more auditors you need who are competent and independent of the work they check. For multi-site or remote organizations, the programme should record which sites are audited in full, which are sampled, the sampling method and the reasons for each decision, such as risk, past nonconformities or how similar the sites are. Write these decisions into the programme before the year starts so the basis for them is visible to an assessor. The guidance in ISO/IEC 27007 is a useful reference for documenting sampling.

Risk should decide where effort goes within that scope. Use the risk assessment and risk treatment results to weight the audit plan toward high-risk controls, recent incidents, significant changes and controls that rely on third parties. Frequency is a judgment you must document, not a number this page can give you. Confirm the minimum audit frequency and sampling approach with your certification body before you commit to a plan, and agree how your own risk analysis will set the rest. Note that the certification body's rule of at least one audit in each calendar year across the three-year cycle is a requirement on the certification body, not an internal audit rule, so your internal programme must be built on your own risk analysis.

ISO 27001 internal audit

What ISO 27001 internal audit requires before your certification body arrives

How to run an internal ISMS audit programme step by step

Set audit programme objectives and criteria

Define scope and frequency from risk and change

Select competent and independent auditors

Plan each internal audit

Conduct the audit against the criteria

Report findings and classify nonconformities

Track corrective action under clause 10.2

Feed results into management review