It is mandatory, and it is a prerequisite
ISO 27001 clause 9.2 requires internal audits at planned intervals, and clause 9.3 requires a management review. Both must have happened before your certification audit, not after it.
This catches teams out constantly. Internal audit sounds like something a mature ISMS does once it is running, so it gets scheduled for after certification — and then Stage 1 asks for the evidence. It is the most common Stage 1 finding we see, and it is entirely avoidable.
What the programme has to cover
Clause 9.2 asks for a documented audit programme, not a single audit. The programme must define frequency, methods, responsibilities, planning requirements and reporting, and it must consider the importance of the processes involved and the results of previous audits.
| Element | What it means in practice |
|---|---|
| Scope of each audit | Which clauses and which Annex A controls this audit covers |
| Criteria | What you are auditing against — the standard, your policies, your SoA |
| Frequency | At planned intervals; annually as a minimum for most organizations |
| Auditor and independence | Who performed it, and why they are independent of the area |
| Findings | Nonconformities, observations, and evidence for each |
| Corrective actions | Owner, action, due date, and evidence of closure |
| Report to management | Results feeding the management review under 9.3 |
A single audit covering the entire ISMS in one pass is acceptable for a small organization. Larger scopes usually split the programme across the year by area.
The independence requirement
Clause 9.2 requires that auditors do not audit their own work. That constraint is what makes internal audit genuinely difficult for small teams.
If one person built the ISMS, wrote the policies and operates most of the controls, there is nobody internal who can audit it independently. The options:
Cross-audit internally. Someone from a different function audits the area, with training. Workable if you have the headcount and someone willing to learn.
Use an external internal auditor. A consultancy performs the internal audit as a service. This is legitimate and common — and importantly, it is a different thing from the certification audit, which must come from an accredited certification body.
The distinction that matters: a consultancy can perform your internal audit. It cannot perform your certification audit, and it cannot audit an ISMS it built without disclosing and managing that conflict. Ask any provider how they handle it.
What a real internal audit looks like
The failure mode is a checklist walkthrough that finds nothing. An internal audit that reports zero findings before a first certification is not reassuring; it suggests the audit was not looking.
Sample actual evidence. Not whether a policy exists — whether the control it describes ran, on the dates it should have.
Interview control owners. Ask them to explain the control in their own words. Divergence from the documentation is the finding.
Trace risks to controls. Pick risks from the register and follow them into the SoA and into implementation. Breaks in that chain are what Stage 2 will find.
Write findings honestly. Nonconformities found internally cost a fix. The same ones found at Stage 2 cost a fix plus schedule.
Management review, the other half
Clause 9.3 requires top management to review the ISMS at planned intervals, considering audit results, the status of corrective actions, changes in risk, feedback on security performance, and opportunities for improvement.
The evidence is a dated record with attendees, inputs considered, and decisions taken. A calendar invite is not evidence. Stage 1 asks for both 9.2 and 9.3 together, and finding one without the other is nearly as common as finding neither.
FAQs
Is an internal audit mandatory for ISO 27001?
Yes. Clause 9.2 requires internal audits at planned intervals, and clause 9.3 requires a management review. Both must be complete before your certification audit — evidence of them is requested at Stage 1, and their absence is the most common Stage 1 finding.
Who can perform an ISO 27001 internal audit?
Anyone competent who is independent of the area being audited, since clause 9.2 requires that auditors do not audit their own work. Small teams often cross-audit between functions or engage a consultancy to perform the internal audit as a service, which is distinct from the certification audit.
Can a consultant do my ISO 27001 internal audit?
Yes. A consultancy can perform your internal audit under clause 9.2. It cannot perform your certification audit, which must come from an accredited certification body, and where it also built the ISMS the conflict has to be disclosed and managed. Ask any provider directly how they handle that.
How often is an ISO 27001 internal audit required?
At planned intervals, which for most organizations means at least annually. Larger scopes commonly split the programme across the year by area rather than auditing everything in one pass. Frequency should reflect the importance of the processes and the results of previous audits.
What should an ISO 27001 internal audit report contain?
The scope and criteria of the audit, who performed it and why they were independent, the evidence sampled, any nonconformities and observations with supporting evidence, and corrective actions with owners, due dates and closure evidence. Results must then feed the management review under clause 9.3.
Where to go next
Have the internal audit run for you as part of ISO 27001 consulting, see what Stage 1 checks in Stage 1 vs Stage 2, or find your gaps first with an an ISO 27001 gap assessment.