An ISO 27001 internal audit is a planned review of your Information Security Management System (ISMS) against the standard's Clause 9.2 requirement and your own Annex A controls, run at least once a year and covering every applicable control before your three-year certification cycle ends. The audit itself costs nothing beyond staff time if you run it yourself, but the hidden cost is the evidence-gathering: pulling logs, screenshots, and sign-offs from a dozen different tools eats most of the days people budget for it.
Why this matters
Clause 9.2 of ISO 27001 is not optional. Auditors from your certification body will ask for internal audit records at every surveillance visit, and a missing or thin audit trail is one of the fastest routes to a nonconformity.
Most founders treat the internal audit as a compliance chore to survive rather than a tool to catch gaps before an external auditor does. Run it properly in 2026 and it becomes the cheapest insurance you have against a failed certification audit.
How to run an ISO 27001 internal audit
The process is the same whether you're a five-person startup or a 200-person scale-up — only the volume of evidence changes.
- Confirm scope and criteria. Pull your current ISO 27001 Statement of Applicability — it tells you which of the 93 Annex A controls actually apply to your ISMS this cycle.
- Build the audit schedule. Map every applicable control area to a month across the year so nothing gets audited twice while others get skipped entirely.
- Assign an independent auditor. The person reviewing a control cannot be the person who owns it — internal, cross-department, or a contracted assessor all satisfy this.
- Collect evidence. Access logs, training completion records, incident tickets, vendor reviews — whatever the control requires as proof it's operating, not just documented.
- Run the review and record findings. Score each control as conforming, minor nonconformity, or major nonconformity, with the exact evidence referenced.
- Raise corrective actions. Every nonconformity gets an owner and a close-out date — auditors check these were actually closed, not just logged.
- Report to management review. Findings feed into your next management review meeting, which is itself an ISO 27001 requirement.
Start this process 4 to 8 weeks before your certification body's surveillance visit. That buffer gives you time to close corrective actions before an external auditor sees them open.
Internal audit vs external certification audit
Both check the same ISMS against the same clauses, but they serve different purposes and different audiences.
| Internal audit | External certification audit | |
|---|---|---|
| Who performs it | Independent internal staff or contracted assessor | Accredited certification body auditor |
| Frequency | At least annually (Clause 9.2) | Annually — surveillance, then recertification every 3 years |
| Purpose | Catch gaps before they're visible externally | Confirm certification or continued certification |
| Outcome | Corrective action plan | Certification, minor/major nonconformity, or failed audit |
| Best for | Ongoing ISMS health checks | Formal proof of compliance to customers and regulators |
Verdict: run the internal audit as a dress rehearsal — every finding it surfaces is one your certification body auditor never gets to raise.
Why internal audit findings vary
No two internal audits turn up the same number of gaps. A handful of factors drive most of the difference:
- Evidence scattered across tools — logs in one system, training records in another, nothing centralised
- Control owners who've changed roles since the last audit, with no handover of responsibility
- Annex A scope drift — new services or vendors added mid-year that were never mapped to a control
- Audit fatigue from teams juggling ISO 27001 alongside SOC 2, Cyber Essentials, or GDPR reviews on separate schedules
- Manual spreadsheet tracking that misses corrective action deadlines silently
- Inconsistent auditor training — a first-time internal auditor misses things an experienced one catches
If your team runs more than one framework, the fatigue point is worth fixing first — see how to reduce audit fatigue across multiple compliance frameworks for the mechanics of running overlapping audits without duplicating the same evidence request three times.
Manually chasing that evidence is where most internal audits actually die. OneClickComply's automated evidence collection pulls logs, records, and sign-offs from connected systems on a schedule, so the audit itself is a review of what's already gathered rather than a two-week hunt.
Run your next audit on autopilot
OneClickComply automates evidence collection for ISO 27001 internal audits.
How often do you need an ISO 27001 internal audit?
At least once a year is the Clause 9.2 requirement, but every applicable Annex A control needs to be audited at least once across your three-year certification cycle. Many teams split the full control set across quarterly mini-audits instead of one annual marathon — it spreads the evidence-gathering load and catches issues sooner.
What happens after the internal audit?
Findings and corrective actions feed straight into your management review, and open items need to be closed before your next external audit. If your certification date is close, the internal audit result is a strong predictor of how the ISO 27001 surveillance audit will go — a clean internal audit almost always means a clean surveillance visit.
Who can perform an ISO 27001 internal audit?
Anyone independent of the control being tested — an internal employee from another department, a shared internal audit function, or a contracted external assessor. The requirement is independence, not seniority or a specific certification.
Frequently asked questions
One last thing
The internal audits that go badly almost never fail because of a bad control — they fail because nobody could produce the evidence fast enough when asked. Fix the evidence pipeline before your next audit date and the review itself becomes the easy part.