ISO 27001:2013 Requirements: Clause 9.2 Internal Audit (2013)

An internal audit is a fantastic tool to evaluate the organisation's ISMS processes and functions. When performing internal audits the organisation must ensure that (I) audits are conducted at planned intervals, and (ii) the auditor must be objective and impartial.

{{snapshot}}

Internal audit basics

• An internal audit evaluates the organisation's ISMS processes and functions.
• Audits must be conducted at planned intervals.
• The auditor must be objective and impartial.
• Audits confirm the ISMS meets its own requirements and those of the standard, a core ISO 27001 duty.

{{/snapshot}}

According to this clause, internal audits must occur at planned intervals to confirm that the ISMS is fulfilling its own system requirements and the requirements of this international standard. The organisation must ensure the effective implementation of these audits.

The organisation shall plan, establish, implement and maintain audit programmes that are performed at planned intervals considering the importance of the processes and the previous audit reports. The criteria and the scope for the audit must be determined before each audit and the auditor selected by the organisation to conduct such audits impartially in order to ensure the objectivity of the auditing process.

{{snapshot}}

Running the audit programme

• Plan, establish, implement and maintain audit programmes at planned intervals.
• Weigh the importance of the processes and previous audit reports.
• Set the criteria and scope before each audit and select an impartial auditor.
• Report results to relevant management and keep them documented; more in the ISO 27001 hub.

{{/snapshot}}

The results of such an audit should be reported to relevant management and must be kept in a documented form.

{{snapshot}}

What Hicomply recommends

An audit is only as good as the evidence behind it, so avoid reconstructing records at the last minute. Keeping your controls and documentation continuously up to date means each internal audit confirms what you already know rather than springing surprises. See how on our platform tour, or explore more in our resources.

{{/snapshot}}