ISO 27001 Internal Audit: Testing Before Certification
An ISO 27001 internal audit tests whether your information security management system (ISMS) meets requirements and operates effectively before certification. It should connect documented controls with operational evidence, identify weaknesses and confirm that corrective actions work.
For leadership teams, this provides a clear view of readiness and unresolved security risks. Start with the audit requirements, then build a programme that tests how your organisation manages information in practice.
Key takeaways
Audit both ISO/IEC 27001 requirements and your organisation's own ISMS commitments.
Assign competent, impartial auditors who don't assess their own work.
Test records across the audit period, report findings to management and verify corrective actions before closure.
What clause 9.2 requires
Clause 9.2 requires internal audits at planned intervals. They must assess whether the ISMS conforms to ISO/IEC 27001:2022 and your organisation's requirements, and whether it's effectively implemented and maintained.
Your audit programme should use a risk-based approach to set audit frequency and process coverage. Consider process importance, previous results, significant changes and risk. Define responsibilities, planning arrangements, reporting, methods, and the criteria and scope for each audit.
Report results to relevant management. Retain documented information demonstrating that the programme was implemented and recording its results.
The ISO/IEC 27001 requirements standard doesn't prescribe a universal annual internal audit frequency. An annual programme is a practical starting point, with more frequent attention for high-risk processes, significant changes or recurring failures.
One audit in three years is problematic where it breaches your programme or leaves important processes unassessed. The issue is inadequate planned coverage, rather than a fixed annual rule.
1. Plan the audit and protect independence
Define boundaries and priorities
Define the audit scope through the services, locations, systems, suppliers and business functions included. An outsourced cloud platform supporting an in-scope service remains relevant to the ISMS, even though another company operates it.
Set audit criteria using the standard, policies, contractual obligations and documented commitments. Prioritise previous findings, privileged access, cloud services and significant operational changes.
Agree interviewees, evidence access and reporting dates before fieldwork. Include HR, operations and procurement where they own relevant controls.
Decide who audits each process
An internal auditor needs competence, objectivity and impartiality. Protect auditor independence by ensuring auditors don't audit their own work or assess their own departments.
A small organisation can use trained cross-functional auditors for suitable processes and independent specialists for areas without sufficient separation. ISO 27001 training supports competence, but doesn't remove conflicts.
A vCISO responsible for designing security governance shouldn't independently audit those decisions. If one consultancy supports implementation and internal auditing, allocate separate auditors and document safeguards against self-review.
2. Review documentation and build the checklist
Review the scope, risk assessment, treatment plan, Statement of Applicability (SoA), policies, previous findings and management review records.
Our Statement of Applicability guide explains how control decisions connect with implementation and evidence. Test that connection rather than accepting an "implemented" status without supporting records.
Build an audit checklist around clauses 4 to 10 and applicable controls. Use it to track coverage and traceability, then test against evidence.
Clause | Practical audit question | Evidence to examine |
|---|---|---|
4: Context | Does the scope reflect actual operations? | Scope, interested parties, service boundaries |
5: Leadership | Are responsibilities and policy approved? | Policy approval, assigned roles |
6: Planning | Do risks drive treatment decisions? | Risk register, treatment plan, SoA |
7: Support | Are people competent and documents controlled? | Training records, document history |
8: Operation | Are planned processes performed? | Assessments, approvals, operational records |
9: Evaluation | Are performance and governance reviewed? | Metrics, audits, formal ISMS review, governance records |
10: Improvement | Are causes addressed and actions effective? | Findings, corrective actions, retest results |
These questions establish coverage; follow-up questions test effectiveness.
Commercial checklist packs may contain 153 management-system questions and 93 Annex A questions. Neither count is an ISO requirement. A relevant question supported by reliable evidence matters more than checklist length.
3. Test Annex A controls with operational evidence
The 2022 revision replaced 114 controls across 14 categories with 93 controls across four themes: organisational, people, physical and technological. Eleven controls were new.
The transition deadline was 31 October 2025, so current audits should use the 2022 structure. Annex A is a reference set, not a requirement to implement every control. Test necessary controls and the justification for exclusions.
Trace access decisions through real records
For A.5.18, access rights, select joiners, role changes and leavers across the audit period. Compare HR records with approval tickets, account changes and removal timestamps.
Ask who authorised access, whether privileges matched responsibilities and how exceptions were handled. Include cloud applications and privileged accounts.
Record the population, selection method, sample size, audit evidence references and result. Expand testing when exceptions suggest a wider failure. Protect sensitive records within the audit repository.
Test recovery, not backup status alone
For A.8.13, information backup, examine backup requirements, job records and restoration tests. A successful backup job doesn't demonstrate recoverability.
Compare restored data and recovery times with approved requirements. Review failures and resulting actions. Technical demonstrations should use authorised, controlled arrangements without disrupting production.
A policy proves what the organisation requires. Dated operational records show whether people followed it during the period under review.
Use interviews, observation and system records together. A single screenshot rarely establishes sustained operation.
4. Report findings and verify corrective actions
Classify findings against requirements
Document nonconformities against the applicable requirement, objective evidence and identified gap. Major and minor classifications should follow your defined audit method.
A major nonconformity indicates failure affecting the management system's ability to achieve intended results. A missing risk assessment process or widespread failure to implement controls claimed in the SoA can meet that threshold.
A minor nonconformity is a limited failure that doesn't indicate systemic breakdown, such as an isolated overdue review within an otherwise functioning process.
An observation or opportunity for improvement identifies potential enhancement without an established breach. Don't use that label to soften a genuine nonconformity.
Address causes and retest effectiveness
Report the scope, criteria, dates, sampling limitations, audit findings and conclusions to relevant management.
Assign an owner, deadline and risk-based priority to each corrective action. Correct the immediate issue, investigate its cause and address recurrence.
For an active leaver account, disabling access is the correction. Repairing the HR-to-IT notification process addresses the cause. Testing subsequent departures demonstrates effectiveness.
Common weaknesses include cloud services missing from scope, hybrid-working risks absent from assessments and unimplemented SoA commitments.
Our risk assessment guidance supports the link between changing operations and treatment decisions. Retest controls and retain closure evidence to confirm effectiveness, prevent recurrence and support continuous improvement of the ISMS.
5. Allow time before the certification audit
For a mid-sized organisation, allow six to eight weeks for audit readiness before certification, provided the ISMS is already operating. This isn't an ISO-prescribed timetable.
Use the opening weeks for scope agreement, document review and evidence selection. Complete interviews and testing next, then leave time for corrective actions, retesting and management review. Serious weaknesses may take longer to resolve.
BSI's assessment and certification process distinguishes two initial audit stages:
The Stage 1 audit reviews documentation and readiness, often remotely. It covers scope, risk methodology, the SoA and governance records.
The Stage 2 audit assesses implementation through staff interviews, records and observation, usually including on-site activity. Remote or hybrid arrangements depend on the audit programme.
Complete internal auditing early enough for findings to inform management review and readiness decisions.
After certification, the first surveillance audit must occur within 12 months of the certification decision. The next commonly falls around month 24. Some programmes use shorter intervals, including six months.
Recertification assesses continued conformity and effectiveness before the three-year certificate expires. It doesn't automatically repeat the initial two-stage sequence. Our surveillance audit preparation guide explains ongoing evidence expectations.
6. Compare in-house and outsourced audit costs
In-house auditing uses staff time for training, preparation, interviews, reporting and follow-up. It works where competent people can audit independently without weakening operational delivery.
Outsourcing provides separate audit capacity and specialist competence. Compare the scope and deliverables, including whether follow-up testing is included.
Published UK pricing examples illustrate the difference between engagement types.
Engagement | Published pricing example |
|---|---|
Outsourced internal audit | From £4,500 plus VAT over one to two weeks |
Broader programme or multi-site scope | From £9,500 plus VAT |
Small to mid-sized certification project | Approximately £5,000 to £15,000 |
These are market examples, not AKRUP quotations. Certification costs are separate from internal audit costs and aren't directly comparable. Scope, locations and remediation needs affect the overall budget.
Our ISO 27001 consultancy and audit support includes gap analysis, independent internal audits and certification readiness. Organisations should retain ownership of risk decisions and corrective actions regardless of who conducts the audit.
Frequently asked questions
Do clauses and Annex A need separate checklists?
No. One controlled checklist can cover both, provided requirements, applicable controls, evidence and findings remain traceable. Separate tabs can simplify ownership and prevent management-system requirements being overlooked.
Can evidence support other frameworks?
Yes, where requirements and scope align. ISO 42001 governance, CMMC requirements and automotive information security may share supporting records, but require separate assessment against their own criteria.
ENX's TISAX Participant Handbook explains the automotive assessment process. TISAX training and consultancy should address that process directly; ISO 27001 auditing doesn't replace a TISAX assessment.
Prepare controls to withstand independent testing
A useful ISO 27001 internal audit gives leadership evidence-based assurance about control operation and unresolved weaknesses. Its value depends on impartial testing, clear findings and corrective actions supported by retesting.
Plan early enough to demonstrate improvement before certification, rather than arriving with completed documents and untested controls.
If you would like to find out more information or require any of our services please Contact Us and complete the enquiry form.
Comments