ISO 27001 internal audit

Internal audits are an essential part of checking how your organisation is complying with the ISO 27001 standard. Businesses that have already achieved ISO 27001 are required to conduct internal audits at regular intervals to stay compliant and continue to improve business security. Our internal audits will help you meet the requirements of clause 9.2 and will facilitate and complete this process with a team of lead auditors who can help with scheduling, planning, conducting the audit, reporting, and following up on improvements.

Our ISO 27001 audit report covers:

• The scope and type of audit
• Management system aspects/documentation
• Annex A controls
• Details of non-conformities
• Opportunities for improvement
• Audit notes and findings

This will depend on several factors including:

1. The scope of your ISMS
2. The size of your organisation
3. The physical locations of your offices/warehouses etc
4. The audit schedule – some companies audit all the clauses and Annex A controls in one audit, while others choose to split it up and do parts over the course of the audit cycle.

If you are interested in conducting your internal audits with us, we will discuss your requirements in detail to understand your environment so that we can provide you with an accurate, fixed price quote.

Once the scope of work is defined and agreed upon, we deliver regardless of the time needed to complete the audit.

Annex A is a set of security controls which your business can use to address identified information security risks. These might sound familiar if you are ISO 27001 certified, as Annex A forms the basis of your information security framework. The internal audit will identify the applicable Annex A controls and ensure these have been implemented effectively.

Your certification body conducts audits for you to achieve ISO 27001 certification and then once every 3 years to renew the standard. These are external audits delivered by the external certification body. It is also a requirement for your business to conduct internal audits at least once every 12 months to maintain the requirements of ISO 27001.

Companies often outsource their internal audits due to lack of in-house resources, and to avoid conflicts of interest if a company is auditing itself. Both internal and external audits are conducted in a similar fashion and are looking to evidence compliance to the clauses and applicable Annex A controls.

Anyone who works in your organisation could potentially be asked to participate in the audit. For instance, if the auditor wants to establish the awareness level of the ISMS amongst the employees, they may randomly select to speak to an employee to find out what they know.

Key people needed for audits will be IT, HR, senior management, the Information Security Manager (if there is one) and risk owners. There may be others, but the auditor will discuss this with you during the initial audit meetings and advise on who they need to speak with.