Internal audit

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

Internal audits must be carried out at planned intervals to give information on whether the ISMS conforms to the organization's own ISMS requirements and to this standard, and whether it is effectively implemented and maintained. The organization must plan, establish, implement and maintain one or more audit programmes that set out how often and how audits are done, who is responsible, what planning they need and how they are reported, taking into account the importance of the processes involved and the results of earlier audits. Each audit gets defined criteria and a defined scope, auditors are chosen and audits run so the process is objective and impartial, and relevant management receives the results. Documented information must be available as evidence of the programme's implementation and of audit results.

How the 2020 guidance taught the audit

This row guides auditors examining the organization's own internal audits (and applies equally to external, self or peer assessments). Auditors confirm that an internal audit programme is planned, implemented and maintained to give information on whether the ISMS conforms both to ISO/IEC 27001 and to the extra ISMS requirements the organization set for itself, and whether it is effectively implemented. They check that audits are planned on the importance of the processes audited and previous results; that methods for planning and conducting audits are set; that roles and responsibilities are allocated with regard to the integrity and independence of the audit process; and that objectives, criteria and scope are set for each audit, criteria being references such as policies, procedures and requirements against which verifiable records or statements are compared and scope covering locations, units, activities, processes and the period. Whether the programme is run by internal staff or by outsiders on the organization's behalf, the selection of those managing it and of the auditors must meet competence requirements. Results must reach the management of the audited function and others as appropriate, and audit information and trends must be reviewed in management review.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

The 2022 clause is split into 9.2.1 General and 9.2.2 Internal audit programme. The audit programme requirements are now explicit, including frequency, methods, responsibilities, planning and reporting.

Evidence an auditor asks for

• Internal auditInternal audit programme and individual audit plans with objectives, criteria and scope
• Internal auditAudit reports and findings
• Internal auditCompetence and independence evidence for the programme manager and auditors
• Internal auditManagement review records considering internal audit results and trends

The questions an auditor will ask

Ask for the internal audit programme and compare it with the 27007 guidance and the 2022 9.2 requirements.

Common gaps

• Programme ignores process importance and earlier results
• Auditors audit their own work
• Audits check conformance to ISO/IEC 27001 only, not to the organization's own requirements
• Findings not reported to the audited function's management

Prepare before the next audit

Refresh the internal audit procedure to the 2022 9.2.1 and 9.2.2 structure and to the 27007 records.

Cross-references

5.1 5.5.2