The short answer
An ISO 27001 internal audit is the check required by clause 9.2 of ISO/IEC 27001:2022 that your ISMS meets the standard and your own rules, and actually works. It must be planned, objective and recorded. Certification bodies expect one before Stage 2 and in each year of the three-year certificate cycle.
On this page
- What does ISO 27001 require from an internal audit?
- Why outsource your ISO 27001 internal audit?
- What does the internal audit cover?
- ISO 27001 internal audit checklist
- How to audit ISO 27001 step by step
- What you receive
- Internal audit vs certification audit
- How often should you do an ISO 27001 internal audit?
- ISO 27001 internal audit plan and programme
- What does an outsourced internal audit cost?
- Why Sovereign Secure
- Book your ISO 27001 internal audit
An ISO 27001 internal audit is the independent check, required by clause 9.2 of ISO/IEC 27001:2022, that your information security management system (ISMS) conforms to the standard and to your own policies, and that it works in practice. We plan the programme, sample the evidence, grade findings as a certification auditor would, and hand you a report and corrective action tracker for management review.
Sovereign Secure Ltd is an ISO 27001-certified UK consultancy, a PCI SSC-approved QSA company and an IASME-licensed Cyber Essentials certification body. We carry out internal audits. Certification audits are carried out by an independent certification body, our partner MQA International.
What does ISO 27001 require from an internal audit?
Clause 9.2 of ISO/IEC 27001:2022 requires a planned audit programme, objective auditors, results reported to management and records to prove it. Here is what each part means in practice.
| Requirement | What it means in practice | Evidence the certification auditor asks for |
|---|---|---|
| 9.2.1 Audits at planned intervals | Check conformity with ISO 27001 and your own ISMS rules, and whether it is effectively implemented | Completed audit reports covering the ISMS scope |
| 9.2.2 Audit programme | Set frequency, methods, responsibilities and reporting, weighted by process importance and previous results | A dated programme, ideally across the three-year cycle |
| 9.2.2 a) Criteria and scope | Each audit states what it tests and against which requirements | An audit plan for each audit |
| 9.2.2 b) Objectivity and impartiality | Auditors do not audit their own work | Auditor names, and their independence from the areas audited |
| 9.2.2 c) Reporting | Results reach relevant management | Report distribution, and audit results as a management review input (9.3) |
| 10.2 Corrective action | Findings are corrected and root causes removed | Nonconformity records and closure evidence |
Some buyers call this an ISO 27001 compliance audit; the requirement is the same.
Why outsource your ISO 27001 internal audit?
Mainly for objectivity: in a small team, the person who wrote the risk assessment and policies cannot audit them.
| Aspect | In-house auditor | Outsourced internal audit |
|---|---|---|
| Objectivity | Hard in small teams; needs someone from outside the areas audited | Independent of your ISMS by default |
| Competence | Staff need audit training (ISO 19011 techniques) and practice | Auditing against published standards is our day-to-day work |
| Calibration | Findings may be too soft or too strict | Graded as a certification body would grade them |
| Time | Takes your ISMS owner away from running the ISMS | Your team’s time goes on interviews and fixes |
| Ownership | Yours | Still yours: you own the programme, management review and actions |
An external internal audit can also support Annex A control 5.35 (independent review of information security).
What does the internal audit cover?
The whole management system: the ISO 27001 requirements in clauses 4 to 10 and every Annex A control your Statement of Applicability (SoA) says applies.
| Area | What we sample |
|---|---|
| Context and leadership (4 to 5) | Scope statement, interested parties, climate change consideration (added by Amendment 1 in 2024), policy communication, roles |
| Planning (6) | Risk assessment and treatment, risk acceptance, SoA justification, security objectives |
| Support and operation (7 to 8) | Training and awareness records, document control, risk reviews at planned intervals, outsourced processes |
| Performance and improvement (9 to 10) | Monitoring results, the last management review, corrective action log |
| Organisational controls (5.1 to 5.37) | Asset inventory, supplier assessments, incident records, cloud services, access rights for joiners and leavers |
| People, physical, technological (6 to 8) | Screening, secure disposal, backups and restore tests, logging, vulnerability management (8.8), change control |
Where 8.8 or 8.29 needs technical evidence, we also provide the testing. See ISO 27001 penetration testing.
ISO 27001 internal audit checklist
Whoever carries out your internal audit, these are the eight things a certification auditor will check about it. Use this list to test your own audit before Stage 1 or a surveillance audit; for the full clause and Annex A readiness list, use our ISO 27001 audit checklist or download it as a spreadsheet.
| Check | What good looks like | Clause |
|---|---|---|
| Audit programme | A dated programme that covers the whole ISMS over the cycle, weighted by risk and previous results | 9.2.2 |
| Scope and criteria | Each audit states what it covers and the requirements it tests against | 9.2.2 a) |
| Auditor independence | Auditors are competent and do not audit their own work | 9.2.2 b) |
| Documents reviewed | Scope, risk assessment, Statement of Applicability, policies, objectives and previous audit results | 9.2.1 |
| Records sampled | Evidence that controls operate, such as leavers, access reviews, supplier checks, backups and incidents | 9.2.1 b) |
| Nonconformity grading | Findings graded consistently as major, minor, observation or opportunity for improvement | 9.2.2 c), 10.2 |
| Corrective action | Each nonconformity has a correction, a root cause, an owner, a date and a check that it worked | 10.2 |
| Management review input | Audit results reported to management and recorded as an input to the review | 9.2.2 c), 9.3.2 |
How to audit ISO 27001 step by step
Every rating rests on evidence we have seen, not on a questionnaire answer.
- Programme and scope. Audits planned against your SoA, risks and previous findings.
- Audit plan. Criteria, scope, dates and interviewees sent in advance.
- Document review. Risk assessment, SoA, policies, objectives, previous audits and corrective actions.
- Interviews and sampling, remote or on site: records such as leavers, access reviews, supplier checks and incidents.
- Closing meeting. Findings agreed on the day, so the report holds no surprises.
- Report and follow-up. We verify corrective actions before your next external audit.
How findings are graded
| Grade | Example | What happens next |
|---|---|---|
| Major nonconformity | No management review has taken place | Fix before the certification audit; a certification body will not certify with one open |
| Minor nonconformity | Two leavers’ accounts disabled days late | Correction and root-cause fix under clause 10.2 |
| Observation | Supplier reviews due next month with no owner assigned | Act before it becomes a nonconformity |
| Opportunity for improvement | Access reviews work but are manual | Optional |
What you receive
- Internal audit programme covering the three-year cycle, mapped to clauses and your SoA.
- Audit plan for each audit.
- Audit report with the scope, criteria, evidence sampled and a conclusion on conformity and effectiveness.
- Nonconformity records with fields for correction, root cause and corrective action.
- Corrective action tracker with owners and dates.
- Management review input summary for clause 9.3.
Internal audit vs certification audit
Your internal audit comes first. Then an independent certification body carries out Stage 1, Stage 2, the annual surveillance audits and recertification. This page covers the internal audit; for what happens at each certification stage, see our guide to the ISO 27001 audit.
| Audit | Who carries it out | When | Purpose |
|---|---|---|---|
| Internal audit | You, or an auditor you appoint | Before Stage 2, then at planned intervals | Checks conformity and effectiveness; can suggest improvements |
| Stage 1 | Certification body | Start of certification | Reviews documentation and readiness, including whether internal audits and management reviews are planned and being performed |
| Stage 2 | Certification body | After Stage 1 | Tests whether the ISMS works; leads to the certification decision |
| Surveillance | Certification body | Years two and three | Samples part of the ISMS; always reviews internal audit, management review and corrective actions |
| Recertification | Certification body | Before the three-year certificate expires | Reviews the whole ISMS for a new cycle |
Certification bodies must stay impartial and will not help you fix what they find, so the internal audit is where you find problems first. For their fees, see ISO 27001 certification cost.
How often should you do an ISO 27001 internal audit?
At least once before Stage 2, then at planned intervals, which in practice means before every surveillance audit. A typical three-year programme:
| When | Internal audit focus |
|---|---|
| Before Stage 1 and 2 | Full scope: clauses 4 to 10 and every applicable Annex A control |
| Before surveillance audit 1 | Clauses 4 to 10, higher-risk Annex A controls, and previous findings closed |
| Before surveillance audit 2 | Clauses 4 to 10 and the remaining Annex A controls |
| Before recertification | Full scope, ready for the new cycle |
Audit more often after major change, such as an acquisition, migration or serious incident.
ISO 27001 internal audit plan and programme
The audit programme sets what is audited across the three-year cycle; the audit plan sets out each individual audit. Many organisations spread the year’s internal audits across quarters rather than auditing everything at once, so findings are fixed well before the surveillance audit. A sample annual plan:
| Quarter | Audit focus | Clauses and Annex A controls | Who is interviewed |
|---|---|---|---|
| Q1 | Context, leadership and risk | Clauses 4 to 6, 8.2 and 8.3 | Top management, ISMS owner, risk owners |
| Q2 | People and suppliers | Clause 7, Annex A 6.1 to 6.8 and 5.19 to 5.23 | HR, procurement, supplier owners |
| Q3 | Technology and operations | Annex A 8.1 to 8.34, incident and continuity controls 5.24 to 5.30 | IT, development, service desk |
| Q4 | Performance and improvement | Clauses 9.1, 9.3 and 10, plus every open finding | ISMS owner, top management |
Each audit in the programme then gets its own plan, sent to the people involved in advance:
| Audit plan item | Example |
|---|---|
| Objective | Confirm supplier security controls conform to the ISMS and operate effectively |
| Criteria | ISO/IEC 27001:2022 clauses 8.1 and 8.3, Annex A 5.19 to 5.23, the supplier security policy |
| Scope | Suppliers with access to customer data or production systems |
| Auditor | Named, and independent of procurement and IT |
| Dates and interviews | Half a day remotely; procurement lead and two supplier owners |
| Sampling | Five suppliers onboarded or reviewed in the last 12 months |
| Reporting | Report to the ISMS owner within a week; results feed the next management review |
What does an outsourced internal audit cost?
We price by audit days and give a fixed quote for a single audit or for a three-year programme. For context, a published cost guide from a UK provider we reviewed in September 2026 put ISO 27001 consultant day rates at £400 to £1,000.
| Cost driver | Effect on audit days |
|---|---|
| People in scope | More teams to interview and records to sample |
| Sites and entities | Possible site walkthroughs and wider sampling |
| Applicable Annex A controls | More controls to test, especially technological ones |
| Full scope or rotation | A full-scope audit before Stage 2 takes longer than a rotating surveillance-year audit |
| Maturity | Clean records and a working corrective action log make sampling faster |
Not ready for audit yet? Start with an ISO 27001 gap analysis, or self-assess with our ISO 27001 checklist.
Why Sovereign Secure
- We hold ISO 27001 ourselves and face the same surveillance audits you do.
- Auditing is our core work. We are a PCI SSC Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA) company, and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) 2026 to 2028, so assessing organisations against published standards is what we do.
- One audit, several frameworks. We can map ISO 27001 findings to PCI DSS and Cyber Essentials. See Cyber Essentials vs ISO 27001.
- Independent certification. Certification audits are carried out by an independent certification body, our partner MQA International, and our ISO 27001 consultancy can support you before and after certification.
- UK company since 2012, headquartered in Accrington, Lancashire (Companies House 08334453).
Book your ISO 27001 internal audit
Tell us how many people and sites are in scope and your next external audit date, and we will send a fixed quote. Request a quote or call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
