An ISO 27001 internal audit checks, at planned intervals, whether your ISMS meets the standard and your own policies. You need a written audit program, an auditor with no conflict of interest, a report to top management, and follow up on every nonconformity. Auditors will ask to see all of it.
What clause 9.2 asks for
Clause 9.2 requires internal audits at planned intervals. They assess how well the ISMS is implemented and maintained, and whether it conforms to ISO 27001 and to your own policies and procedures. The audit should cover the whole ISMS scope, and the criteria include internal rules and any requirements from interested parties, not only the standard.
The audit program
The internal audit program is a mandatory document. Think of it as a one year or three year plan. It states how many audits will run, their scope and criteria, who is responsible, how often, and by what method. The standard says planned intervals but does not fix a number, so choose a rhythm you can keep.
Who can audit
The auditor must be competent and free of conflict of interest. In practice that means nobody audits their own work. If your security lead built the access control process, someone else reviews it. Small teams often bring in an outside person for exactly this reason.
Five steps for a single audit
- Review the ISMS documents and check them against the standard.
- Build a checklist from what you reviewed.
- Run the audit and collect evidence for each checklist item.
- Write the report with nonconformities, observations and recommendations.
- Follow up to confirm each nonconformity was corrected properly.
An audit procedure and a checklist are optional. The program and the audit reports are mandatory records.
Where the output goes
The report goes to top management and becomes an input to the management review under clause 9.3. Nonconformities found here feed the corrective action process in clause 10.2, which has its own required records. If you want to see how those pieces connect, read the corrective action post alongside this one.
Mistakes that cost time
- Auditing only documents and never sampling real evidence.
- Writing findings with no owner or due date.
- Running one audit the week before the certification audit and nothing before it.
- Choosing an auditor who owns the process under review.
A realistic first audit
For a first cycle, pick a scope you can finish. Audit the controls that carry the most risk, such as access, change and supplier management, plus the clauses auditors always read: scope, risk, objectives and the Statement of Applicability. Record what you sampled and how many items. A short, honest audit with real findings is worth more than a long one that finds nothing.
Quick check
How often must internal audits happen?
At planned intervals. The standard does not set a number, so your audit program defines the frequency and you must follow it.
Can the same person write the policies and audit them?
That creates a conflict of interest. Use a different person, or an outside auditor, for the areas that person owns.
Sources
Last reviewed: 19 October 2026.
