The internal audit is often the last line on the ISMS project list, and there is no name next to it. The policies are written, the risk process is running, the statement of applicability is agreed. Then comes a line that looks like paperwork, and it gets treated that way: a date, a report, a tick.
In our experience, certification projects lose their schedule right here. An internal audit is not difficult. What is missing is a responsibility nobody in the project ever asked about.
Is an internal audit mandatory for ISO 27001?
Yes. ISO/IEC 27001 requires internal audits at planned intervals in clause 9.2, and in clause 9.3 a management review that builds on their results. Without both there is no certificate. The obligation applies to every organisation with an ISMS, regardless of size and sector.
What clause 9.2 asks for in detail is soberly worded: an audit programme covering frequency, methods, responsibilities and reporting, defined criteria and a defined scope for each audit, a selection of auditors that ensures the objectivity and impartiality of the audit process, a report to the relevant level of management, and documented evidence.
This list describes an operation and not a state, and that is the uncomfortable part. "At planned intervals" means there is a second time. A one off internal audit three weeks before the certification date meets the letter and misses the point, because an audit of a system nobody has used yet finds nothing. What that means for your calendar we have written up in our piece on the duration of an ISO 27001 project.
Who is allowed to carry out the internal audit?
Anyone who is competent and did not do the audited work themselves. ISO 27001 requires objectivity and impartiality of the audit process, and nothing further: no external auditor, no auditor certification, no software. The internal audit is your job, and you are allowed to do it with your own people.
This misconception costs money, because it leads to a bought in engagement that ISO 27001 never asked for at this point.
One thing does rule out objectivity, and it is the whole crux. Whoever built and ran a control cannot be the same person who confirms it works. This is not a formal objection. Someone checking their own work finds the mistakes they already know about and overlooks the assumptions they made while building. Those assumptions are where an internal audit earns its keep.
Why the internal audit comes down to arithmetic in an SME
In a large group this is a question of organisation. In an SME it is a sum that does not add up.
In our experience the ISMS was built by one person, usually the IT lead or whoever also carries quality, data protection and compliance. The same person runs the risk process, writes the policies and sits in the management review. Nobody else in the building understands the system in detail. And that is exactly the person who must not sign it off.
It does not follow that you have to buy in an auditor. It follows that a decision is pending which nobody has taken so far. There are three workable answers, and they cost different things.
The first is a cross audit inside your own company. Someone from finance looks at the access process in IT, someone from IT looks at supplier approval in purchasing. This requires the criteria to be written down beforehand, because this person brings no subject matter depth. What they do bring is something the builder cannot have: they do not believe the assumptions, because they did not make them.
The second is an outside view within your own group. A sister company, a partner business, in industry associations also a peer from a comparable firm. That costs time instead of money and works as long as the other side does not sit in the same conflict of interest.
The third is a bought in auditor, but tailored. Not for the entire scope, but for the areas where nobody internal can be impartial. In the companies we work with, that is two or three topics and not the whole annex.
Which of the three fits depends less on the budget than on how many people at your place can judge what they are looking at. If the answer comes down to a single person, the decision has already been made, and it has been made against the internal option.
Not everything every year
The second misconception concerns scope. An audit programme that tries to check every control in the annex in its first pass fails, in our experience, on its own ambition, and produces nothing at all afterwards.
The standard does not ask for that either. When establishing the audit programme, the importance of the processes concerned and the results of previous audits are to be taken into account. That means, in plain terms, the programme is risk based and may run across several years. The access process through which your crown jewels are reachable deserves a look every year. The rule on disposal of storage media deserves one when something has changed or when something came up last time.
That is the difference between a programme that lasts several years and an exercise that falls asleep after the first certificate. A pragmatically built ISMS lives on this staggering.
Gap analysis, internal audit, certification audit
These three terms get mixed up in sales conversations, and the mixing costs money.
The gap analysis is a consulting service that shows what is missing between today and the standard. No clause of the standard requires it. Useful at the start, and we have set out what it delivers and what it does not.
The internal audit is your obligation under clause 9.2. It asks whether what exists does what is documented, not what is still missing. And it repeats.
The certification audit comes from an accredited certification body. In Switzerland this accreditation is regulated by the state. On the Swiss Accreditation Service SAS, SECO states: "Die Schweizerische Akkreditierungsstelle (SAS) ist die nationale Akkreditierungsstelle der Schweiz und Teil des Staatssekretariats für Wirtschaft (SECO)", the Swiss Accreditation Service is the national accreditation body of Switzerland and part of the State Secretariat for Economic Affairs, and further that it "begutachtet und akkreditiert verschiedene Typen von Konformitätsbewertungsstellen (KBS) auf der Basis der entsprechenden internationalen Normen", it assesses and accredits various types of conformity assessment bodies on the basis of the relevant international standards. A body accredited in this way issues your certificate, and it will want to see that the internal audit and the management review took place. We have described the course of a certification separately.
Anyone who buys the gap analysis twice and skips clause 9.2 notices it in stage 2 of the certification audit. By then it is a scheduling problem.
What an honest internal audit finds
The value of an internal audit is not the list of findings you present to the external auditor. It lies in this being the first occasion where someone sees the difference between described and operated.
Three findings come up again and again in our experience.
A control has a documented owner, and that owner knows nothing about it. A table with a column reading "Responsible: IT" produces cases like this.
An exception process is described and has never been used. Either there are no exceptions, which is hardly ever true, or the exceptions bypass it.
A review is meant to happen quarterly and has happened once, on the day the document was created.
None of these findings is embarrassing. All three are what an ISMS normally produces in its first year of operation, which is why it is better to find them yourself, in a meeting with no certificate at stake. An external auditor who makes the same finding writes a nonconformity, and that comes with a deadline.
The management review under clause 9.3 hangs on this too, since it evaluates what the internal audit delivered. If the audit produces an empty list, the management team evaluates nothing and records exactly that. An internal audit that only produces confirmations turns the obligation in 9.3 into a formality, and in our experience this combination is what the external auditor notices.
What you do not need to spend money on
Four items show up in quotes around clause 9.2 without contributing anything.
Audit software for a programme with two audits a year. A calendar entry, a criteria list and a record meet the evidence requirement.
Auditor training for the internal role. The standard requires competence, not a certificate on the wall.
An external internal audit across the entire scope as a first attempt. Buy impartiality where it is missing internally, and nowhere else.
An additional audit in the same quarter because the first pass produced findings. Findings are the result, not the failure.
What really determines the effort is the scope of your ISMS. If it is drawn too wide, you audit things every year that nobody wanted to protect, and you pay for that width in every cycle.
The name missing from the line
If your project documents contain a line reading "internal audit" with no name and no date, that is not a documentation gap. It is an open decision, and it gets more expensive the closer the certification date comes. Under time pressure what remains in the end is the option available immediately, and that is rarely the cheap one.
The next step is small. Take your audit programme, or the blank sheet where it ought to be, and write two things behind every control you want to check: who runs it and who looks at it. Wherever both fields carry the same name, you have found the point where your decision is pending. That replaces most discussions about methodology.
How wide the programme needs to be and where impartiality is missing is something we usually clarify in one meeting as part of building an ISMS to ISO 27001. An initial conversation is enough for that assessment.
One question interests us more than any question of method: who in your company could run an audit of the work of IT today without assessing their own work in the process?
Frequently asked questions
Is an internal audit mandatory for ISO 27001?
Yes. ISO/IEC 27001 requires internal audits at planned intervals in clause 9.2 and a management review in clause 9.3 that builds on them. Both must have taken place before a certification body examines implementation. Without both there is no certificate, regardless of size and sector.
Who is allowed to carry out the internal audit?
Anyone who is competent and did not do the audited work themselves. The standard requires objectivity and impartiality of the audit process, not an external auditor and not an auditor certificate. The only thing ruled out is signing off your own work. In an SME that is the real bottleneck.
What is the difference between an internal audit and a certification audit?
You run the internal audit yourself, it satisfies clause 9.2 and repeats at planned intervals. The certification audit comes from an accredited certification body and leads to the certificate. A gap analysis is neither of the two, it is a consulting service with no clause behind it.
