All services Every engagement has a fixed, published price. Book a strategy call
What happens in the room: the clauses and controls auditors check, the eight questions they ask, the seven findings that recur everywhere, and who is allowed to perform the audit.
Most guidance on the ISO 27001 internal audit describes paperwork: a plan, a report, a template to download. Very little of it tells you what an auditor does in the room, which is a shame, because knowing what gets checked is the difference between a rehearsal and an ambush. This guide sets out what auditors genuinely look at, the exact questions they ask, the findings that recur in almost every organisation, and the independence rule that decides who is allowed to do the auditing at all.
The short answer. The internal audit is required by clause 9.2 of ISO 27001, before certification and on a rhythm afterwards. Auditors check the management clauses 4 to 10 and a sample of Annex A controls, and the test throughout is the same: whether the records prove the system runs as described. The audit must be performed by someone objective and impartial, which rules out the people who built or run the ISMS. With Intelance an internal audit runs from £4,500 + VAT, performed by people who had no hand in the build.
The internal audit has one job: find the problems while they are still cheap and private. Every finding it raises is one the certification body cannot surprise you with, and every finding it misses becomes a public nonconformity a few weeks later. The standard requires it under clause 9.2, requires the results to feed the management review under clause 9.3, and certification bodies check both before Stage 2. Treating it as a rubber stamp converts inexpensive private findings into expensive public ones, which is the most avoidable mistake in the whole certification process.
| Area | What the auditor looks at | What passes |
|---|---|---|
| Scope and context (clause 4) | Whether the scope statement matches what the organisation does | A scope an employee would recognise as their own company |
| Leadership (clause 5) | Whether management demonstrably owns the ISMS | Signed policies, resourced roles, leadership visible in the records |
| Risk and the SoA (clause 6) | Whether the risk assessment is current and the Statement of Applicability matches reality | Risks reviewed recently, treatments implemented, exclusions justified |
| Competence and awareness (clause 7) | Training and awareness records for people in scope | Evidence people were trained, including recent joiners |
| Operation (clause 8) | Whether the controls run day to day | Operational records matching the documented processes |
| Performance and improvement (clauses 9 and 10) | Monitoring, past audits, management reviews and corrective actions | Reviews held, actions tracked to closure rather than to a spreadsheet grave |
| Annex A sample | A slice of controls tested in depth: access, incidents, suppliers, change, backups | Records that hold up when pulled at random |
The thread through all of it is the evidence test. Auditors read the policy for five minutes and the records for five hours, because the policy says what should happen and the records say what does.
Every question follows the same shape: a claim from your documentation, and a request for the record that proves it. Organisations that can answer these eight questions quickly pass internal audits and cruise Stage 2. Organisations that need a week to find the records have their answer already.
Seven findings appear in almost every first internal audit. A risk assessment last touched at the build and stale ever since. Access reviews scheduled quarterly and performed annually. Leavers with live accounts, found within minutes of asking. Backups taken religiously and never once restored. A Statement of Applicability describing controls that changed months ago. Training records covering everyone except the people who joined since launch. And a management review that either never happened or produced no record, which to an auditor is the same thing. None of these are exotic. All of them are visible to anyone who looks, which is the entire argument for looking first.
Clause 9.2 requires auditors to be objective and impartial, which in practice means nobody audits their own work. The person who built the ISMS, and the person who runs it, are both disqualified from auditing it. Larger organisations solve this with a trained internal auditor from another function. Smaller organisations buy it in, which also brings something an internal colleague cannot: an outsider’s eye that has seen how fifty other ISMSs fail. Our internal audit runs from £4,500 + VAT and is performed by people with no hand in the build, because an audit of your own homework convinces nobody, least of all the certification body.
Findings are graded, commonly as nonconformities, observations and opportunities for improvement. Each nonconformity gets a corrective action with an owner and a date, the results feed the clause 9.3 management review, and the closure evidence is exactly what the certification body wants to see at Stage 2: a system that finds its own problems and fixes them. That loop, running, is the single strongest signal an ISMS can send. Organisations that want the whole rhythm handled, audits, reviews and surveillance preparation, run it through a Managed ISMS from £2,500 + VAT per month.
Yes. Clause 9.2 requires internal audits at planned intervals, and certification bodies expect at least one full internal audit and a management review before the Stage 2 certification audit. Arriving without them is a nonconformity in itself.
Anyone competent and demonstrably independent of the ISMS being audited. The people who built or operate the system are disqualified from auditing it, which is why organisations use a trained auditor from another function or buy the audit in from £4,500 + VAT.
At planned intervals covering the whole ISMS across the certification cycle, and commonly annually as a minimum, timed so the results feed the management review and land before the certification body’s surveillance visit.
The internal audit is yours: private, required by clause 9.2, and designed to find problems first. The certification audit is performed by an independent accredited body and decides the certificate. A strong internal audit makes the certification audit an inspection rather than an ordeal.
With Intelance, from £4,500 + VAT, performed by auditors with no hand in building the system. The full pricing picture across the ISO 27001 journey is in our guide to what ISO 27001 costs in the UK.
That is the audit working. Findings become corrective actions with owners and dates, the results feed the management review, and the closure evidence strengthens the certification audit. The only bad internal audit is the one that finds nothing in a system that has never been audited before.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
