The ISO 27001 internal auditor: what the role is, what it requires, how it fits

What is an ISO 27001 internal auditor?

The internal auditor provides the organisation with evidence-based assurance about its ISMS. Under Clause 9.2, the audit checks whether the system conforms to the organisation's own requirements and to the applicable requirements of ISO/IEC 27001, and whether it is effectively implemented and maintained. The subject is the management system as it operates—not simply the existence of policies or a completed checklist.

An internal audit is commissioned and owned by the organisation. The auditor agrees the criteria and scope, gathers evidence, evaluates what that evidence shows and reports findings. The people who run the system remain responsible for their controls and decisions. The auditor should not write the corrective action, create missing evidence or approve their own recommendations as if they were management.

Internal auditor versus certification auditor

An internal audit is the organisation's own assurance activity. It can be performed by a competent employee outside the audited work or by an independent external auditor. A certification audit is a third-party assessment performed by a certification body. It determines whether the organisation meets the certification requirements within the audit scope. The certification body reviews the organisation's internal audit and management review as part of its evidence; it does not replace either one.

ISO/IEC 17021-1:2015 treats a certification body's internal audit work for its certified clients as a significant threat to impartiality and restricts that work. This restriction is specific to certification bodies and related entities. It does not mean a competent independent consultant cannot conduct an internal audit.

Clause 9.2 audit versus Annex A 5.35

These are related but distinct activities. Clause 9.2 concerns audits of the ISMS against defined criteria and scope. Annex A control 5.35 concerns independent review of the organisation's approach to information security. The control review may form part of an assurance plan, but it does not replace the planned, recorded ISMS audit programme required by Clause 9.2.

What ISO 27001 requires from the internal audit

Clause 9.2 sets requirements for the organisation's audit programme and for each audit. It does not prescribe a particular job title, a universal frequency or a named auditor qualification. The organisation must establish a process that can produce objective results and retain the documented information that demonstrates the programme and its outcomes.

Audit programme, criteria and scope

The organisation plans audits at intervals it determines. The programme takes account of the importance of the processes concerned and the results of previous audits. It defines how often audits occur, which methods are used, who is responsible, what planning is needed and how results are reported. The organisation defines criteria and scope for each audit so that people know what is being tested and against which requirements.

The programme should be practical enough to follow and broad enough to cover the ISMS over time. A risk-based cycle can give more attention to significant change, high-impact processes, previous nonconformities or controls whose operating evidence is uncertain. A large checklist completed once a year is not a substitute for a programme that responds to actual changes and results.

Objectivity, impartiality and competence

Auditors are selected and audits are conducted so that the process is objective and impartial. This is a requirement of Clause 9.2.2. Clause 7.2 also requires the organisation to determine the competence needed for people doing work under its control that affects information security performance, and to retain appropriate evidence of competence. In practice, an audit assignment needs a person who understands the audit method, the ISMS criteria and the technical or business processes in scope.

ISO 19011:2026 provides guidance on management-system auditing, including audit principles, programme management, audit conduct and auditor competence. It is guidance, not an additional ISO 27001 certification requirement. Training or a certificate can support an auditor's competence record, but ISO/IEC 27001 does not prescribe one specific internal-auditor certificate.

Reporting, records and action

Audit results are reported to relevant management. The organisation retains documented information as evidence that the audit programme was implemented and of the audit results. A useful report identifies the criteria, scope, evidence sampled, findings and any limitations. Findings should be traceable to evidence; they should not be negotiated into a preferred conclusion.

Management and process owners decide and implement corrective action under the organisation's nonconformity process. The auditor may explain the finding and verify subsequent evidence, but should not take ownership of the fix. Audit results also feed management oversight, including management review under Clause 9.3.

How to protect auditor objectivity and independence

ISO 27001 requires objective and impartial audits. Independence is therefore a practical safeguard: the auditor must be able to reach and report a conclusion without reviewing their own decisions or being pressured to change a finding. The standard focuses on the quality and impartiality of the audit process, not on a fixed organisational chart.

A useful working rule is: do not audit your own work or controls you designed or operate. If an advisor helped establish the ISMS, they should not audit that same preparation. If a control owner maintains evidence, they should not be the sole auditor of that control. Where prior involvement exists, record the boundary and use a different competent auditor for the affected scope.

Smaller organisations can still achieve impartiality. They can rotate auditors between teams, assign an internal auditor to an area outside their responsibilities, obtain a peer review, or bring in an external auditor. The audit programme should state how assignments are made and how conflicts are identified. If no reasonable separation is possible, narrow the auditor's scope or use another person rather than treating a self-review as independent.

Prior advisory involvement should be disclosed and managed, not hidden. The organisation remains responsible for deciding whether the proposed arrangement protects objectivity. The auditor should be able to refuse or reassign work where the conflict cannot be adequately controlled.

How the auditor, ISMS owners and management work together

The role model separates preparation, testing, decisions and independent certification. Evidence moves forward through the process, but responsibility stays with the role that owns the relevant work.

In sequence, control owners and the ISMS lead prepare operating evidence; the internal auditor tests it and reports; management decides and follows up; management review considers the results; and the certification body then conducts its independent audit. The organisation's audit programme and certification body's requirements determine the detailed timing.

What a sound internal audit looks like

A useful audit tests whether the ISMS works in practice, not only whether its documents exist. The audit plan should make the scope manageable, and the evidence should be sufficient to support each conclusion. Sampling is normal; the report should make the limits of a sample clear.

1. Set the programme. Define coverage, methods, responsibilities and timing using process importance, prior results and relevant changes.
2. Agree each audit. Set the objective, scope, criteria, people to meet, evidence sources and practical plan.
3. Test operating evidence. Interview process owners, inspect records and sample activity to see whether controls operate as described.
4. Evaluate against criteria. Separate facts from interpretation and connect each finding to evidence and a clear requirement.
5. Report to management. Present results, limitations, strengths and nonconformities without prescribing management's corrective-action decision.
6. Follow up and review. Owners address findings; the auditor verifies agreed evidence, and management review considers audit outcomes and needed decisions.

Examples of operating evidence include approved access changes, incident exercises, supplier reviews, risk-treatment decisions, backup restoration tests and records showing that assigned responsibilities are performed. The evidence depends on the agreed scope. A policy alone can show that a rule was documented; it cannot prove by itself that the rule is followed.

Common internal-audit mistakes

• Auditing your own work. The assignment creates a conflict and makes it harder to demonstrate impartiality.
• Reading only documents. A policy says what should happen; interviews and records show whether it happens.
• Using a checklist without criteria. Questions are useful only when they connect to the audit scope and requirements.
• Reporting conclusions without evidence. Findings should identify what was sampled and why it does or does not meet a criterion.
• Negotiating away uncomfortable results. Management may challenge facts, but findings should remain evidence-based.
• Skipping management follow-up. The audit is not complete as a management process if owners and leadership do not address results.

Framework-specific audit learning

The role boundaries remain useful across management systems, but the audit criteria and evidence change with the framework. These resources connect the role model to current ISO 27001 and ISO 42001 material without naming clients or certification bodies.

Related context: NIS2 implementation and the Cyber Resilience Act overview. These frameworks have their own legal and technical criteria; ISO 27001 audit findings do not automatically demonstrate compliance with them.

Standards referenced

This page paraphrases requirements and guidance; it does not reproduce standards text. Check the current publication and the organisation's certification scheme before applying a clause to a specific audit.

Questions about audit independence or readiness? Get in touch.