ISO 27001 Internal Audit: A Practical Guide

An internal audit is one of the most powerful tools in an information security management system, yet it is often treated as a box-ticking chore. Done properly, it tells leadership whether your ISO/IEC 27001:2022 controls actually work in practice, not just on paper. Done poorly, it wastes effort and gives false assurance that unravels at certification or, worse, during a real incident.

This guide walks through how to plan, conduct and report an ISO 27001 internal audit that satisfies Clause 9.2 of the standard and produces genuine improvement. It is written for Australian organisations preparing for certification or maintaining an existing certificate.

Why ISO 27001 requires internal audits

Clause 9.2 of ISO/IEC 27001:2022 makes internal audit a mandatory component of the management system. The purpose is twofold: to confirm that the ISMS conforms to the requirements of the standard and to your own documented requirements, and to confirm that it is effectively implemented and maintained. The distinction matters. Conformity means your policies exist and meet the standard; effectiveness means people actually follow them and they achieve the intended outcome.

Internal audits also de-risk the certification process. A competent internal audit programme surfaces the issues a certification body would otherwise find at Stage 2, giving you time to fix them. It is far cheaper to find a gap yourself than to receive a major nonconformity that delays your certificate.

Building an audit programme

Do not confuse a single audit with an audit programme. The programme is the overarching plan that schedules audits over a period, typically a year, and ensures the entire ISMS scope is covered. When you design it, factor in:

• The importance of the processes concerned. Customer-facing systems, identity and access management, and supplier relationships usually warrant deeper or more frequent coverage.
• Results of previous audits. Areas that have shown nonconformities, or that have changed significantly, need earlier and closer scrutiny.
• Changes in the organisation. A new cloud platform, a merger, a major staffing change or a significant incident should trigger targeted audits.

A common and practical approach is a rolling programme: rather than auditing everything in one exhausting week, you spread coverage across the year so that all clauses (4 to 10) and all applicable Annex A controls are audited at least once annually. This keeps the workload manageable and the findings fresh.

Maintaining auditor independence

The standard requires that auditors do not audit their own work and that the process is objective and impartial. In a large organisation this is straightforward: someone from a different team audits. In a small business it is harder, because the person who wrote the access control policy may also be the only one who understands it.

Practical options include rotating auditors across functions so nobody reviews their own area, training a second staff member to provide cross-cover, or engaging an external party. Bringing in an outside auditor adds independence and exposes your team to how other organisations implement the same controls. A virtual CISO engagement frequently includes internal audit precisely for this reason: it provides experienced, impartial scrutiny without the cost of a full-time security hire.

Conducting the audit

A structured audit moves through clear stages. Skipping any of them tends to produce findings that auditors or management later dispute.

1. Plan the individual audit. Define the scope, objectives and criteria. Criteria are what you audit against: the relevant clauses of ISO 27001, your own policies and procedures, and applicable legal or regulatory obligations.
2. Prepare. Review prior audit results, the risk assessment, the Statement of Applicability and relevant procedures. Draft a checklist or set of audit questions, but stay willing to follow the evidence where it leads.
3. Gather evidence. Interview staff, observe activities, and inspect records. Sample rather than attempt to check everything. For an access review control, for example, you might examine the last quarter’s access recertification records and test a handful of leavers to confirm their accounts were disabled.
4. Evaluate. Compare what you found against the criteria. Where there is a gap, decide whether it is a nonconformity (a failure to meet a requirement), an observation, or an opportunity for improvement.

Evidence is the heart of a credible audit. Statements such as “the team confirmed they do regular reviews” are weak. “We sampled five privileged accounts and three had no recorded review in the last 12 months” is defensible and actionable.

Handling nonconformities and corrective action

Finding nonconformities is a sign the audit is working, not failing. Each one should be recorded clearly, with the requirement breached and the evidence. From there, follow Clause 10.2:

• Correction. The immediate fix for the specific instance, for example re-enabling the missing review on those three accounts.
• Root cause analysis. Why did it happen? A missing calendar reminder is a different cause from an unowned process or an under-resourced team.
• Corrective action. The systemic change that prevents recurrence, such as automating the review schedule or assigning clear ownership.
• Verification. Confirm at a later date that the action worked. An action marked closed without verification is not really closed.

Be wary of an internal audit that reports no findings at all. Certification auditors often regard a perfectly clean internal audit with suspicion, as it usually signals an audit that did not look hard enough rather than a flawless system.

Common internal audit pitfalls

Even well-intentioned audit programmes fall into recurring traps. Recognising them early saves you from findings at certification and from an audit that consumes effort without producing value:

• Auditing documents instead of practice. Confirming a policy exists is not the same as confirming it is followed. The point of Clause 9.2 is to test effectiveness, so always seek operational evidence, not just the procedure.
• Checklist tunnel vision. A checklist is a starting point, not a script. If an interview or record points to a problem outside your prepared questions, follow it. Rigid adherence to a checklist misses the most valuable findings.
• Inadequate sampling. Reviewing a single record proves little. Sample enough instances, across the period and across different teams, to draw a defensible conclusion about whether the control consistently works.
• Vague findings. A finding such as “access control could be improved” is useless. State the requirement, the evidence and the gap precisely so the owner can act.
• No follow-through. An audit whose findings are never actioned or verified is theatre. The value lies in the corrective action loop, not in the audit report itself.

Building auditor competence

Clause 7.2 requires the people performing the ISMS work, including auditors, to be competent. A capable internal auditor needs more than familiarity with the standard. They need enough technical understanding to judge whether a control genuinely works, the interviewing skill to draw out how things really happen rather than how they are supposed to, and the impartiality to report uncomfortable findings without softening them.

For smaller organisations, this competence is often the hardest part. Recognised auditor training helps, but practical experience of how controls fail in the real world is what separates a perfunctory audit from a useful one. This is one reason many Australian organisations bring in external expertise for at least some audits: it injects competence and independence at once, and lets internal staff learn alongside an experienced auditor.

Reporting and linking to management review

The audit report should be concise and decision-ready: scope and objectives, what was sampled, findings classified by severity, and clear recommendations. Avoid burying a major issue in a wall of minor observations. Leadership needs to see, at a glance, what is broken and what it would take to fix it.

Audit results then feed directly into the management review under Clause 9.3, where executives weigh them alongside incident trends, security objectives and resourcing. This closes the loop: audits identify problems, management decides on action and resources, and the next audit verifies the fix. Organisations that treat these two activities as connected, rather than separate compliance rituals, get far more value from both.

Where this fits in your wider programme

Internal audit does not exist in isolation. It works best alongside a clear risk assessment, a well-maintained Statement of Applicability, and an honest view of your control maturity. For Australian organisations that also align to the Essential Eight or operate under regulatory regimes such as APRA CPS 234, the same audit discipline can be extended to test those obligations in the same cycle, reducing duplicated effort.

If you would like an experienced, independent internal audit of your ISMS, or help building an audit programme that will survive certification scrutiny, CISO Advisory provides hands-on support to Australian government and private sector organisations. You can get in touch or call 07 2112 8502 to discuss your situation. For broader context on certification, see our guide to ISO 27001.