How to Conduct an ISO 27001 Internal Audit: Audit Plan, Nonconformity Management and Certification Readiness

What Is an ISO 27001 Internal Audit?

An ISO/IEC 27001 internal audit is an independent and impartial audit activity in which an organisation systematically evaluates whether its ISMS (Information Security Management System) conforms to the defined requirements, is implemented effectively and can be sustained.

Clause 9.2 of ISO/IEC 27001:2022 requires organisations to conduct internal audits at planned intervals.

An internal audit is not merely a check on whether policies and procedures exist.

Its real purpose is to evaluate how the defined information security processes are applied in actual operations and whether the management system is producing the expected results.

For example, an organisation may have an access control policy.

However, if the accounts of departing employees are not closed on time, there is a significant gap between the policy and its implementation.

An internal audit makes it possible to identify discrepancies of this kind.

Short answer: An ISO 27001 internal audit is the evidence-based evaluation of the policies, processes, risk management, security controls and operational practices within the ISMS scope against the defined audit criteria.

1. Why Is an ISO 27001 Internal Audit Important?

Information security management systems cannot be sustained through documentation alone.

An organisation's security policies, risk assessments and technical controls can change over time.

New systems may be put into service.

Employees may change roles.

Cloud services may start to be used.

New threats may emerge.

These changes can affect the effectiveness of existing security controls.

An internal audit helps assess whether the management system remains suitable for current conditions.

Core objectives of an internal audit

• Evaluating the ISMS's conformity with the requirements of ISO/IEC 27001.
• Verifying compliance with the organisation's own information security rules.
• Examining how security controls are implemented.
• Evaluating the effectiveness of risk management processes.
• Identifying gaps and nonconformities.
• Initiating corrective actions.
• Presenting reliable evaluation results to top management.
• Supporting continual improvement.

An internal audit should not be seen as a final check carried out just before the certification audit.

It should be a regular part of corporate security governance.

2. Is an ISO 27001 Internal Audit Mandatory?

Yes.

Under ISO/IEC 27001:2022, conducting an internal audit is a management system requirement.

However, the standard does not require every organisation to audit only once a year.

The organisation must conduct internal audits at planned intervals.

When the audit programme is drawn up, the importance of the processes, the changes affecting the organisation and the results of previous audits must be taken into account.

Example

An organisation that manages critical payment systems may choose to audit certain high-risk processes more frequently.

Different audit intervals can be set for lower-risk and stable processes.

An important distinction

An annual internal audit is a practice used by many organisations.

However, ISO/IEC 27001 does not prescribe a single annual audit calendar for all organisations.

The audit frequency must be justified and planned.

3. The Difference Between an Internal Audit and a Certification Audit

Internal audits and certification audits are carried out for different purposes.

Criterion	Internal audit	Certification audit
Purpose	Evaluating the conformity and effectiveness of the management system	Evaluating conformity with the certification requirements
Auditor	A competent and impartial auditor from within the organisation or from outside	An auditor of the certification body
Planning	According to the organisation's audit programme	According to the certification process
Outcome	An internal audit report and improvement actions	Audit results feeding the certification decision
Scope	The areas defined in the audit programme	The certification scope and the related requirements
Follow-up	Managed by the organisation	Subject to the certification body's processes

It is possible for an external consultant to carry out the internal audit.

However, auditor impartiality and conflicts of interest must be managed.

4. ISO/IEC 27001:2022 Internal Audit Requirements

Clause 9.2 of ISO/IEC 27001:2022 addresses the internal audit requirements.

The internal audit process must evaluate the ISMS's conformity with the organisation's own requirements and with the requirements of the standard.

It must also examine whether the management system is effectively implemented and maintained.

Core requirements

Planning the audit programme.

Determining the audit frequency.

Defining the audit methods.

Assigning responsibilities.

Establishing the audit criteria.

Defining the audit scope.

Ensuring impartiality.

Reporting the audit results to the relevant management.

Retaining documented information on the audit programme and the results.

Audit programme versus audit plan

The audit programme describes the overall arrangement of the audits to be carried out over a given period.

The audit plan, on the other hand, sets out the scope, dates, methods and activities of a specific audit.

These two documents complement each other.

5. How Is ISO 19011 Used in Internal Audits?

ISO 19011 provides guidance on auditing management systems.

It is a useful reference when planning and conducting ISO/IEC 27001 internal audit processes.

Areas supported by ISO 19011

Auditing principles.

Managing an audit programme.

Planning the audit.

Conducting audit activities.

Evaluating evidence.

Auditor competence.

Reporting the audit results.

Core auditing principles

Integrity.

Fair presentation.

Due professional care.

Confidentiality.

Independence.

Evidence-based approach.

Risk-based approach.

An important point

ISO 19011 is an auditing guideline.

It does not mean that a separate ISO 19011 certificate is required for ISO/IEC 27001 certification.

6. How Is an ISO 27001 Internal Audit Programme Prepared?

The audit programme must be prepared in line with the organisation's ISMS scope and risks.

Information an audit programme may contain

The audit period.

The audit objectives.

The processes to be audited.

The audit criteria.

The audit frequency.

The audit methods.

Auditor responsibilities.

Resource requirements.

Previous audit findings.

Reporting of the audit results.

Sample annual programme

Period	Audit area	Sample focus
Q1	ISMS governance	Policy, scope, objectives
Q2	Risk management	Risk assessment, SoA
Q3	Technical security	Access, logging, vulnerabilities
Q4	Operations and improvement	Incident management, corrective action

This table is a sample programme.

The programme as a whole must appropriately cover the applicable ISO/IEC 27001 requirements and the relevant processes within the ISMS scope.

7. What Is Risk-Based Audit Planning?

Risk-based audit planning directs audit resources towards the more significant risk areas.

Not every process poses the same level of risk.

Prioritisation criteria

The criticality of the business process.

The types of data processed.

Past security incidents.

Previous audit findings.

System changes.

Supplier dependencies.

Legal obligations.

The state of technical vulnerabilities.

Example

Access control of an internet-facing customer application may be a critical audit area.

A low-risk internal process that has undergone no changes may be audited at a different frequency.

However, a risk-based approach does not justify systematically disregarding the relevant requirements of the standard.

8. How Is the Internal Audit Scope Determined?

The audit scope defines which organisational units, processes, systems and locations will be evaluated.

Sample scope

Information security management.

Risk management.

Human resources security.

Asset management.

Identity and access management.

Network security.

Application security.

Cloud services.

Incident management.

Business continuity.

Supplier management.

A scoping error

If a critical cloud service that falls within the organisation's ISMS scope is never evaluated in the audit plan, this can constitute a significant gap.

For this reason, the audit scope must be linked to the ISMS scope and to risks.

9. Who Can Be an Internal Auditor?

An internal auditor must have the knowledge and skills to evaluate the area being audited.

Required areas of competence

Knowledge of ISO/IEC 27001.

Audit methods.

Evidence evaluation.

Risk management.

Information security processes.

Reporting.

Impartiality.

Must the internal auditor be a company employee?

No.

The internal audit can also be carried out by competent external auditors whom the organisation considers suitable.

Can an internal auditor audit their own work?

It is not appropriate for an auditor to evaluate their own activities in a way that undermines audit impartiality.

In small organisations in particular, it should be planned how auditor independence will be ensured.

10. Which Documents Are Reviewed Before an Internal Audit?

It is useful to review the relevant documents before the audit begins.

Sample document list

The ISMS scope.

The information security policy.

The risk assessment methodology.

The risk register.

The risk treatment plan.

The SoA.

The information security objectives.

The asset inventory.

The access control procedure.

The incident response procedure.

The backup policy.

Supplier security records.

Previous internal audit reports.

Corrective action records.

Management review records.

An important point

Document review is only one stage of the audit.

It must be supported by operational records, interviews and appropriate technical verification.

11. Sample ISO 27001 Internal Audit Plan

The following sample shows a two-day audit plan for a medium-sized organisation.

Day	Time	Audit area
1	09:00–09:30	Opening meeting
1	09:30–10:30	ISMS scope and governance
1	10:30–12:00	Risk management and SoA
1	13:00–14:30	Asset and access management
1	14:30–16:00	Human resources and supplier security
1	16:00–17:00	Review of the day's findings
2	09:00–10:30	Technical security controls
2	10:30–12:00	Incident management and monitoring
2	13:00–14:00	Backup and business continuity
2	14:00–15:00	Performance evaluation and improvement
2	15:00–16:00	Verification of findings
2	16:00–17:00	Closing meeting

These durations are examples.

The actual duration of an audit depends on the organisation's size, scope and complexity, and on the audit objectives.

12. How Is an ISO 27001 Opening Meeting Held?

The opening meeting is the coordination activity held at the start of the audit.

Topics that may be discussed

The purpose of the audit.

The scope.

The criteria.

The audit method.

The audit schedule.

The personnel to be interviewed.

Access to evidence.

Confidentiality requirements.

The communication method.

Sample opening statement

“The purpose of this internal audit is to evaluate the conformity of the ISMS processes with the defined requirements and the effectiveness of their implementation. The evaluations will be carried out through documents, records, interviews and appropriate sampling.”

In the opening meeting, it can be explained that the audit is not intended to punish anyone, and that it aims at objective evaluation and improvement.

13. What Is Audit Evidence?

Audit evidence is verifiable information relevant to the audit criteria.

Evidence can be obtained from documents, records, observations, interviews or technical examinations.

Sample evidence

A policy document.

A system configuration.

An authorisation matrix.

Log records.

A backup report.

A security test result.

An incident response record.

A training attendance record.

Example

An organisation may state that MFA is enforced for all employees.

The auditor can verify this claim through appropriate user samples and MFA coverage reports.

A critical point

Verbal explanations can provide valuable information.

However, significant conformity decisions should, wherever possible, be supported by verifiable evidence.

14. How Is Sampling Carried Out in an Audit?

In an internal audit, it is not always possible to examine every transaction and record individually.

For this reason, appropriate sampling methods can be used.

Example

The organisation has 500 user accounts.

Instead of examining every account one by one, the auditor can apply risk-based sampling.

Sample groups

Administrator accounts.

Newly created accounts.

Departed personnel.

Employees who changed roles.

Supplier accounts.

Users of critical systems.

Points to watch

The sampling method must be justifiable.

When sample results are evaluated, the scope and limitations must be taken into account.

A single compliant record does not prove that the whole process works flawlessly.

15. ISO 27001 Clause 4 – How Is the Context of the Organisation Audited?

Clause 4 of ISO/IEC 27001 concerns the context of the organisation and the ISMS scope.

Audit questions

Have the organisation's internal and external issues been determined?

Have the interested parties been identified?

Have the requirements relevant to information security been evaluated?

Is the ISMS scope clear?

Have the scope boundaries been justified?

Have the ISMS processes been established?

Sample nonconformity

A critical outsourced service within the ISMS scope not being addressed in the interested party and dependency assessments.

Evidence

The context analysis.

The interested party analysis.

The ISMS scope document.

Process maps.

16. ISO 27001 Clause 5 – How Is Leadership Audited?

Top management's involvement in the information security management system is important.

Audit questions

Has the information security policy been approved?

Are the information security objectives supported?

Are the necessary resources being evaluated?

Have roles and responsibilities been defined?

Are information security requirements being integrated into business processes?

Example

The information security policy may have been prepared but not properly approved by top management.

This situation must be evaluated against the relevant requirements.

An important point

Top management's responsibility is not merely a matter of signing a document.

The decisions and activities that support the effectiveness of the management system must also be evaluated.

17. ISO 27001 Clause 6 – How Is Planning Audited?

Clause 6 relates to risks, opportunities, information security risk assessment, risk treatment and objectives.

Audit questions

Has the risk assessment methodology been defined?

Have the risk acceptance criteria been established?

Have the risk owners been identified?

Have risk assessments been carried out?

Has the risk treatment plan been prepared?

Has the SoA been created?

Have the information security objectives been defined in a measurable way?

Sample nonconformity

The absence of a treatment decision and a related plan for a risk rated as critical in the risk register.

Audit evidence

The risk methodology.

Risk records.

The risk treatment plan.

The SoA.

The information security objectives.

18. ISO 27001 Clause 7 – How Is Support Audited?

Clause 7 covers resources, competence, awareness, communication and documented information.

Audit questions

Have the necessary resources been provided?

Has the competence of personnel been evaluated?

Has information security awareness been established?

Have the communication processes been defined?

Are documents being controlled appropriately?

Sample nonconformity

The required competence criteria not being defined for personnel performing a critical security role, and their competence being impossible to verify.

Evidence

Job descriptions.

Competence records.

Training records.

Document control records.

Communication plans.

19. ISO 27001 Clause 8 – How Is Operation Audited?

Clause 8 relates to the operational implementation of the ISMS.

Audit questions

Are risk assessments performed at planned intervals?

Are risks reassessed when significant changes occur?

Are the risk treatment plans being implemented?

Are operational processes under control?

Example

The organisation may have put a new cloud service into use without assessing the impact of this change on information security risks.

Evidence

Current risk records.

Change records.

Risk treatment results.

Control implementation records.

20. ISO 27001 Clause 9 – How Is Performance Evaluation Audited?

Clause 9 covers the requirements for monitoring, measurement, analysis, evaluation, internal audit and management review.

Audit questions

Is information security performance being monitored?

Have measurement methods been defined?

Is the internal audit programme being implemented?

Are the audit results being reported?

Is the management review being carried out?

Example

The organisation may have set information security objectives but not evaluated the extent to which they have been achieved.

Evidence

KPI reports.

Internal audit reports.

Management review records.

Performance evaluation results.

21. ISO 27001 Clause 10 – How Is Improvement Audited?

Clause 10 covers continual improvement and the corrective action processes for nonconformities.

Audit questions

Are nonconformities being recorded?

Is action being taken in response to nonconformities?

Are the causes being evaluated?

Are corrective actions being implemented?

Is the effectiveness of the actions being reviewed?

Example

An access control nonconformity may have been closed.

However, if the same problem recurs in other systems, it may be concluded that the root cause was not adequately addressed.

22. How Are ISO 27001 Annex A Controls Audited?

The SoA is an important reference when evaluating Annex A controls.

Audit approach

The necessity of the control is evaluated.

The implementation status in the SoA is examined.

The relevant policies and procedures are reviewed.

Operational evidence is evaluated.

Technical verification is carried out where necessary.

Example

Control: A.8.13 – Information backup.

Audit question: Are backups of critical systems being taken?

Additional question: Is the restorability of the backups verified?

Evidence: Backup reports and restore tests.

A critical distinction

Auditing an Annex A control is not merely a matter of verifying that the relevant policy document exists.

The actual implementation status of the control must be evaluated.

23. Auditing Technical Security Controls

When technical controls are audited, system records and configurations can be evaluated.

Sample areas

Active Directory.

Firewall.

VPN.

Server security.

Cloud IAM.

Database security.

Endpoint security.

Logging.

Backup.

Application security.

Sample audit

Area: Active Directory.

Control objective: Restricting privileged accounts.

Evidence: The Domain Admins membership list.

Evaluation: The members' roles and the justifications for their privileges are examined.

An important point

An internal audit is not the automated equivalent of a comprehensive penetration test.

Where necessary, technical tests can support the audit evidence.

24. What Is an ISO 27001 Nonconformity?

A nonconformity is the non-fulfilment of a specified requirement.

The requirement may stem from the ISO/IEC 27001 standard, from the organisation's own policies or from other applicable criteria.

Example

Suppose the organisation's access control procedure specifies that the accounts of departing personnel must be closed within a set period.

Suppose the audit finds that several accounts remained active beyond that period.

This situation can be evaluated as a nonconformity against the relevant audit criteria.

Nonconformity record

The relevant criterion.

The observed situation.

Objective evidence.

The affected process.

A description of the nonconformity.

The classification of the nonconformity.

25. The Difference Between Major and Minor Nonconformities

Classifying nonconformities as major or minor is an approach used particularly in certification audits.

It can also be used in internal audits, according to the methodology the organisation has defined.

Major nonconformity

Situations that raise significant doubt about the management system's ability to achieve its intended results, or that show a significant requirement is systematically not being met, may be evaluated as major.

Minor nonconformity

Nonconformities of a more limited nature that do not significantly undermine the overall effectiveness of the management system may be evaluated as minor.

Sample comparison

Situation	Possible evaluation
The risk assessment process not being implemented at all	May be major
The internal audit requirement not being met across the ISMS	May be major
Limited documentation gap in a single record	May be minor
Systematic access control deficiency	May be major
Limited gap in one training record	May be minor

Important: These classifications are not automatic. The scope, impact and systematic nature of the findings, and the relevant audit rules, must be taken into account.

26. What Are an Observation and an Opportunity for Improvement?

Not every finding during an audit has to be a nonconformity.

Observation

It can refer to a situation that may create risk in the future or that requires attention.

Opportunity for improvement

It is a recommendation aimed at making existing processes more effective or more efficient.

Example

Access reviews at the organisation may be carried out properly.

However, because the process is run entirely manually, the likelihood of error is high.

The auditor may note the use of automation as an opportunity for improvement.

A critical point

A situation in which a requirement is not met should not be classified as an observation merely to avoid raising a nonconformity record.

27. How Is a Nonconformity Report Written?

Nonconformity reports must be clear, objective and verifiable.

Sample nonconformity record

Finding ID: NC-2026-001

Audit area: Identity and access management.

Criterion: The organisation's access termination procedure.

Finding: In three of the departure records examined, the relevant user accounts were not closed within the period specified in the procedure.

Evidence: Account status records and departure dates.

Risk: An increased likelihood of unauthorised access.

Classification: To be determined according to the organisation's nonconformity methodology.

Incorrect wording

“The IT team does not pay attention to access security.”

More appropriate wording

“In the sample examined, the account closure period defined in the procedure was found not to have been met.”

In an audit report, objective evidence should be used instead of personal comments.

28. How Is a Root Cause Analysis Performed?

Root cause analysis is the effort to understand why a nonconformity occurred.

Sample nonconformity

The accounts of departing employees are not being closed on time.

Superficial explanation

“The IT team forgot.”

This explanation may not be sufficient.

Root cause evaluation

There may be no automatic notification between human resources and IT.

Responsibilities may not have been clearly defined.

The account closure process may be run manually.

There may be no completion check for the task.

Methods that can be used

5 Whys Analysis.

Fishbone Diagram.

Process analysis.

Failure mode evaluation.

Purpose

The aim is not only to fix the error that was seen, but to address the conditions that cause the same error to recur.

29. The Difference Between Correction and Corrective Action

These two concepts must be kept apart.

Correction is the action taken to eliminate the current consequence of an identified nonconformity.

Corrective action aims to prevent recurrence by eliminating the cause of the nonconformity.

Example

Nonconformity: The account of a departed employee is still active.

Correction: Closing the account.

Corrective action: Establishing a controlled account closure workflow between human resources and identity management.

Verification

The new process is implemented.

After a certain period, sample accounts are examined.

It is verified that the accounts were closed on time.

This verification helps evaluate the effectiveness of the corrective action.

30. Sample Corrective Action Plan

Field	Example
Finding ID	NC-2026-001
Nonconformity	Accounts not being closed on time
Root cause	A gap in the manual notification process
Correction	Closing the open accounts
Corrective action	Automated offboarding workflow
Owner	IT and Human Resources
Target date	To be set by the organisation
Verification	Sample of newly departed personnel
Effectiveness criterion	Compliance with the defined closure period
Status	Open / Implemented / Verified

An important point

A corrective action should not be closed merely because the owner says “completed”.

The implementation and effectiveness of the action must be appropriately evaluated.

31. How Is the Effectiveness of Corrective Actions Verified?

Effectiveness verification evaluates whether the improvement made helps prevent the nonconformity from recurring.

Sample verification methods

Examining new records.

Technical control tests.

Process observations.

Access reviews.

Relevant performance indicators.

Re-audit.

Example

The organisation automated its access termination process.

The auditor then evaluates subsequent departure records.

Account closure times are examined.

Exceptions are investigated.

A critical point

Implementing a control and the control working effectively are different matters.

Both may need to be evaluated.

32. How Is an ISO 27001 Internal Audit Report Prepared?

The internal audit report must present the results of the audit that was carried out to the relevant management in an understandable way.

Recommended report structure

Audit title.

Audit date.

Audit objective.

Audit scope.

Audit criteria.

Audit team.

Processes audited.

Audit method.

A summary of the evidence examined.

Conformity assessment.

Nonconformities.

Observations.

Opportunities for improvement.

Overall conclusion.

Follow-up activities.

Sample executive summary

“The ISMS internal audit that was carried out examined the risk management, access control, incident management and performance evaluation processes. Owners have been assigned for the nonconformities identified, and the follow-up of corrective actions has been planned.”

Besides unnecessary technical detail, the report should also contain the information that enables decisions to be made.

33. How Is an Internal Audit Closing Meeting Held?

The closing meeting is held to share the audit results with the relevant parties.

Topics that may be discussed

The audit scope.

The audit methods.

Positive practices.

Nonconformities.

Observations.

Opportunities for improvement.

The reporting timetable.

The corrective action process.

An important approach

Audit findings should be explained through the relationship between process and requirement, not as criticism aimed at individuals.

The evidence on which the findings are based should be clear.

Disagreements can be appropriately recorded.

34. What Is Management Review?

Management review is the management activity in which top management evaluates the suitability, adequacy and effectiveness of the ISMS at planned intervals.

It is addressed under Clause 9.3 of ISO/IEC 27001:2022.

Topics that may be reviewed

Previous management decisions.

Changes in internal and external issues.

Interested party requirements.

Information security performance.

The status of objective achievement.

Risk assessment results.

The status of risk treatment.

Internal audit results.

Nonconformities.

Opportunities for improvement.

Outputs

Improvement decisions.

ISMS change needs.

Resource requirements.

An important point

Management review should not be carried out merely to produce meeting minutes.

The decisions taken and the follow-up activities should be clear.

35. How Does the ISO 27001 Certification Process Work?

The ISO/IEC 27001 certification process is carried out according to the relevant rules applied by the certification body.

A two-stage audit approach is generally used in the initial certification process.

Stage 1

It focuses on evaluating the readiness of the management system and the relevant documented information.

Stage 2

The implementation and effectiveness of the management system are evaluated in greater detail.

Certification decision

The decision is made taking into account the audit results, the status of nonconformities and the relevant certification rules.

Subsequent process

Surveillance audits.

Recertification.

An important distinction

The accreditation status of the certification body and the scope of the certificate must also be verified separately.

36. What Is Examined in a Stage 1 Audit?

Stage 1 helps evaluate the organisation's readiness for the Stage 2 audit.

Sample areas of evaluation

The ISMS scope.

The information security policy.

The risk assessment approach.

The risk treatment plan.

The SoA.

The information security objectives.

The internal audit and management review processes.

The organisation's activities and locations.

An important point

The purpose of Stage 1 is not merely to count whether documents exist.

The management system's readiness for the next audit stage is evaluated.

37. What Is Examined in a Stage 2 Audit?

Stage 2 focuses on the actual implementation status and effectiveness of the ISMS.

Sample areas

Risk management practices.

Access control.

Asset management.

Supplier security.

Security incident management.

Backup.

Human resources security.

Technical security controls.

Performance measurement.

Corrective actions.

Example

The organisation may have a vulnerability management procedure.

Within Stage 2, it may be examined whether this procedure is genuinely applied, how the vulnerabilities identified are evaluated and how improvements are followed up.

38. The Most Common Mistakes Before ISO 27001 Certification

1. An unclear ISMS scope

Scope boundaries and dependencies must be clearly defined.

2. An outdated risk analysis

Significant changes must be reflected in the risk assessment.

3. A mismatch between the SoA and actual practice

Control implementation statuses must reflect reality.

4. Performing the internal audit as a mere formality

The audit must be based on objective evidence.

5. An inadequate management review

The required inputs and outputs must be evaluated.

6. Corrective actions not being closed

The causes of nonconformities and effectiveness verification must be addressed.

7. Employees being unaware of the processes

Awareness and responsibilities must be clear.

8. Technical controls not being verified

Policies and system practices must be consistent.

9. Scattered audit evidence

Evidence must be managed in a controlled and accessible way.

10. Treating certification as the only goal

The sustainability of the ISMS and its risk-reduction effect must be the primary basis.

39. How Are Technical Tests Used in an ISO 27001 Internal Audit?

Technical tests can help verify the implementation of specific controls.

Sample tests

Firewall configuration review.

Active Directory security analysis.

Server security configuration check.

Cloud IAM assessment.

Vulnerability scanning.

Source code security analysis.

Backup restore test.

Logging check.

Example

The SoA states that the technical vulnerability management control is implemented.

The auditor examines the vulnerability scan results.

The auditor evaluates how critical findings are prioritised.

The auditor checks the verification records for the findings that were closed.

A critical point

Technical tests must be conducted with authorisation, under control and within an appropriate scope.

Activities that could cause disruption in the production environment must be planned separately.

40. How Are SOC and SIEM Evaluated in an Internal Audit?

SOC and SIEM practices can be important in evaluating security monitoring processes.

Audit areas

The coverage of log sources.

Critical incident scenarios.

Alert management.

Incident classification.

Response procedures.

Protection of records.

Escalation processes.

Example

Failed sign-in attempts on critical administrator accounts may be monitored through the SIEM.

The auditor can evaluate whether the relevant logs are actually being collected, whether the detection rules are appropriate and whether the alerting processes are functioning.

An important point

Having a SIEM product installed does not, on its own, mean effective security monitoring.

Log coverage, use cases and operational response processes are what matter.

41. How Are Internal Audit Findings Fed Into the Risk Register?

Audit findings can provide input to the risk assessment process.

Example

The audit identified a lack of MFA on critical systems.

Finding: Privileged accounts without MFA.

Risk scenario: Unauthorised administrator access.

Risk assessment: Performed according to current conditions.

Risk treatment: Enforcing MFA and restricting access.

Verification: The MFA coverage report and appropriate tests.

A critical distinction

Not every audit finding has to create a separate risk record automatically.

Existing risk records can be updated, or new risk scenarios can be defined.

42. How Is Internal Audit Performance Measured?

The effectiveness of the internal audit process can be tracked with measurable indicators.

Sample KPIs

The completion rate of planned audits.

The time taken to issue the audit report.

The number of open nonconformities.

Corrective actions that have passed their target date.

The recurring nonconformity rate.

The corrective action effectiveness verification rate.

Audit coverage of critical processes.

An important point

A low number of nonconformities does not, on its own, indicate high audit quality.

The audit scope and the adequacy of the evidence must also be evaluated.

43. A 30-Day Preparation Plan for an ISO 27001 Internal Audit

Days 1–5: Audit Preparation

Reviewing the ISMS scope.

Evaluating the audit programme.

Determining the audit team.

Defining the audit criteria.

Days 6–10: Document Review

Policies.

Risk assessments.

The SoA.

Control records.

Previous audit results.

Days 11–20: Audit Activities

Interviews.

Evidence reviews.

Technical verification.

Recording the findings.

Days 21–25: Reporting

Evaluating the nonconformities.

Preparing the audit report.

The closing meeting.

Days 26–30: Improvement Planning

Root cause analyses.

Corrective action plans.

Assigning responsibilities.

Establishing the follow-up timetable.

This plan is an example.

It does not mean that all corrective actions will be completed within 30 days.

44. ISO 27001 Internal Audit Checklist

Management system

• Is the ISMS scope up to date?
• Have the interested party requirements been evaluated?
• Is the information security policy approved?
• Have roles and responsibilities been defined?
• Have the information security objectives been set?

Risk management

• Is there a risk assessment methodology?
• Have the risk acceptance criteria been defined?
• Are the risk assessments up to date?
• Have the risk owners been identified?
• Is there a risk treatment plan?
• Is the SoA up to date?

Technical security

• Is the critical asset inventory up to date?
• Are privileged accesses being reviewed?
• Is MFA coverage being verified?
• Is vulnerability management being implemented?
• Are security logs being evaluated?
• Are backup restore tests being performed?

People and process

• Is employee awareness being ensured?
• Is access being terminated when people leave?
• Are supplier risks being evaluated?
• Are security incidents being recorded?

Improvement

• Have the internal audit results been reported?
• Are nonconformities being tracked?
• Are root cause analyses being performed?
• Is the effectiveness of corrective actions being verified?
• Has the management review been carried out?

This list is a sample aid for audit preparation; it does not replace all the requirements of the standard.

45. SECURESYS ISO 27001 Internal Audit and Certification Readiness Consulting

SECURESYS offers an approach to evaluating information security management systems that addresses technical security controls and management system requirements together.

ISMS current-state analysis

Existing processes and documents are evaluated against the requirements of ISO/IEC 27001:2022.

Internal audit planning

We support determining the audit scope, criteria, methods and evidence needs.

Risk management assessment

The consistency between the risk assessment methodology, the risk register, the risk treatment plan and the SoA is examined.

Technical control verification

Appropriate technical assessments can be carried out across network, system, application, cloud and access security.

Nonconformity management

We support recording the gaps identified, root cause analysis and corrective action planning.

Certification readiness

Readiness and gap assessments can be carried out before the Stage 1 and Stage 2 audits.

Continual improvement

We support linking the audit results to security objectives and enterprise risk management.

In the SECURESYS approach, an internal audit is not merely an activity to prepare for an ISO/IEC 27001 certificate; it is an evaluation process that measures the effectiveness of security controls and strengthens organisational resilience.

Frequently Asked Questions (FAQ)

1. What is an ISO 27001 internal audit?

It is a systematic and impartial audit activity carried out to evaluate the ISMS's conformity with the defined requirements and its effectiveness.

2. Is an ISO 27001 internal audit mandatory?

Yes. An internal audit must be conducted under Clause 9.2 of ISO/IEC 27001:2022.

3. Must an ISO 27001 internal audit be carried out once a year?

The standard does not require the same annual frequency for all organisations. Audits must be carried out at planned intervals.

4. Who can conduct an ISO 27001 internal audit?

It can be carried out by auditors, internal or external, who have the necessary competence and ensure audit impartiality.

5. Is an internal auditor certificate mandatory?

The standard does not make a particular commercial training course or certificate mandatory for all internal auditors. Competence and impartiality are required.

6. What is the difference between an internal audit and an external audit?

An internal audit is the organisation's own evaluation of its management system. A certification audit is conducted by an independent certification body.

7. What should an ISO 27001 internal audit report contain?

It may contain information such as the purpose, scope, criteria, method, evidence, findings, conclusions and follow-up activities.

8. What is a major nonconformity?

It can refer to significant deficiencies in the management system's ability to meet requirements or produce its intended results.

9. What is a minor nonconformity?

It can refer to nonconformities of a more limited nature that do not significantly undermine the overall effectiveness of the management system.

10. How is an ISO 27001 nonconformity closed?

Action is taken on the nonconformity, the causes are evaluated, the necessary corrective actions are implemented and their effectiveness is verified.

11. What is root cause analysis?

It is an evaluation aimed at identifying the underlying conditions that caused the nonconformity to occur.

12. What is the difference between correction and corrective action?

Correction eliminates the existing nonconformity. Corrective action addresses the cause of the nonconformity and aims to prevent its recurrence.

13. What is a Stage 1 audit?

It is the first audit stage in the certification process, in which the readiness of the management system is evaluated.

14. What is a Stage 2 audit?

It is the certification audit stage in which the implementation and effectiveness of the management system are evaluated in detail.

15. Is a penetration test required in an ISO 27001 internal audit?

It is not mandatory to perform a penetration test in every internal audit. The need for technical testing is determined according to the audit objectives, the risks and the relevant requirements.

16. Can an ISO 27001 internal audit be conducted remotely?

Remote audit methods can be used under appropriate conditions. What matters is the adequacy of the evidence and the achievement of the audit objectives.

17. Should internal audit results be presented to management?

Yes. The audit results must be reported to the relevant management.

18. Is management review mandatory?

Yes. There are management review requirements under Clause 9.3 of ISO/IEC 27001:2022.

19. How many years is an ISO 27001 certificate valid for?

In accredited certification practice, the certification cycle is generally three years. Surveillance and recertification requirements are subject to the relevant rules.

20. What does ISO 27001 internal audit consulting provide?

It provides support for audit planning, control evaluation, evidence review, nonconformity management and certification readiness work.

Conclusion: How Does an ISO 27001 Internal Audit Increase Security Maturity?

An ISO/IEC 27001 internal audit is an important management mechanism that evaluates the actual implementation status of the information security management system.

For a successful internal audit, the scope and criteria must be clearly defined.

Auditors must be competent and impartial.

Evaluations must be based on objective evidence.

The relationship between risk management and the SoA must be examined.

Technical security controls must be verified using appropriate methods.

Nonconformities must be clearly recorded.

Root causes must be evaluated.

The effectiveness of corrective actions must be verified.

Audit results must provide input to top management decisions.

An effective ISO 27001 internal audit does not merely identify gaps; it helps the organisation make its security processes more measurable, sustainable and risk-focused.