Blog

ISO 27001 internal audit checklist (clause 9.2).

The internal audit is where you check your own ISMS before anyone else does. Clause 9.2 of ISO/IEC 27001:2022 asks whether the ISMS conforms to your own requirements and to the standard, and whether it is effectively implemented and maintained.

Below: what 9.2 actually requires, a working checklist for clauses 4 to 10 and a sample of Annex A controls, and what to do with the findings afterward.

What clause 9.2 requires

• Planned intervals. Internal audits happen on a schedule you set, not only when something goes wrong. The standard does not fix the interval.
• An audit program. Frequency, methods, responsibilities, planning requirements and reporting, taking into account how important each process is and what earlier audits found.
• Criteria and scope for each audit. Every audit states what it checks against (the standard, your policies, your SoA) and which parts of the ISMS it covers.
• Objective and impartial auditors. The people auditing are chosen and the audit is run so the result is objective. In practice, nobody audits their own work.
• Results reported to relevant management. Findings go to the people who can act on them, not just into a file.
• Documented information as evidence. You keep records showing the program was carried out and what the audits found.

The standard does not say who must audit. A small organization can use a trained colleague from another team, or an outside auditor, as long as they are not auditing their own work. ISO 19011 is the general guidance standard for auditing management systems if you want more on method.

Timing: certification bodies generally expect to see at least one completed internal audit and management review before the Stage 2 audit. Ask yours what they expect for your first cycle.

Before the audit

• Write down the criteria (ISO/IEC 27001:2022, your policies, your Statement of Applicability) and the scope of this audit.
• Pick the auditor and record why they are objective for this area.
• Choose the Annex A controls to sample. Weight the sample toward high risks, controls that changed, and areas with findings last time.
• Tell the people being audited when, and what records you will ask for.

The checklist: clauses 4 to 10

For each line, ask for the record that proves it, not a description of it. “We do that” is not evidence; the review sign-off, the ticket or the training log is.

The checklist: a sample of Annex A controls

You do not need to audit all 93 controls every time, but over your audit program every applicable control should be covered. Take the sample from your SoA. These are common starting points:

• 5.15 / 5.18☐ Access control policy exists, and access rights were actually reviewed when the policy says they would be. Ask for the last review record.
• 5.19-5.23☐ Key suppliers, including cloud services, were assessed and their security requirements are in contracts.
• 5.24-5.27☐ Incidents are logged, handled per the plan, and lessons learned are recorded.
• 6.3☐ Awareness training happened, for the people the plan says, with records.
• 8.8☐ Technical vulnerabilities are identified and fixed within the timescales you set.
• 8.13☐ Backups run, and a restore has been tested.
• Exclusions☐ Each Annex A control marked not applicable still has a justification that holds against the current scope and risk assessment.

Recording findings

Each finding should state the requirement, what you found, and the evidence you looked at. Typical categories are a conformity, a nonconformity (a requirement is not met), an observation (not yet a nonconformity, but heading there), and an opportunity for improvement. ISO 27001 itself does not define “major” and “minor”; certification bodies use those grades, and many organizations borrow them internally.

From nonconformity to corrective action (clause 10.2)

For every nonconformity, clause 10.2 asks you to react (correct it and deal with the consequences), find the cause, check whether it could happen elsewhere, take corrective action, and review whether that action worked. Keep records of the nonconformity, what you did, and the result. A nonconformity closed without an effectiveness check is a common audit finding in its own right.

Feeding the management review (clause 9.3)

Audit results are a required input to management review, along with the status of nonconformities and corrective actions, monitoring results, risk assessment results and the status of the risk treatment plan. Report the audit to the relevant managers when it closes, then bring the summary and the open actions to the next review so leadership can decide what to change.

How GapLedger handles internal audits

In GapLedger, each internal audit records the framework, the planned date, the scope, the auditor and the auditor's qualifications, and moves from planned to completed with a summary. Findings are logged as conformity, nonconformity, observation or opportunity for improvement, and a nonconformity or observation becomes a tracked nonconformity in one step, with corrective actions, owners, due dates and an effectiveness note. The management review form then opens with a snapshot of open nonconformities, open corrective actions, open and high risks, and the last completed audit. All of it goes into the audit pack PDF for your certification auditor.

See how a first ISO 27001 audit goes, step by step, or read the ISO 27001 software page for the rest of the ISMS.