Insights
How often should an ISO 27001 internal audit take place? For most organisations, the short answer is once a year. Whether that audit is worth anything depends on another question: when.
ISO 27001 does not prescribe a fixed frequency. It calls for internal audits at planned intervals, set out in an audit programme that takes into account the importance of the processes and the results of previous audits. In practice, most organisations settle on once a year.
For a smaller organisation, I would leave it at that: one internal audit a year, around six weeks before the certification audit. That takes a week at most, so the effort stays manageable.
For larger organisations, I would recommend spreading the internal audit across the year, with the same auditor covering the whole management system. That way, one person can still deliver a report with a complete overview.
Frequency is rarely the problem. Timing is.
I saw this at a smaller technology organisation working towards its first certificate. A first certification usually involves a lot of work to bring everything up to standard: controls still need to be worked out, and the evidence has to be in place too.
The internal audit was held one week before the first stage of the certification audit.
The organisation judged the findings too substantial to resolve in time and postponed the certification audit. Otherwise, it would have tried to clear the bar with stopgaps.
Postponing was the right call, and the certification went well afterwards. Without the delay, the audit would most likely have ended with too many major nonconformities. That is a waste for an organisation that genuinely wants to earn its certificate properly.
Why is one week not enough? Because the certification audit goes beyond the documents.
The first stage looks mainly at the documentation and at whether the organisation is ready for the next step. The second stage checks whether the management system actually works as described. Everything in the documents then has to be proven in practice.
That proof comes from how the organisation operates. A process that has only just started has not run long enough to show that it works. And while everything is still in motion, changing or implementing anything between the two stages becomes a very tricky balancing act.
The internal audit and the management review are not optional either. The Statement of Applicability lets you choose which controls apply, but the requirements for the management system itself are not up for selection, and both of these are among them. At the first stage, certification bodies typically check whether both have been carried out, and if the organisation is not ready, the audit stops there. The management review also builds on the results of the internal audit, so it has to fit into the same weeks.
So the problem is not an internal audit before certification. That is where it belongs. The problem is holding it just before.
An audit held a few weeks earlier, with those weeks deliberately kept free to deal with its findings, serves a completely different purpose from an audit the week before. By then, that time is gone.
Six weeks gives you room to resolve findings properly. Sometimes there is time to spare. But when the audit uncovers a genuinely larger issue, it cannot be solved in less.
An internal audit squeezed in just before certification becomes a dress rehearsal. It tells you whether you are likely to pass, but it no longer helps you improve.
That throws away much of what an internal audit is for. A good internal audit takes a closer look at how things really happen, so the improvement cycle can actually turn at governance level too. Someone with a different perspective examines the way of working and points out opportunities for improvement.
Those suggestions are tailored as far as possible to the organisation being audited. Even so, it is always the organisation that judges whether a suggestion fits the way it works. Rejecting the internal auditor's opportunities for improvement is normal, as long as the rejection is well grounded in the way of working and the culture of the organisation, and well documented.
An audit in the week before certification leaves no time even to consider them. That opportunity should not go to waste.
If a certification audit is coming up, plan the internal audit in good time: preferably six weeks to two months before the first day of the certification audit. Then keep those weeks free to deal with its findings.
And share everything with your internal auditor. If they have enough experience and expertise, that can only help. From a different angle, they may spot the things that genuinely move your security forward.
The question of how often has a short answer. The question of when decides whether the internal audit improves anything or is only a rehearsal, and that is usually settled the moment someone puts the date in the calendar.