ISO 27001 Internal Audit: Checklist, Process and Report Template

Internal Audit Process

1. Define audit programme (scope, frequency, methods, competence).
2. Plan each audit (criteria, evidence sources, sample size).
3. Conduct fieldwork (interviews, records, technical sampling).
4. Report findings (conformities, nonconformities, opportunities).
5. Feed corrective action (Clause 10.2) and management review (9.3).

Programme Checklist

• Audit schedule covers ISMS clauses and prioritized SoA controls
• Auditors independent of the activities audited
• Prior nonconformities and major changes re-tested
• Results retained and presented in management review

Lightweight Report Outline

• Scope, criteria, dates, auditors
• Summary of conformity / effectiveness
• Nonconformities with evidence references
• Opportunities for improvement
• Follow-up owners and due dates

Frequently Asked Questions

Is internal audit the same as Stage 1?

No. Clause 9.2 internal audit is your organization's programme. Stage 1/Stage 2 are certification-body audits.

Must every Annex A control be audited every year?

Audit the ISMS at planned intervals for conformity and effectiveness. Depth and sampling follow your risk-based audit programme — not a blind 93-control annual sweep unless your programme requires it.

Who can perform the internal audit?

Auditors must be objective and impartial toward the work audited. Many SMEs use trained internal staff plus external support for independence on sensitive areas.

Related ISO 27001 Resources

Stage 1 vs Stage 2 · Compliance checklist · Mandatory documents