ISO 27001 internal audit case study: a Clause 9.2 audit met with evidence

In one paragraph

A small Australian technology company certified to ISO/IEC 27001:2022 needed a Clause 9.2 internal audit before its first surveillance audit. Because the people available internally had designed or operated the management system, the organisation appointed Aegentra to protect objectivity and impartiality. Aegentra audited all of Clauses 4 to 10 and a risk-based sample of 47 Annex A controls across 73 lines of enquiry. No nonconformities were raised. Five opportunities for improvement were recorded, the previous certification audit’s findings were verified as closed, an interim summary was issued before the surveillance audit began, and the final report followed within four business days of the closing meeting.

The client

A small technology company, certified to ISO/IEC 27001:2022, operating with a lean team and a compliance-automation platform, and approaching its first surveillance audit.

The organisation is not named, and will not be. Aegentra publishes no client name without written approval on file. Everything below is therefore stated in terms of what was audited, what was found and how it was reported, which is the part a reader can evaluate.

The challenge: who audits a management system its own authors built?

Clause 9.2 of ISO/IEC 27001 requires internal audits at planned intervals, conducted by auditors who are objective and impartial with respect to what they audit. A small organisation can find that hard to satisfy in-house when the people who designed and operate the management system are also the only available auditors. The position is the same for a forty-person company in Manchester as for one in Melbourne.

A compliance-automation platform does not solve it. It collects evidence continuously and will tell you a control is configured; it will not form an audit opinion, sample against an audit criterion, or satisfy an impartiality requirement that is about people rather than tooling.

There was a second constraint: timing. The audit had to be reported within a narrow window so the results were available as evidence for the certification body and as an input to management review. An internal audit report that arrives after the surveillance audit has already begun has missed the point of running one.

Methodology and limitations

The audit criteria were ISO/IEC 27001:2022 Clauses 4 to 10 in full, the Annex A controls marked applicable in the organisation’s Statement of Applicability and selected for this cycle, and the organisation’s own policies and procedures. Evidence was obtained four ways: interview, inspection of documented information, examination of records and configuration, and sampling of operational records. Each of the 73 lines of enquiry was tied to a criterion and to the evidence that answered it, and every item was indexed in the working papers.

The limitations are the ordinary ones of an internal audit and were stated in the report: conclusions apply to the samples drawn and the period examined; the Annex A coverage was a risk-based subset of 47 controls, with the remaining applicable controls scheduled for the second cycle of the documented programme; and a nil-nonconformity result describes that organisation on the days it was audited, not a standing condition.

Our approach

1. Fixed fee, agreed before fieldwork

   The audit plan, the audit criteria and the sampling rationale were agreed and signed off before any fieldwork began. Scope was therefore not something that moved once testing was under way, and the fee did not move with it. UK engagements are run the same way: a fixed fee from £1,500 + VAT after scoping, with the plan agreed in writing.

2. A documented two-year audit programme

   Clause 9.2 requires a documented audit programme. The controls sampled in this cycle and those scheduled for the next were planned together so that the two cycles achieve the coverage planned for the three-year certification cycle. The coverage decision and its rationale were recorded in the programme.

3. Independent audit team

   Fieldwork was led by a certified ISO 27001 Lead Auditor who also holds CISA and CISM. Engagement oversight and report issue sat with a certified ISO 27001 Lead Implementer. Neither had any part in designing or operating the management system under audit, which is what Clause 9.2 means by objective and impartial.

4. Evidence obtained four ways, and indexed

   Interview, inspection of documented information, examination of records and configuration, and sampling of operational records. Every item was indexed and retained in the working papers, so each conclusion in the report can be traced back to the evidence that supports it.

5. Matters tested before they were reported

   Anything raised during fieldwork was put back to the organisation and tested against its evidence before it reached the report, rather than carried into the report unexamined. That is why two potential nonconformities were closed on evidence instead of being written up.

The outcome

The audit covered all requirements of Clauses 4 to 10 and a risk-based sample of 47 Annex A controls, across 73 lines of enquiry. No nonconformities were identified. Five opportunities for improvement were recorded, and the previous certification audit’s findings were verified as closed.

Two matters initially raised as potential nonconformities were examined further and closed on evidence. Both were reported transparently as such, with the reasoning recorded in the working papers, rather than dropped silently and rather than left in the report because withdrawing a finding is awkward.

An interim summary was issued before the surveillance audit began, giving the organisation a written position for its certification body on day one. The final report followed within four business days of the closing meeting.

Nonconformity, opportunity for improvement, observation

The three terms are not interchangeable, and organisations routinely lose ground at surveillance for recording one as another. The distinction is what a finding is measured against.

In this engagement the split was five opportunities for improvement and no nonconformities, with two potential nonconformities examined and closed on evidence before the report was issued.

What a UK organisation can take from it

• The impartiality problem is universal. If the only people who can audit your ISMS built it, Clause 9.2.2 is not met. Outsourcing the internal audit is the route the standard explicitly allows, and a UKAS-accredited certification body will ask to see the impartiality assessment either way.
• Coverage can be planned across the cycle. Forty-seven controls in cycle one and the balance in cycle two is a legitimate programme when the rationale is written down. It also keeps each audit proportionate and the fee predictable.
• Timing is part of the deliverable. An interim summary before the external auditor arrives, and a final report within days of the closing meeting, is what makes the internal audit usable as evidence rather than a filed document.
• The same method is available here. The seven steps, the indexed working papers and the fixed fee after scoping are described on the ISO 27001 internal audit service page; the wider practice, covering ISO 27001, ISO 42001, ISO 27701, ISO 9001 and ISO 45001, is on the internal audit services page.

Download

Choose the next step.