An internal audit is a rehearsal you can learn from.

The standard asks that auditors are chosen and audits are run so the process stays objective and impartial. It does not require an outside firm. A trained colleague from another team, an internal audit function, or an external consultant can all do it. ISO 19011, the general guidance on auditing management systems, treats independence and an evidence-based approach as core principles, which is a sensible frame for your own rules.

• No auditing your own work. The person who wrote the access procedure does not audit access control.
• No reporting line conflict. An auditor should not be judging the team that sets their pay or appraisal, where you can avoid it.
• Competence on record. Training in auditing and enough knowledge of security to understand what they see, kept as evidence under clause 7.2.
• Free to report. Findings go to management without being softened by the area audited.
• Outside help kept separate. A consultant who built your ISMS should not also be its only internal auditor for the same areas.

In a very small company total independence may be impossible. Split the audit so nobody covers their own area, and record how you handled it.

Criteria and scope

Criteria are what you audit against: the clauses of ISO 27001, your policies and procedures, and any contractual or legal requirements in scope. Scope is the slice of the ISMS this particular audit covers. Most organisations spread clauses 4 to 10 and the applicable controls across several audits in a year, rather than one large exercise.

• Ask for the complete list first: all leavers, all changes, all incidents in the period.
• Pick across the period, not only recent items, and include anything unusual you spot.
• Size the sample to the population and the risk; a handful is often enough for a small population.
• Record what you picked and why, so a later reader can repeat it.
• If a sample fails, look at a few more to judge whether it is a one-off or a pattern.

Nonconformity

A requirement, of the standard or of your own ISMS, is not met. It needs correction and corrective action.

Observation

Not a failure yet, but a weakness that could become one. Recorded and watched.

Opportunity for improvement

The requirement is met, and there is a better way. Management decides whether to act.

Write facts, not opinions. Leave out blame and adjectives. A good finding is one the auditee reads and agrees describes what happened.

1. Hold a short closing meeting with the auditee and agree the facts.
2. Send a report to the relevant management with scope, criteria, findings and a conclusion.
3. Log each nonconformity in the corrective action register under clause 10.2.
4. Check closure evidence when due, and test effectiveness at a later point.
5. Feed the overall results into the next management review.

• A checklist that just repeats the standard. Asking whether a policy exists, rather than testing whether it is followed.
• Auditing a week before Stage 2. Findings arrive with no time to close them, and become the certification body's findings.
• The auditee picks the samples. The good examples get shown and the evidence loses its value.
• Zero findings, every year. Either the ISMS is perfect or the audit was not looking.
• Findings without evidence. Vague statements cannot be fixed or verified.
• No link to clause 10. Findings sit in a report and never enter corrective action.

Sources: ISO/IEC 27001:2022, clause 9.2 (internal audit) and its sub-clause titles, clauses 7.2 and 10.2; ISO 19011:2018, Guidelines for auditing management systems, for general audit principles. All described in our own words.