How to Conduct an ISO 27001 Internal Audit Before Your Final Certification?
QUICK ANSWER
How do you conduct an ISO 27001 internal audit before certification?
Plan an audit programme, then have an objective auditor test the whole ISMS against the standard and your applicable Annex A controls, using real evidence. Record each finding against a clause or control, assign corrective actions and verify that they are closed. Finish the audit and fix the findings before the Stage 2 certification audit, because certification bodies expect to see the results.
Who audits
A competent person who does not audit their own work, from another team or an outside provider.
What to test
The ISMS clauses and the Annex A controls in your Statement of Applicability, with evidence that they operate.
When to finish
Before Stage 2, with time left to close findings and feed the management review.
An ISO 27001 internal audit is a required check and not a rehearsal you can skip. Clause 9.2 of ISO/IEC 27001:2022 requires organisations to audit the ISMS at planned intervals, and certification bodies review the audit programme and its results. An audit finished days before the certification visit leaves no time to fix what it finds.
This guide covers the clause 9.2 requirements, when to audit, how to prepare, eight steps to run the audit, the evidence auditors look for and who should carry it out. It is written for organisations preparing for first certification or recertification.
If you need support running the audit, see our ISO 27001:2022 certification and implementation services.
Last updated: October 2026
ISO 27001 Internal Audit Requirements
ISO 27001:2022 requires an internal audit programme that checks, at planned intervals, whether your ISMS meets the standard and your own requirements and is effectively implemented. The audit must be objective and impartial, and you must keep records of both the programme and the results. These records are among the first things a certification body asks to see.
What Clause 9.2 Requires
The audit (clause 9.2.1)
- Audits happen at planned intervals.
- They test whether the ISMS conforms to your own requirements and to ISO/IEC 27001.
- They test whether the ISMS is effectively implemented and maintained.
The audit programme (clause 9.2.2)
- Plan and maintain a programme that sets frequency, methods, responsibilities, planning needs and reporting.
- Define the criteria and scope for each audit.
- Select auditors and run audits so that objectivity and impartiality are protected.
- Report results to relevant management and keep documented evidence of the programme and the results.
How Often to Audit
The standard says planned intervals, and most organisations run at least one full audit cycle a year. Across the three-year certification cycle, the programme should cover every ISMS requirement and every applicable Annex A control, with higher-risk areas audited more often.
When to Conduct the ISO 27001 Internal Audit
Run the first full internal audit once your ISMS has operated long enough to produce real records, and finish it before the Stage 2 certification audit. Leave enough time afterwards to fix findings, verify the fixes and hold the management review. Certification bodies treat an audit squeezed in at the last minute as a warning sign.
Too Early, Too Late and the Right Time
Too early
Controls are not yet operating and there are few records, so findings are about missing evidence and not about whether controls work.
Too late
An audit finished days before the certification visit leaves no time to fix anything, and a broad audit that finds nothing looks hollow.
The right time
The ISMS is running with records, findings are closed and verified, and the management review has used the audit results.
A Practical Order of Events
- Implement the ISMS and let it run long enough to generate records such as access reviews, incident logs and training evidence.
- Approve the audit programme and the plan for the first audit.
- Carry out the internal audit across the ISMS scope.
- Raise corrective actions, fix the root causes and verify the fixes.
- Hold the management review using the audit results as an input.
- Go to the certification body for Stage 1, then Stage 2.
Practice differs between certification bodies. Some expect the first audit and management review to be complete by Stage 1, and many review the audit programme at that stage, so ask yours what it wants to see and when.
Audits After Certification
Certification does not end the requirement. Keep auditing on your programme schedule, at least once a year, and use the remaining areas of the ISMS to complete coverage before each surveillance audit and the recertification audit.
Preparing for an ISO 27001 Internal Audit
Preparation means fixing the scope and criteria, writing an audit plan and having your evidence and people ready before the first interview. Good preparation keeps the audit focused on whether controls work, not on last-minute paperwork. Write the plan before the audit starts, because an auditor who defines scope afterwards cannot show objectivity.
Define Scope and Criteria
Scope says what the audit covers and criteria say what you audit against. For each audit, name both in writing:
- Scope: the ISMS scope, locations, systems and the period of records you will examine.
- Standard: the ISO/IEC 27001:2022 clauses in scope.
- Controls: the Annex A controls marked applicable in your Statement of Applicability.
- Your own rules: your policies, procedures and any legal or contractual security requirements you have committed to.
What to Put in the Audit Plan
| Plan element |
What to record |
| Objectives |
What the audit must establish, such as conformity with the standard and effective operation of controls. |
| Scope and criteria |
The clauses, controls, locations, systems and period examined. |
| Auditor and independence |
Who audits, their competence, and confirmation that they do not audit their own work. |
| Schedule and people |
Dates, process owners and the interviews booked with each. |
| Methods |
Document review, interviews, evidence sampling and any technical testing. |
| Reporting |
How findings are classified, when the closing meeting happens and who receives the report. |
Preparation Checklist
Documents are ready
Policies, procedures, the risk assessment, the risk treatment plan and the Statement of Applicability are approved and current.
People are briefed
Process owners and system owners know the dates, what will be asked and which records they need to have to hand.
Evidence is gathered
Logs, access reviews, incident records, training records and change records are collected for the period under audit.
The checklist fits your risks
Build the checklist from the clauses and your applicable controls, and give more time to the areas where your risk assessment shows the most exposure.
How to Conduct an ISO 27001 Internal Audit: 8 Steps
A good internal audit is evidence based. The aim is not only to find gaps but to prove that the ISMS is implemented and working as intended. Each step below ends with a record you should keep, because certification auditors may ask to see them.
1
Initiate the Audit and Hold the Opening Meeting
Confirm the objectives, scope, criteria and schedule with management and process owners, and explain how the audit will run.
Keep: the approved audit plan and an attendance record.
2
Review the ISMS Documentation
Check that policies, procedures, the risk assessment, the risk treatment plan and the Statement of Applicability are approved, current and consistent with the scope.
Keep: documentation review notes.
3
Interview Process Owners and Key Staff
Ask the people who run each process and control how it works in practice, then compare their answers with the documents.
Keep: interview notes mapped to each clause or control.
4
Examine Records and Evidence
Sample records across the whole audit period, such as access reviews, logs, incident records, training attendance and change records. A single piece of evidence does not show that a control operates consistently.
Keep: a list of the evidence you sampled, with references.
5
Test Control Implementation and Effectiveness
Check that controls work in practice, for example monitoring, access restrictions, incident response and vulnerability management. Where risk is high, technical testing such as a vulnerability assessment and penetration test gives objective evidence.
Keep: test results for each control you tested.
6
Identify and Record Findings
Write each finding objectively, cite the clause or Annex A control it relates to, and classify it:
- Major nonconformity: a requirement is missing or a process has broken down.
- Minor nonconformity: an isolated lapse that does not undermine the system.
- Observation: not a breach, but an opportunity to improve.
Keep: a findings log with clause or control references and classifications.
7
Hold the Closing Meeting
Present the findings to management and process owners, and make sure they are understood and acknowledged.
Keep: the audit report and a record of management’s acknowledgement.
8
Follow Up on Corrective Actions
Give each finding an owner, find the root cause, set a deadline and verify that the fix works before the certification audit. Pass the results to the management review.
Keep: a corrective action plan with owners, dates and verified closure.
CyberSapiens supports internal audits as an outside provider. Independence comes first: where we have helped build your ISMS, the audit should be led by different people, and you should record how impartiality is managed.
Audit planning and scope
A plan built from your ISMS scope, the applicable clauses and your Annex A controls.
Checklists and evidence mapping
ISO 27001 aligned checklists, with logs, reviews, incident records and training data mapped to each criterion.
Control validation
Governance, operational and technical controls checked in practice, with technical testing where your risk calls for it.
Clear reporting
Findings classified as major, minor or observation, each with a root cause and a practical recommendation.
Corrective action support
Action plans with owners and dates, and follow-up to confirm that fixes are effective.
Management review and certification readiness
Audit results summarised as an input to the management review, ahead of Stage 1 and Stage 2.
