Key takeaways
- Audit the ISMS at planned intervals against your own requirements and the standard, using an audit programme, with impartial auditors.
- An audit programme ensures audits are planned, consistent and risk-based.
- Start here: plan an audit programme with frequency, methods, responsibilities and reporting.
Purpose
Audit the ISMS at planned intervals against your own requirements and the standard, using an audit programme, with impartial auditors.
Requirement
Requirement summaryThe organization shall plan, establish, implement and maintain an audit programme(s), including the frequency, methods, responsibilities, planning requirements and reporting. When establishing the internal audit programme(s), the organization shall consider the importance of the processes concerned and the results of previous audits. The organization shall: a) define the audit criteria and scope for each audit; b) select auditors and conduct audits that ensure objectivity and the impartiality of the audit process; c) ensure that the results of the audits are reported to relevant management; Documented information shall be available as evidence of the implementation of the audit programme(s) and the audit results.
Why it matters
An audit programme ensures audits are planned, consistent and risk-based.
How to implement
- Plan an audit programme with frequency, methods, responsibilities and reporting.
- Prioritise processes by importance and previous results.
- Define criteria and scope for each audit.
- Keep records of the programme and results.
What evidence you need to provide
Here is what you will typically need to provide for Clause 9.2.2. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your audit programme: frequency, methods, responsibilities and reporting.
Records and examples to show
- Records showing auditors were independent of the work they checked.
- Proof audit results reached the relevant managers.
Things you should be able to show or explain
- Be able to explain how auditors are chosen.
How much to show: The current audit programme.
Common mistakes
- Auditors checking their own work.
- Reports not shared.
- No programme, only ad hoc audits.
- Ignoring previous audit findings.
- Tip: Do a full internal audit and a management review before your Stage 2 audit.
Policies & documents to have
- Internal audit procedure
FAQ
Can we exclude clause 9.2.2?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
A full audit cycle covering the scope; findings followed up.