A First-Time Guide to ISO 27001 Internal Audits

A first internal audit for ISO/IEC 27001:2022 tests whether the Information Security Management System (ISMS) works the way staff actually use it day to day, beyond what the paperwork describes.

Define the Scope Before Anything Else

Every good audit starts with boundaries. Use the documented ISMS scope to define which processes, locations, and services each audit will examine. Include relevant outsourced services and the organization’s responsibilities for overseeing them. Vague boundaries can leave important activities out of the audit program and lead to surprises during the external assessment.

The audit program doesn’t have to cover each site and control in one pass. Clause 9.2 asks for audits at planned intervals, with full coverage built over time. That gives small teams room to plan. It also means scheduling should be deliberate.

Use risk assessment and risk treatment results to set priorities. High-risk processes and systems with prior issues deserve early attention. The Statement of Applicability guides that work by showing which Annex A controls apply and why others don’t. Not every one of the 93 controls will fit every organization, and documented justification matters as much as implementation.

Build the Audit Program Around Clause 9.2

Clause 9.2 sets the internal-audit requirements. Establish an audit program covering frequency, methods, responsibilities, planning, and reporting. Keep documented evidence that the program was carried out and record its results. A short procedure can help organize that work without becoming a paperwork exercise.

Choose a schedule suited to the importance of the processes and previous audit results. Leave room for follow-up, because findings need time for correction and an effectiveness check.

Define audit criteria for each audit in plain terms. Criteria are the policies and requirements used to judge evidence. An audit might use an ISO/IEC 27001 clause alongside an internal procedure, with an Annex A control also informing the review. Specific criteria make sampling faster and findings harder to dispute because auditors and process owners share the same view of what good evidence looks like.

Keep reporting consistent with the same template for plans and results. A repeatable format makes trends easier to spot across audits.

Don’t treat the audit as a pass-or-fail exam. A strong internal audit won’t prevent every future incident, but it will show whether controls are followed in practice.

Pick Objective Auditors and Set Clear Criteria

Choose auditors with knowledge of the standard, interviewing and evidence-review skills, and an understanding of the processes being audited. Then check that assignments support objectivity and impartiality, rather than putting people in charge of judging their own work.

The basic rule is simple. No one audits their own work. An IT administrator shouldn’t audit access controls they configured. A common fix is to trade auditors between departments. Another option is to train someone from quality or operations to handle interviews and record checks.

Teams seeking outside support can review iso 27001 consulting services from IS Partners and ask about audit planning, sampling, and reviewer impartiality. Clarify the provider’s role before engaging a certification body.

That separation supports impartiality. Certification bodies expect auditors to maintain that distance.

Collect Evidence Like an Outsider Would

Evidence is what demonstrates conformity. A policy on paper doesn’t prove staff follow it. Auditors need to see records and watch tasks happen.

Start with document review paired with staff interviews. Read the access policy, then ask two users to explain the request steps. Look at tickets and approval logs to see if practice matches the written requirements. Short answers can reveal more than long documents.

Then move to observation and sampling, with extra weight given to high-risk areas. Watch a joiner and leaver process from request through removal, and sample recent changes to firewall rules or privileged accounts. Check training completion for new hires and contractors.

Annex A of ISO/IEC 27001:2022 aligns with ISO/IEC 27002:2022 and holds 93 security controls under four themes: organizational, people, physical, and technological. Map notes back to those controls as work proceeds.

One clear paragraph of notes beats a page of checked boxes.

Ask open questions that invite demonstration rather than yes-or-no replies. Give staff room to show each step in plain terms.

Write Findings That Hold Up Under Scrutiny

A nonconformity is a clear statement that a requirement wasn’t met, backed by evidence. Vague wording helps no one. Weak notes say a review was missed. Stronger wording names the criterion and the proof: privileged access for the finance system wasn’t reviewed in Q2 as required by the access control procedure, with no record for April through June.

Separate correction from corrective action. Correction fixes the immediate gap, like removing unneeded access. Corrective action addresses root cause to prevent repeat issues, such as unclear ownership for quarterly reviews or training that didn’t cover the step.

Feed results into management review without delay. Leadership needs to see patterns and resource needs that affect risk decisions. That link supports continual improvement tied to ISO/IEC 27001:2022 and its focus on risk management.

Use the audit as a dry run for certification. Hold a short opening meeting and take notes in a way that a stranger could follow. Classify findings with care so minor lapses don’t read as system failure.

Assign an owner and target date to each corrective action. Before closing it, review evidence that the change addressed the cause and worked as intended. Keep those records available for management review and later audits.

Strong audits don’t chase perfection. They build a record that the ISMS works in practice and is adjusted when reality shifts.