ISO 27001 internal audit

← Back to home

The audit that tells you the truth

The certification audit tells you whether you pass. The internal audit is the one that tells you where you actually stand. It is not optional either: ISO 27001 requires internal audits at planned intervals, and the results have to feed into your management review. No internal audit means no certification.

In practice, it is the requirement most often reduced to theatre. Someone audits work they did themselves, findings are worded so that nobody has to act on them, and the report lands a week before the certification body arrives.

An internal audit earns its cost when it finds what the external auditor would have found, early enough that fixing it is still cheap and unhurried.

How I run an audit

Four phases, agreed with you before anything starts. You know in advance what will be examined, how, and against which criteria.

1. Plan and criteria We agree the audit programme: which parts of the management system this cycle covers, the criteria I audit against, the sampling approach, and who I need to speak to. Surprises belong in the findings, not in the logistics.
2. The system as designed A review of the documented system: scope, risk assessment, Statement of Applicability, policies and procedures. This establishes what you have committed to, and that becomes the yardstick for everything that follows.
3. The system as operated Interviews and evidence sampling with the people who actually run the processes. This is where design and practice tend to part company, and where an audit either earns its keep or does not.
4. Report and results meeting A report you can hand to management and to your certification body. We then walk your team through the results in a meeting, so everyone understands the findings and knows what they can do with them.

What you get

• An audit plan agreed in advance, with scope, criteria and schedule.
• Nonconformities graded major or minor, each with the objective evidence behind it and the requirement it breaches.
• Observations and improvement opportunities kept separate from nonconformities, so your corrective action process does not silt up with nice-to-haves.
• A report written to be read by management, not only by auditors.
• The audit results packaged as input for your management review.
• A meeting with your team to go through the results.

Who this is for

Organisations with a management system in operation that need an independent internal audit: preparing for initial certification, heading into a surveillance or recertification audit, or simply due for the next cycle in their audit programme. It is also for organisations that have realised their internal audit is being done by the person who built the system.

Questions I am often asked