Skip to content
Contact us
All posts

ISO 27001 Internal Audit Requirements

  Ray Watts  ·  3 minute read

Summary

ISO 27001 internal audits are a required part of operating an ISMS. They prove your system works in practice, not only on paper. A good internal audit program finds gaps early, strengthens evidence, and prevents surprises during certification audits.

  • Internal audits are mandatory: ISO 27001 requires planned internal audits at defined intervals.
  • Focus on effectiveness: Auditors look for whether controls operate, not only whether policies exist.
  • Evidence matters: Keep records of plans, findings, corrective actions, and follow-up.

What ISO 27001 requires for internal audits

ISO/IEC 27001 requires organizations to conduct internal audits at planned intervals. The goal is to confirm your ISMS conforms to the standard and to your own requirements, and that it is effectively implemented and maintained.

Internal audit requirements typically include:

  • Defined audit criteria and scope
  • Audit planning and scheduling
  • Objective, competent auditors
  • Reporting of results to management
  • Corrective actions and verification of closure

 

Who needs a strong internal audit program

Every organization pursuing or maintaining ISO 27001 certification needs internal audits. They are especially important if you:

  • Operate in the cloud: where shared responsibility and third parties increase complexity.
  • Have lean teams: where controls may exist but evidence routines are inconsistent.
  • Sell to enterprise buyers: who expect mature governance and risk management.
  • Manage regulated data: where security and privacy expectations overlap.

 

What internal audits should cover

Internal audits should cover ISMS processes and controls that matter to your scope and risk profile. A good program typically reviews:

  • ISMS governance: policies, roles, risk assessment, SoA maintenance, management review.
  • Operational controls: access reviews, change management, incident response, vendor management.
  • Technical controls: identity and access, logging, monitoring, vulnerability management, encryption.
  • Evidence quality: whether records exist and match what is actually happening.

 

Evidence auditors expect

Both certification auditors and internal audit reviewers will expect a clear audit trail. Common evidence includes:

  • Audit program and schedule: what you audit and when
  • Audit plans: scope, criteria, and sampling approach
  • Audit reports: findings, observations, and conclusions
  • Corrective actions: root cause, remediation steps, and owners
  • Follow-up records: proof that issues were closed and validated

Rule of thumb: If you cannot show the record, you cannot prove the ISMS is maintained.

 

Internal audit roadmap

 

1. Define your audit program

List ISMS processes and control areas to audit. Set frequency based on risk and change.

Deliverable: Internal audit program
 

2. Plan each audit

Define scope, criteria, and sampling. Prepare interview lists and evidence requests.

Deliverable: Audit plan and checklist
 

3. Execute and document

Run interviews and evidence review. Document findings clearly, including objective evidence.

Deliverable: Audit report with findings
 

4. Drive corrective actions

Assign owners, define root cause, and track remediation through closure.

Deliverable: Corrective action plan
 

5. Verify closure and improve

Confirm fixes are implemented and operating. Feed results into management review and risk updates.

Deliverable: Closure evidence and improvement actions

 

Common internal audit gaps

  • Checklist-only audits: documenting answers without testing evidence.
  • Weak independence: control owners auditing their own work without safeguards.
  • Poor sampling: reviewing one system or one month and assuming it represents reality.
  • Findings without follow-through: issues are logged but not tracked to closure.

 

How Neutral Partners helps

We help you build an internal audit program that fits your business. We define scope, test controls like an external auditor would, and help you close issues with evidence. That makes certification audits smoother and reduces repeat findings.

Since 2017, we have maintained a 100% audit success rate across more than 700 successful audits and assessments.

 

FAQs

How often do we need to run internal audits?

ISO 27001 requires planned intervals. Most organizations run at least annually, with higher-risk areas reviewed more often.

Can internal audits be remote?

Yes. Many audits are remote, as long as evidence access and interviews are effective.

Do we need certified internal auditors?

Not required, but competence matters. Auditors must understand ISO 27001 and your environment.

What is the difference between an internal audit and the certification audit?

Internal audits are your program. Certification audits are performed by a certification body and follow Stage 1 and Stage 2.

 

Key resources

 

Schedule a Discovery Session

If you want help building or improving your internal audit program, we can review your scope, audit plan, and evidence routines in a working session.

Schedule a Discovery Session