Glossary · ISO and management systems
The internal audit is where you find your own findings first.
A planned, independent check that an organization runs on its own management system to see whether it meets the standard and its own rules, and works in practice.
Back to the glossary01 · In plain words
In plain words
A planned, independent check that an organization runs on its own management system to see whether it meets the standard and its own rules, and works in practice.
Before an outside auditor looks at your ISO system, you are required to look at it yourself. An internal audit samples policies, records and controls, compares them with what the standard and your own documents promise, and reports what is missing. The person auditing must not be checking their own work.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
ISO/IEC 27001 makes the internal audit a requirement under Clause 9.2, and the same pattern appears in ISO/IEC 42001 and other management system standards. A certification body will ask to see the audit programme, the reports and what happened to each finding. A missing or token internal audit is itself a finding. Done properly, it is the cheapest way to discover a broken control, because you find it on your own schedule rather than during Stage 2.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- The audit programme
- A plan that sets which areas are audited, how often and by whom, weighted by risk and past results.
- Internal audit reports
- What was sampled, against which requirement, and the nonconformities and observations raised.
- The management review
- Internal audit results are one of the inputs top management must consider.
- Stage 1 and Stage 2 audits
- The certification body checks that at least one full internal audit has been completed and acted on.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a logistics firm's audit of its own change process
A Chennai logistics company assigns its finance controller, who has no role in IT, to audit the change management control. She picks ten production changes from the last quarter and asks for the approval record of each. Eight are complete. Two were pushed during a weekend outage with no record at all. She raises a nonconformity, the IT lead traces the cause to an emergency route nobody documented, and a short emergency change procedure is written. When the certification auditor later samples changes, the finding and its fix are already on file.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Certification audit
- Run by an external certification body that decides on the certificate. The internal audit is yours and decides nothing on its own.
- Management review
- Top management's periodic look at the whole system. It consumes the internal audit results rather than producing them.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Write an audit programme that covers every clause and the controls in scope over the cycle.
- Choose auditors who are competent and independent of the areas they check.
- Sample real records, not just policies, and note the requirement each finding relates to.
- Track every finding to a corrective action with an owner and a closing date.
- GuideThe ISO 27001 internal auditWho may audit, what to test, and how to report.
- GuideClause 9: performance evaluationMeasuring, auditing and reviewing the system.
- GuideNonconformity and corrective actionFrom a finding to a fix that holds, with root cause.
Sources: public ISO summaries of ISO/IEC 27001:2022 Clause 9.2, ISO/IEC 42001:2023 and ISO 19011 (guidelines for auditing management systems).
Questions about Internal audit
Can we outsource the internal audit?
Yes, if the auditor is competent and independent.
Many small companies use an outside auditor because they lack an independent person in house. The responsibility for the programme and for acting on findings stays with you. The firm that built your ISMS should not audit its own design.
Does one person have to audit everything in one go?
No.
The programme can spread audits across the year and across auditors. What matters is that the whole scope is covered over the planned cycle and that each audit has defined criteria and a report.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.