Key takeaways
- Audit the ISMS at planned intervals against your own requirements and the standard, using an audit programme, with impartial auditors.
- Internal audits give an honest view of ISMS conformity before the certification body arrives.
- Start here: plan audits at intervals covering the full ISMS.
Purpose
Audit the ISMS at planned intervals against your own requirements and the standard, using an audit programme, with impartial auditors.
Requirement
Requirement summaryThe organization shall conduct internal audits at planned intervals to provide information on whether the information security management system: a) conforms to 1) the organization’s own requirements for its information security management system; 2) the requirements of this document; b) is effectively implemented and maintained.
Why it matters
Internal audits give an honest view of ISMS conformity before the certification body arrives.
How to implement
- Plan audits at intervals covering the full ISMS.
- Audit against the standard and your own requirements.
- Use objective and impartial auditors.
- Report results to relevant management.
What evidence you need to provide
Here is what you will typically need to provide for Clause 9.2.1. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your internal audit plan covering the whole programme over a set period.
Records and examples to show
- Internal audit reports with clear results.
- Proof findings were fixed.
Things you should be able to show or explain
- Be able to explain how audits are scheduled.
How much to show: The current plan and the latest reports.
Common mistakes
- Parts of the programme never audited.
- Findings not followed up.
- Auditors auditing their own work.
- Parts of the scope never audited.
- Tip: Do a full internal audit and a management review before your Stage 2 audit.
Policies & documents to have
- Internal audit procedure
FAQ
Can we exclude clause 9.2.1?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
A full audit cycle covering the scope; findings followed up.