How to conduct an ISO 27001 internal audit: a seven-step method with templates

Before you start: what an internal audit has to achieve

An ISO 27001 internal audit has one job, set by Clause 9.2 of ISO/IEC 27001:2022: provide information on whether the information security management system conforms to the organisation’s own requirements and to the standard, and whether it is effectively implemented and maintained. The seven steps below are the method Aegentra uses on outsourced audits for UK organisations, written out so that an internal team can run the same process. Each step names its inputs, its output and a realistic time range for a single-site organisation of up to about one hundred people. Larger scopes scale the sampling and interview days, not the method.

If you need the requirement itself explained first, read the Clause 9.2 requirements guide. If you want the audit done by an independent auditor, the ISO 27001 internal audit service page describes the same seven steps as a fixed-fee engagement from £1,500 + VAT.

The seven steps, with inputs, outputs and time

1. Scope and plan the audit

   Time half a day to one dayInputs audit programme, ISMS scope statement, Statement of Applicability, previous audit report, organisation chartOutput a written audit plan

   Start from the audit programme, not from a checklist. Confirm which clauses and which applicable Annex A controls this audit covers, which sites, systems and teams are in scope, and which period of records you will sample. Write the criteria explicitly: the clause numbers, the control references from the SoA, and the organisation’s own policies and procedures you will test against.

   Record the auditor’s competence and independence in the plan. If the auditor had any part in designing or operating a control in scope, exclude that control from their work or assign it to someone else. Agree evidence access and confidentiality with the ISMS owner, and send interview requests with the topics listed so people arrive with the right records.

2. Review the documented information

   Time one to two daysInputs policies, procedures, risk assessment and treatment plan, SoA, objectives, audit programme, management-review minutes, previous findingsOutput an evidence request list and a question set per area

   Read the ISMS documents against the criteria before you speak to anyone. The purpose is not to grade the writing; it is to learn what the organisation has committed to, so that interviews and sampling can test whether those commitments are kept. Note every place where a procedure sets a specific obligation (a timeframe, an approval, a review period, a record to be kept): each is a testable criterion.

   Build the evidence request list from those obligations. For a leaver procedure that requires access removal within one working day, the request is the leaver population for the period and the access-removal records for a sample. For a supplier security policy that requires annual review, the request is the supplier register and the review records.

3. Interview control owners

   Time one to two daysInputs question set, evidence request list, access to the people who run each processOutput interview notes referenced to criteria

   Interview the people who operate the controls, not only the ISMS manager. Ask how the process actually runs, what happens when it does not, and what records exist. Listen for the difference between what the procedure says and what is done. Where someone describes a record, ask to see it during the interview rather than accepting the description; this is the single habit that most improves audit quality.

   Keep notes that reference the criterion each answer relates to. Interview evidence is useful for understanding and for finding where to sample; on its own it rarely supports a conclusion about effectiveness.

4. Select the sample and test the evidence

   Time one to three daysInputs the complete population behind each control (leavers, changes, incidents, supplier reviews, access reviews), the records for the sampled itemsOutput evidence references and test results

   Reconcile the population first. If the leaver list comes from HR and the access-removal tickets from IT, compare them before sampling, because the gap between the two is often the finding. Choose a sample that is justified in writing: risk, volume, change and previous results drive the size, not a fixed percentage. For a small UK organisation, a sample of five to ten items per control is common; the rationale matters more than the number.

   Test each sampled item against its criterion and record the identifier, the date, the evidence source, the result and any limitation (for example, a record that could not be located). Minimise personal data in the working papers: a ticket number and a date are enough.

5. Evaluate and grade the findings

   Time half a day to one dayInputs test results, interview notes, the criteriaOutput findings written as criterion, evidence, condition and conclusion

   A finding is only a finding when it is tied to a criterion and supported by evidence. Separate a missing record from a control that did not operate: an unlocated access review may mean the review was not done, or that it was done and not filed, and the two have different causes and different gradings. Put every potential nonconformity back to the control owner before you grade it, and record the response. Findings that are withdrawn on evidence are reported as such, not dropped.

   Grade consistently. A major nonconformity is a requirement not met in a way that undermines the ISMS or a control’s ability to achieve its intended outcome, or a pattern of minors. A minor nonconformity is a single lapse against a requirement. An opportunity for improvement is a requirement that is met but could be met better. An observation is a matter to watch. The sample finding below shows the same evidence written at three gradings.

6. Write and present the report

   Time one dayInputs findings, plan, working-paper indexOutput the audit report, presented at a closing meeting

   Write for two readers: management, who will act on it at management review, and the certification auditor, who will read it as evidence under Clause 9.2. State the objectives, scope and criteria; the methods used and the sample sizes; each finding with its grading; the limitations of the audit; and a conclusion on conformity and effectiveness for the scope audited. Keep the working papers indexed so any conclusion can be traced back to the evidence.

   Hold a closing meeting. Walk through every finding, confirm the facts are accepted, and agree who owns each action. The report template in the download section follows this structure section by section.

7. Follow up corrective action

   Time spread across the following weeksInputs the action record, closure evidence from control ownersOutput verified closures, inputs to management review and to the next audit programme

   Management owns correction and corrective action under Clause 10.2: fix the immediate issue, find the cause, act on the cause, and check that the action worked. The auditor’s role is to verify closure on evidence, not to accept a ticket marked done. Agree in advance who verifies and when, feed the status into management review under Clause 9.3, and let the results shape the frequency and coverage of the next cycle in the programme, which is what Clause 9.2.2 asks for.

A sample audit plan

This is the plan for a fictional UK software company, forty staff, one office, production hosted in a public cloud, certified to ISO/IEC 27001:2022 and nine weeks from its first surveillance audit. It fits on one page, which is the right length.

One piece of evidence, written three ways

Grading is where internal audits most often go wrong, in both directions: lapses written up as majors because the auditor wants to be taken seriously, and genuine nonconformities softened into observations because the control owner is a colleague. The same evidence, graded against the same criterion, should read differently only because the condition differs. Here is one leaver-handling test written at three gradings.

Observation

All eight sampled leavers had access removed within the required time. In two cases the removal was completed by the IT lead from a personal reminder rather than from a ticket, so the control depends on one person’s diligence rather than on the process. No requirement is breached. Recommend that HR’s leaver notification create the IT ticket automatically.

Minor nonconformity

Seven of eight sampled leavers had access removed within the required time. One contractor’s account (ticket 4821) remained enabled for six working days after the last working day recorded by HR; the console log shows no sign-in during that period. Requirement P07 section 4.2 was not met for this item. Cause reported by the IT lead: the contractor was not on the HR leaver list because contractors are managed by the engineering lead. Corrective action required on the population, not only the account.

Major nonconformity

Four of eight sampled leavers retained access beyond the required time, by between three and forty-one working days, and one account (ticket 4790) was used to sign in nine days after the leaver’s last day. The contractor population is not covered by the leaver process at all, and no access review in the period detected the retained accounts (Annex A 5.18). Requirement P07 section 4.2 is not met as a process, and the control is not achieving its intended outcome. Immediate correction of the open accounts, investigation of the post-leaving sign-in under the incident procedure, and corrective action on the process and the access review are required before the surveillance audit.

Notice what changes: the condition observed, the proportion of the sample affected, whether the cause is an individual lapse or a process gap, and whether a related control that should have caught it also failed. Notice what does not change: the criterion is quoted, the sample is stated, each item is identified by a reference rather than a name, and the conclusion stays within what the evidence supports.

What the audit report contains, section by section

The report is the deliverable the certification body reads and the document management acts on. The structure below is the one used in the downloadable template.

Six mistakes that turn an internal audit into a certification finding

• Auditing the documents and calling it an audit of the ISMS. Clause 9.2.1 asks whether the system is effectively implemented and maintained. That needs operating records and people, not policies alone.
• Sampling without a population. Picking the five best-documented changes tells you nothing. Get the full list first, then sample from it with a stated rationale.
• Letting the ISMS owner audit their own work. It fails the objectivity requirement in 9.2.2 and it is the first thing a certification auditor checks.
• Writing “compliant” with no evidence reference. A conclusion with no trail to a sample is an opinion. Index the working papers.
• Grading every lapse the same. A missing record, a single lapse and a failed process are three different findings with three different corrective actions.
• Finishing the audit after the certification body arrives. The report has to be tabled at management review and available as evidence before the external audit, or it has done half its job.

Downloads

Templates are starting points. The agreed scope, criteria and sample decide the content of a real audit.

Choose the next step.