ISO/IEC 27001 FAQ Internal Audit

Build an audit programme that states frequency, methods, responsibilities, planning requirements, and reporting. Consider the importance of each process and previous audit results rather than defaulting to equal annual coverage.

For each audit, define the audit criteria and scope before testing. Collect objective evidence through records, observation, interviews, demonstrations, and samples; report the results to relevant management; then handle confirmed nonconformities through the corrective-action process.

Retain evidence that the audit programme was implemented and the audit results. A usable audit file identifies the criteria and scope, auditor, dates, methods, samples, evidence examined, conclusions, and reported findings.

A finding should distinguish a nonconformity from an observation or improvement suggestion. ISO/IEC 27001 requires action on nonconformities; labels such as observation or opportunity for improvement come from the organization's audit method and should not be used to weaken a failure to meet a requirement. For a nonconformity, link the unmet requirement and evidence to correction, cause analysis, corrective action, and the later effectiveness review required by Clause 10.2.

The auditor forms and reports the audit conclusion; relevant management receives the results. The process owner normally owns correction and corrective action, while someone able to make an objective judgment verifies completion and effectiveness under the organization's procedure.

Do not close a nonconformity because a due date passed or a document was uploaded. Confirm the immediate correction, assess the cause and whether the issue could exist elsewhere, implement any needed corrective action, and review its effectiveness. For example, correcting one missing approval fixes the sampled record; changing the workflow and then testing later approvals may address and verify the systemic cause.

ISO/IEC 27001 requires internal audits at planned intervals but sets no universal annual frequency. Set the programme so the organization can judge conformity and effective implementation across the ISMS, using process importance and previous results to decide timing and coverage.

A major change, incident, repeated failure, overdue corrective action, or new risk may justify an additional or earlier audit. That is a risk-based programme decision, not a separate fixed timetable imposed by the standard.