Practical guide / United Kingdom
ISO 27001 Clause 9.2: internal audit requirements explained
Clause 9.2.1 and 9.2.2 explained in plain English for UK organisations: what the audit programme must contain, what planned intervals mean inside a UKAS-accredited certification cycle, how small teams meet the impartiality requirement, what changed from the 2013 edition, and how the clause relates to ISO 19011.
Written from the published text of ISO/IEC 27001:2022 and ISO 19011:2018. Quotations are paraphrased; buy the standards from BSI or ISO for the normative wording. Examples are general practice, not client results or legal advice.
What Clause 9.2 asks for, in one paragraph
Clause 9.2 of ISO/IEC 27001:2022 requires the organisation to conduct internal audits at planned intervals that provide information on whether the information security management system (ISMS) conforms to the organisation’s own requirements for it and to the requirements of the standard, and whether it is effectively implemented and maintained. The clause then sets out how that has to be done: through an audit programme, with defined criteria and scope for each audit, by auditors whose objectivity and impartiality are assured, with results reported to relevant management, and with documented information retained as evidence of the programme and the results.
Everything a UK certification body tests under this clause follows from those sentences. The rest of this guide walks through each requirement, what it looks like when it is met, and the gaps that most often appear as findings at a Stage 2 or surveillance audit.
Clause 9.2.1: the general requirement, line by line
The 2022 edition splits the clause in two. 9.2.1 states the purpose of internal audit and what it must establish; 9.2.2 covers the programme that delivers it. 9.2.1 has two tests, and an audit that answers only one of them does not meet the clause.
- Conformity to the organisation’s own requirements. Your ISMS defines its own rules: the policies you approved, the procedures you wrote, the risk-treatment decisions you recorded and the objectives you set under Clause 6.2. The audit has to check whether the organisation is doing what it said it would do. A control that operates differently from its procedure is a nonconformity against your own requirement even if the standard would accept either approach.
- Conformity to the requirements of ISO/IEC 27001. Clauses 4 to 10 are mandatory in full. Annex A controls apply where your Statement of Applicability says they do. The audit covers both, which is why a programme that samples only Annex A controls and never looks at context, leadership, planning, support, operation, performance evaluation and improvement falls short.
- Effectively implemented and maintained. This is the test most often skipped. Existence of a document is not effectiveness. The auditor has to look at whether the control produces the intended result, whether it has kept operating since the last audit, and whether changes to people, suppliers or systems have been absorbed. It is why evidence sampling, not document review alone, is the method the clause expects.
The word “information” in 9.2.1 matters. Internal audit exists to give management information it can act on under Clause 9.3 (management review) and Clause 10 (improvement). An audit report that lists documents seen and ends with “compliant” supplies no information. One that states what was sampled, what the sample showed and what remains uncertain does.
Clause 9.2.2: the internal audit programme
The 2022 edition requires the organisation to plan, establish, implement and maintain an audit programme, and lists what the programme has to contain. In practice this is a short document, often one page, that the certification body will ask to see before anything else under 9.2.
| Programme element | What satisfies it | What a certification auditor usually finds instead |
|---|---|---|
| Frequency | Planned intervals set per process or control area, with the reasoning recorded. | An unexplained “annual” entry with no link to risk or previous results. |
| Methods | Document review, interview, observation, sampling of records, technical inspection where relevant. | Methods left implicit, so remote-only review of policies passes for an audit of operation. |
| Responsibilities | Who owns the programme, who audits, who receives reports and who tracks actions. | The ISMS manager owns everything, including auditing their own work. |
| Planning requirements | How each audit is scoped, how criteria are chosen and how evidence access is arranged. | No defined plan per audit; the checklist stands in for one. |
| Reporting | Report format, distribution and the route into management review. | Reports filed in a shared drive and never tabled at management review. |
| Consideration of importance and previous results | Higher-risk processes audited more often; areas with earlier findings revisited sooner. | Every clause given equal weight regardless of risk or history. |
The clause also requires that each audit have defined criteria and scope. Criteria are what you audit against: the specific clauses, the applicable Annex A controls, your own policies and any contractual or legal commitments that are part of the ISMS. Scope is what you audit: the processes, sites, systems and period of records. A plan that lists “ISO 27001” as the criterion and “the ISMS” as the scope has defined neither.
What “planned intervals” means in a UK certification cycle
ISO 27001 does not set a frequency. It requires intervals that are planned and justified. In the United Kingdom, where certification bodies are accredited by UKAS against ISO/IEC 17021-1, the practical expectation is shaped by the three-year certification cycle: a Stage 1 and Stage 2 audit, surveillance audits in years one and two, and a recertification audit in year three.
Certification bodies commonly expect the internal audit programme to cover every clause and every applicable Annex A control across that three-year cycle, with the full management-system clauses revisited at least annually. The most common UK arrangement is therefore one full internal audit a year, scheduled to complete before the surveillance or recertification audit so the report can be tabled at management review and shown to the external auditor as current evidence.
Two triggers should pull an audit forward regardless of the calendar: a significant change to the ISMS (a new platform, a merger, a change of scope) and a serious incident. Both are things 9.2.2 asks you to consider when you plan, and both are things a certification auditor will ask about if your programme shows no movement after an obvious change.
Objectivity and impartiality: the small-team problem
Clause 9.2.2 requires the organisation to select auditors and conduct audits so that the objectivity and impartiality of the audit process are ensured. The standard does not say the auditor must be external, and it does not say they must be certified. It says they must not be auditing their own work, and that the organisation has to be able to show how it ensured that.
In a team of ten, this is the hardest requirement in the clause. The person who understands the ISMS best is almost always the person who built it, and the only other people available report to them or operate the controls in question. A compliance-automation platform does not resolve this: it can collect evidence and flag a misconfiguration, but an audit opinion, a justified sample and an impartiality assessment are things people do.
- Rotate within the organisation where there is genuine separation, for example an operations lead auditing the HR controls and an HR lead auditing the IT onboarding process, with competence evidenced for each.
- Use a peer organisation or group company with a reciprocal arrangement, documenting the competence and independence of the exchanged auditor.
- Outsource the internal audit under Clause 9.2 to an independent provider. This is the route most UK organisations under about fifty staff take, and it is the service described on Aegentra’s ISO 27001 internal audit service page. The impartiality assessment is still the organisation’s responsibility: record why the provider is independent of the ISMS and confirm that the auditor assigned did not design or operate any of it.
Whichever route you take, keep a competence record for the auditor. The certification body will want to see that the person who audited the ISMS understands both the standard and auditing method. Formal training such as a PECB ISO 27001 Lead Auditor course is one way to evidence that; documented experience is another. What does not work is an auditor whose only qualification is availability.
What the certification body checks under Clause 9.2
UKAS-accredited certification bodies test 9.2 the same way at every audit in the cycle. Prepare these four things and the clause rarely produces a finding.
| Evidence | What they look for | Typical finding when it is missing |
|---|---|---|
| The audit programme | Planned coverage of all clauses and applicable controls across the cycle; frequency tied to risk and previous results. | Minor nonconformity: programme does not demonstrate planned intervals or consideration of importance. |
| Audit plans | Per-audit criteria, scope, methods, auditor, dates and evidence access. | Observation or minor: criteria and scope not defined for individual audits. |
| Audit reports | Findings linked to a specific requirement and to the evidence sampled; limitations stated; conclusions on conformity and effectiveness. | Minor nonconformity: report does not provide information on effectiveness, only on document existence. |
| Competence and impartiality records | Who audited, their competence evidence, and why they were independent of the area audited. | Minor or major: ISMS manager audited their own work with no impartiality assessment. |
A fifth check sits outside the clause but depends on it: the certification auditor will trace your internal audit findings into Clause 10 corrective action and Clause 9.3 management review. An internal audit with findings that never became actions, or a report that was never tabled, turns a clean 9.2 into a finding under 9.3 or 10.
What changed between ISO/IEC 27001:2013 and 2022
The 2013 edition expressed internal audit as a single Clause 9.2 with requirements listed from a) to g). The 2022 edition restructured it into 9.2.1 General and 9.2.2 Internal audit programme without changing the substance: the audit programme, the defined criteria and scope, the objectivity requirement, reporting to management and retained documented information are all carried forward. The restructure aligned the clause with the harmonised structure used by other management-system standards, which makes integrated audits across ISO 27001, ISO 9001 and ISO 45001 easier to plan.
What did change for internal auditors is Annex A. The 2022 edition reorganised the controls from 114 across 14 domains into 93 across four themes: organisational, people, physical and technological. Eleven controls are new, including threat intelligence, cloud services security, ICT readiness for business continuity, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding. The transition deadline for certified organisations was 31 October 2025, so a UK internal audit conducted now must audit against the 2022 Statement of Applicability. A checklist still organised by the 2013 domains is a finding waiting to happen.
ISO 27001 Clause 9.2 and ISO 19011: requirement versus method
Clause 9.2 tells you what an internal audit has to achieve. ISO 19011:2018, Guidelines for auditing management systems, tells you how competent auditors go about it. ISO 19011 is guidance, not a requirement, but UK certification auditors are trained to it and they recognise its vocabulary when they read your audit reports.
| Topic | ISO/IEC 27001 Clause 9.2 (requirement) | ISO 19011:2018 (guidance) |
|---|---|---|
| Status | Mandatory for certification. | Advisory; adopted by choice. |
| Audit programme | Must exist and consider importance and previous results. | Clause 5 describes how to establish, implement, monitor and improve one. |
| Audit criteria and scope | Must be defined for each audit. | Clause 6.2 and 6.3 describe how to set objectives, scope and criteria and plan the audit. |
| Auditor independence | Objectivity and impartiality must be ensured. | Clause 4 principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach. |
| Evidence | Implied by “information on whether the ISMS is effectively implemented”. | Clause 6.4 describes collecting and verifying information and generating findings from evidence against criteria. |
| Competence | Implied by objectivity and by Clause 7.2 generally. | Clause 7 sets out knowledge, skills, behaviour and evaluation of auditors in detail. |
| Reporting | Results must be reported to relevant management. | Clause 6.5 describes preparing, distributing and completing the audit report. |
The practical use of ISO 19011 is to borrow its structure for your audit plan and report. A plan with objectives, scope, criteria, methods, resources and schedule, and a report with findings stated as criterion, evidence, condition and conclusion, will read as competent work to any certification auditor in the UK.
How this requirement is met in practice
Aegentra delivers Clause 9.2 audits for UK organisations as an outsourced internal audit: the programme coverage is agreed with you, each audit has a written plan with criteria and scope, fieldwork uses document review, interviews and a justified sample of operating records, findings are graded and tied to the clause or control they relate to, and the report is written for management review and for your certification body. The fee is fixed after scoping, from £1,500 + VAT. The ISO 27001 internal audit service page sets out the seven steps and what each produces; the how-to guide explains the same method for teams who want to run the audit themselves.
Questions readers ask.
Is an internal audit mandatory for ISO 27001 certification?
Yes. Clause 9.2 is a requirement of ISO/IEC 27001:2022, and a UK certification body will expect to see at least one completed internal audit, its programme and its report before the Stage 2 audit, then current internal audit evidence at every surveillance and recertification audit.
How often does ISO 27001 require an internal audit?
The standard requires planned intervals rather than a fixed frequency. Most UK organisations run a full internal audit annually, timed before the surveillance audit, and plan coverage of every clause and applicable Annex A control across the three-year certification cycle, with higher-risk areas or areas with previous findings audited more often.
Does the internal audit have to cover all 93 Annex A controls every year?
No. Clause 9.2.2 asks you to consider the importance of the processes and the results of previous audits when you set coverage. Many organisations audit all of Clauses 4 to 10 each year and sample Annex A controls on a risk basis so that every applicable control is covered within the certification cycle. The coverage decision must be written into the programme.
Can the person who implemented the ISMS also audit it?
Not without breaching the objectivity requirement. Clause 9.2.2 requires auditors who are objective and impartial with respect to what they audit, and auditing your own work fails that test. Small organisations resolve it by cross-auditing between functions with genuine separation, by using a peer organisation, or by outsourcing the internal audit to an independent provider under a documented impartiality assessment.
Does the internal auditor need to be certified?
ISO 27001 does not require a specific certificate. It requires that the audit be objective and impartial and, through Clause 7.2, that people doing ISMS work are competent. A recognised qualification such as a PECB ISO 27001 Lead Auditor certificate is a straightforward way to evidence competence; documented auditing experience and training records are an alternative the certification body will also accept.
What is the difference between an internal audit, a gap assessment and the certification audit?
A gap assessment is a planning exercise that finds what is missing before you build or change the ISMS; it is not required by the standard. An internal audit is the Clause 9.2 requirement: an evidence-based evaluation of whether the ISMS conforms and operates effectively. The certification audit is performed by an accredited certification body to decide whether to issue or continue a certificate. The three have different purposes, performers and outputs.
What has to be kept as documented information for Clause 9.2?
Evidence of the audit programme and of the audit results. In practice that means the programme itself, each audit plan, the audit report with its findings, the records of auditor competence and impartiality, and the trail from findings into corrective action and management review.
Can an ISO 27001 internal audit be done remotely in the UK?
Yes, where remote methods can produce sufficient appropriate evidence. Interviews, screen-shared walkthroughs and controlled evidence review cover most of a typical ISMS. Physical and environmental controls, and anything that depends on observing people at work, may need an on-site element. The decision and its reasoning belong in the audit plan, and remote delivery does not lower the audit criteria.