Updated: 7th October 2026
Reviewed by: David Small BSc (Hons), MSc, MTOPRA (Founder and CEO)
Understanding ISO 27001 Internal Audits
An ISO 27001 internal audit is a systematic and independent review of an organisation’s Information Security Management System (ISMS). It provides assurance that the ISMS is operating as intended, meets the organisation’s own information security requirements and conforms to the requirements of ISO/IEC 27001:2022.
Internal auditing is a mandatory part of ISO 27001. Clause 9.2 requires organisations to conduct internal audits at planned intervals to determine whether the ISMS conforms to both the organisation’s own requirements and those of the standard, and whether it is effectively implemented and maintained.
A well-planned internal audit should go beyond simply checking whether policies and procedures exist. Auditors should gather objective evidence to determine whether information security processes and controls are being implemented in practice, whether identified risks are being appropriately managed and whether the ISMS continues to support the organisation’s information security objectives.
Internal audits also provide an opportunity to identify weaknesses before they develop into more significant issues or are identified during an external certification or surveillance audit. Findings can therefore play an important role in corrective action, continual improvement and maintaining ISO 27001 certification.
For organisations implementing ISO 27001 for the first time, internal auditing is also an essential step in preparing the ISMS for certification.
Looking for a Complete Guide to ISO 27001?
This article explains the role of internal audits within an Information Security Management System (ISMS). If you're looking for a comprehensive guide covering ISO 27001 requirements, certification, Annex A controls, risk assessments, Statements of Applicability and ISMS implementation, read our Complete Guide to ISO 27001.
What Is an ISO 27001 Internal Audit?
An ISO 27001 internal audit is a structured assessment used to determine whether an organisation’s Information Security Management System (ISMS) conforms to its own requirements and the requirements of ISO/IEC 27001:2022.
Unlike a certification audit, an internal audit is conducted on behalf of the organisation itself. Its purpose is not to award certification, but to provide an objective assessment of how effectively the ISMS has been implemented and maintained.
During an internal audit, the auditor will typically review documented information, interview relevant personnel, examine records and sample evidence to determine whether established information security processes are actually being followed.
The audit may examine areas such as:
- ISMS policies and procedures
- Information security roles and responsibilities
- Information security risk assessments and risk treatment
- The Statement of Applicability (SoA)
- Applicable Annex A controls
- Information security objectives and performance monitoring
- Competence and awareness
- Incident management
- Supplier and third-party security
- Corrective actions and previous audit findings
- Management review and continual improvement
The scope of an individual audit does not necessarily need to cover the entire ISMS at once. Organisations can establish an internal audit programme that assesses different processes, locations or areas of the ISMS over a defined period, provided the programme meets the requirements of Clause 9.2 and provides appropriate coverage of the ISMS.
The findings from these audits provide management with evidence about the performance of the ISMS and help identify areas requiring correction, corrective action or improvement.
ISO 27001 Clause 9.2: What Does the Standard Require?
Clause 9.2 of ISO/IEC 27001:2022 establishes the requirements for an organisation’s internal audit programme. Internal audits must be conducted at planned intervals to provide information on whether the Information Security Management System (ISMS) is operating effectively and meeting the required criteria.
The internal audit must determine whether the ISMS:
- Conforms to the organisation’s own requirements for its Information Security Management System.
- Conforms to the requirements of ISO/IEC 27001:2022.
- Is effectively implemented and maintained.
However, Clause 9.2 requires more than simply carrying out an audit periodically. Organisations must establish, implement and maintain an internal audit programme that defines how audits will be planned and managed.
The audit programme should address:
- The frequency, methods, responsibilities and planning requirements for internal audits.
- How audit results will be reported.
- The importance of the processes being audited.
- Changes that could affect the organisation or its ISMS.
- The results of previous audits.
- Defined audit criteria and scope for each audit.
- Selection of auditors and conduct of audits in a way that ensures objectivity and impartiality.
- Reporting of audit results to relevant management.
- Retention of documented information as evidence of the audit programme and audit results.
The standard does not prescribe a fixed frequency, such as requiring one complete internal audit every 12 months. Instead, the organisation should establish an audit programme appropriate to its ISMS, risks, activities and previous audit results.
This means that higher-risk or more significant areas may warrant greater audit attention, while the programme can be structured across several audits rather than assessing every aspect of the ISMS in a single exercise.
A well-designed audit programme therefore provides more than evidence of compliance. It gives management an objective view of whether the ISMS is functioning effectively and where corrective action or improvement may be required.
Why Are ISO 27001 Internal Audits Important?
Internal audits are an essential part of maintaining an effective Information Security Management System (ISMS). While they are required by ISO/IEC 27001:2022, their value extends beyond simply demonstrating conformity with the standard.
A well-conducted internal audit helps an organisation understand whether its information security arrangements are working effectively in practice and whether the ISMS continues to address relevant risks.
Internal audits can help organisations to:
- Identify nonconformities early – allowing weaknesses to be addressed before they become more significant issues or are identified during a certification or surveillance audit.
- Verify implementation – confirming that documented policies, procedures and controls are actually being followed in practice.
- Assess effectiveness – evaluating whether information security processes and controls are achieving their intended outcomes.
- Identify emerging risks – highlighting changes in systems, suppliers, working practices or threats that may require further consideration.
- Support corrective action – providing objective evidence that can be used to investigate causes and implement appropriate corrective actions.
- Inform management review – providing management with evidence about ISMS performance and areas requiring attention.
- Drive continual improvement – identifying opportunities to strengthen information security processes and improve the effectiveness of the ISMS.
- Support certification readiness – helping organisations identify and address potential issues before external certification or surveillance audits.
Internal auditing should therefore not be treated as a simple compliance checklist. When performed effectively, it becomes an important management tool for assessing the health of the ISMS and ensuring information security arrangements continue to develop alongside the organisation.
What Should an ISO 27001 Internal Audit Cover?
The scope of an ISO 27001 internal audit should be based on the organisation’s ISMS, its audit programme and the specific objectives and criteria established for the audit. While an individual audit does not necessarily need to assess the entire ISMS, the overall audit programme should provide appropriate coverage of the system.
Depending on the scope of the audit, areas reviewed may include:
- Context of the organisation – including interested parties, relevant requirements and the defined scope of the ISMS.
- Leadership and responsibilities – including information security policy, roles, responsibilities and management commitment.
- Information security risk management – including the organisation’s risk assessment methodology, identified risks and risk treatment activities.
- Statement of Applicability (SoA) – confirming that applicable controls are identified and that decisions regarding their inclusion or exclusion are appropriately justified.
- Information security objectives – assessing whether objectives have been established, monitored and reviewed.
- Competence and awareness – checking whether personnel understand their information security responsibilities and have appropriate competence.
- Documented information – reviewing whether required policies, procedures and records are appropriately controlled and maintained.
- Operational processes – assessing whether information security processes are implemented and operating as intended.
- Applicable Annex A controls – examining evidence that selected controls are implemented and operating effectively where relevant to the audit scope.
- Performance monitoring and measurement – reviewing how the organisation evaluates the performance and effectiveness of its ISMS.
- Information security incidents – assessing how incidents are reported, managed, investigated and used to support improvement.
- Supplier and third-party security – where applicable, reviewing how information security risks associated with external providers are managed.
- Previous audit findings and corrective actions – checking whether identified nonconformities have been appropriately addressed and whether corrective actions have been effective.
- Management review – confirming that management reviews are conducted and provide appropriate oversight of ISMS performance.
- Continual improvement – examining how the organisation identifies and implements improvements to the ISMS.
Auditing Annex A Controls
A common misconception is that an ISO 27001 internal audit consists simply of working through all 93 Annex A controls as a checklist.
The organisation’s Statement of Applicability identifies the controls necessary for its risk treatment and explains their implementation status and any exclusions. The internal audit should therefore consider applicable controls in the context of the organisation’s risks, processes and ISMS requirements rather than treating Annex A as a standalone compliance checklist.
The objective is to gather sufficient objective evidence to determine whether the ISMS conforms to established requirements and is effectively implemented and maintained.
Supplying Digital Health Technologies to the NHS?
If your organisation supplies digital health technologies, medical devices or software to the NHS, you may also need to consider the NHS Digital Technology Assessment Criteria (DTAC). Our guide explains the DTAC requirements, including clinical safety, data protection, technical security, interoperability, and usability and accessibility. Read our Complete Guide to NHS DTAC Compliance.
How to Plan an ISO 27001 Internal Audit
Effective planning is essential to ensure an ISO 27001 internal audit provides meaningful and reliable results. The audit should have clearly defined objectives, scope and criteria, with sufficient time and resources allocated to gather appropriate objective evidence.
Establish the Internal Audit Programme
The organisation should maintain an audit programme that determines which areas of the ISMS will be audited and when. The programme should consider the importance of the processes concerned, changes affecting the organisation and the results of previous audits.
A risk-based approach can help ensure that higher-risk or more significant areas receive appropriate audit attention.
Define the Audit Scope and Criteria
Before conducting an audit, the organisation should establish its scope and audit criteria.
The scope defines what will be audited and may include particular departments, processes, locations, systems or areas of the ISMS.
Audit criteria provide the requirements against which evidence will be evaluated. These may include:
- ISO/IEC 27001:2022 requirements
- The organisation’s information security policies and procedures
- The Statement of Applicability
- Information security objectives
- Relevant contractual or regulatory requirements
- Internal processes and established controls
Clearly defining these elements helps ensure the audit remains focused and that findings can be supported by objective evidence.
Select Competent and Impartial Auditors
Auditors should have appropriate knowledge and competence to assess the areas within the audit scope. They must also be sufficiently objective and impartial.
This is particularly important when audits are performed internally. An individual should not simply audit their own work and then determine whether it is compliant.
For smaller organisations, achieving sufficient independence can sometimes be difficult because the same individuals may be responsible for implementing and maintaining significant parts of the ISMS. In these circumstances, using an external ISO 27001 internal auditor can provide greater independence and specialist expertise.
Prepare the Audit Plan
The auditor should prepare for the audit by reviewing relevant documentation and identifying the evidence that will need to be sampled.
This may include:
- Policies and procedures
- Risk assessments and risk treatment plans
- The Statement of Applicability
- Previous audit reports
- Corrective action records
- Information security objectives and monitoring results
- Incident records
- Training and competence records
- Supplier assessments
- Management review records
- Evidence relating to applicable information security controls
Good preparation allows the auditor to spend less time simply locating documents and more time evaluating whether the ISMS is implemented effectively in practice.
How to Conduct an ISO 27001 Internal Audit
Once the audit has been planned, the auditor can begin gathering objective evidence to determine whether the ISMS conforms to the established audit criteria and is effectively implemented and maintained.
An effective ISO 27001 internal audit should combine document review with discussions, observations and sampling of records. The objective is to understand what actually happens in practice rather than simply confirming that policies and procedures exist.
Review Documents and Records
The auditor should review relevant documented information and records associated with the audit scope. This can include policies, procedures, risk assessments, the Statement of Applicability, training records, incident records, supplier assessments and evidence generated by information security processes.
Documents should be assessed not only for their existence but also to determine whether they are current, appropriately controlled and consistent with actual working practices.
Interview Relevant Personnel
Speaking with employees and process owners can provide valuable evidence about how information security requirements are understood and implemented.
The auditor may ask personnel to explain their responsibilities, demonstrate processes or describe how they would respond to particular information security events.
Interviews can also help identify differences between documented procedures and day-to-day practice.
Sample Objective Evidence
Internal audits do not normally require every record or transaction to be examined. Instead, auditors can use appropriate sampling to evaluate whether processes are operating consistently.
For example, an auditor might sample:
- User access approvals and removals
- Security awareness and training records
- Information security incidents
- Supplier assessments
- Backup and recovery records
- Change management records
- Risk treatment activities
- Corrective actions from previous findings
The sample should be sufficient to provide reasonable confidence in the conclusions reached.
Evaluate Implementation and Effectiveness
The audit should go beyond asking whether a control has been implemented. Where appropriate, the auditor should also consider whether it is achieving its intended outcome.
For example, having an information security awareness programme does not automatically demonstrate effectiveness. The auditor may also examine completion records, employee understanding, reported incidents or other evidence showing whether the programme is working as intended.
Record the Evidence and Findings
Audit conclusions should be based on verifiable evidence rather than assumptions or personal opinion.
The auditor should maintain sufficient records to demonstrate what was examined, the evidence obtained and how each finding was reached. Any identified nonconformity should be clearly linked to the relevant audit criterion or requirement.
This creates a defensible audit trail and makes it easier for the organisation to understand and address any issues identified.
Developing Medical Device Software?
If your organisation develops Software as a Medical Device (SaMD), embedded software or connected medical technologies, information security should be considered alongside the software development lifecycle. Learn how software planning, risk management, verification, maintenance and cybersecurity fit together in our Complete Guide to IEC 62304 Medical Device Software Development.
ISO 27001 Audit Findings: Conformities, Nonconformities and Opportunities for Improvement
Once the evidence has been evaluated, the auditor should document the findings clearly and objectively. Each finding should be supported by evidence and linked to the relevant audit criterion.
The purpose of reporting findings is not simply to identify faults. A good internal audit provides management with a clear picture of where the ISMS is working effectively, where requirements are not being met and where improvements could strengthen information security performance.
Conformity
A conformity indicates that the available audit evidence demonstrates that the relevant requirement has been met.
Recording positive conformity can be useful because it provides assurance that processes and controls are operating as intended and helps demonstrate the overall effectiveness of the ISMS.
Nonconformity
A nonconformity occurs where audit evidence demonstrates that a requirement has not been fulfilled.
For example, an auditor might identify that:
- A required information security process has not been implemented.
- A documented procedure is not being followed.
- Risk treatment actions have not been completed as planned.
- Required records cannot be provided.
- Previous corrective actions have not been effectively implemented.
- An applicable control identified within the Statement of Applicability is not operating as intended.
A nonconformity should clearly state the requirement, the objective evidence identified and the nature of the failure. This makes it easier for the organisation to investigate the issue and determine appropriate corrective action.
Opportunities for Improvement
An audit may also identify areas where the organisation technically meets its requirements but could improve the efficiency, consistency or effectiveness of its ISMS.
These may be recorded as opportunities for improvement (OFIs) or observations, depending on the organisation’s audit methodology.
An OFI should not be used to disguise a genuine nonconformity. If a requirement has not been met, it should be reported as a nonconformity.
Clear and proportionate reporting helps ensure that audit findings lead to meaningful action rather than becoming a simple administrative exercise.
Corrective Action and Follow-Up
Identifying a nonconformity is only part of the internal audit process. The organisation must also ensure that appropriate action is taken to address the issue and prevent it from recurring.
Where an internal audit identifies a nonconformity, the organisation should first understand why the problem occurred, rather than simply correcting the immediate issue.
For example, if an employee has not completed required information security training, simply asking them to complete the training addresses the immediate problem. However, the organisation should also determine why the training was missed and whether the underlying process for assigning, monitoring or escalating overdue training needs improvement.
Correction vs Corrective Action
There is an important distinction between a correction and corrective action:
- Correction addresses the specific problem that has been identified.
- Corrective action addresses the cause of the nonconformity to reduce the likelihood of it happening again.
Depending on the nature of the finding, corrective action may involve:
- Updating policies or procedures.
- Providing additional training or awareness.
- Improving monitoring or oversight.
- Changing technical or organisational controls.
- Updating risk assessments or risk treatment activities.
- Clarifying roles and responsibilities.
- Improving supplier management processes.
- Introducing additional checks or approvals.
Root Cause Analysis
For significant or recurring nonconformities, the organisation should consider the root cause of the issue.
Methods such as the 5 Whys can help determine whether the apparent problem is actually the result of a deeper weakness within a process, responsibility, resource or control.
Understanding the underlying cause helps prevent organisations from repeatedly correcting the same issue without resolving why it continues to occur.
Verify the Effectiveness of Corrective Action
Corrective action should not automatically be considered complete simply because an action has been implemented.
The organisation should determine whether the action taken has been effective. This may involve reviewing new records, resampling evidence, speaking with relevant personnel or conducting a follow-up audit.
The level of follow-up should be proportionate to the significance and risk associated with the finding.
Maintaining records of findings, corrections, corrective actions and effectiveness checks also provides valuable evidence during management review and subsequent certification or surveillance audits.
ISO 27001 Internal Audit vs Certification Audit
Although both assess an organisation against the requirements of ISO/IEC 27001:2022, an internal audit and a certification audit serve different purposes.
An internal audit is conducted on behalf of the organisation to evaluate its own Information Security Management System (ISMS). It helps identify nonconformities, weaknesses and opportunities for improvement before they become more significant issues.
A certification audit, by comparison, is conducted by an independent accredited certification body to determine whether the organisation’s ISMS meets the requirements necessary for ISO 27001 certification.
| ISO 27001 Internal Audit | ISO 27001 Certification Audit |
|---|---|
| Conducted for the organisation itself | Conducted by an independent certification body |
| Required by Clause 9.2 | Required to obtain and maintain third-party certification |
| Evaluates conformity and effectiveness of the ISMS | Determines whether the ISMS meets certification requirements |
| Can be conducted by competent internal or external auditors | Conducted by certification body auditors |
| Helps identify issues before external assessment | Can result in certification-related nonconformities |
| Forms part of continual evaluation and improvement | Provides independent third-party certification |
Internal Audits Before ISO 27001 Certification
An organisation seeking initial ISO 27001 certification will normally need to have completed its internal audit activities and management review before progressing through the certification process.
This makes the internal audit an important certification-readiness exercise. It provides an opportunity to identify gaps in the ISMS while there is still time to investigate and address them before the certification body conducts its assessment.
However, the purpose should not be simply to “pass” the certification audit. A strong internal audit programme should continue throughout the certification cycle, helping the organisation verify that its ISMS remains effective as its risks, systems, people and business activities change.
How Often Should ISO 27001 Internal Audits Be Conducted?
ISO/IEC 27001:2022 does not specify a fixed frequency for internal audits. Instead, Clause 9.2 requires organisations to conduct internal audits at planned intervals and to establish an audit programme appropriate to their ISMS.
When determining the frequency and timing of audits, organisations should consider factors such as:
- The importance and risk associated with the processes being audited.
- Results and findings from previous internal and external audits.
- Significant changes to systems, technology or infrastructure.
- Changes to organisational structure, responsibilities or working practices.
- New or emerging information security risks.
- Information security incidents or recurring issues.
- Changes to legal, regulatory or contractual requirements.
- The maturity and performance of the ISMS.
Does ISO 27001 Require an Annual Internal Audit?
There is no specific ISO 27001 requirement stating that a complete internal audit must be performed once every year.
Many organisations choose an annual audit cycle because it provides a practical way of demonstrating regular oversight of the ISMS. However, this should not be treated as a universal requirement of the standard.
An organisation may instead establish a rolling audit programme, assessing different areas of the ISMS at different points throughout the year.
For example, higher-risk processes or areas with previous nonconformities may be audited more frequently, while stable and mature areas may require less frequent attention.
The important point is that the organisation can demonstrate that its audit programme is planned, justified and appropriate to its risks and circumstances, and that it provides sufficient oversight to determine whether the ISMS continues to conform to requirements and operate effectively.
Common ISO 27001 Internal Audit Mistakes
An internal audit can meet the basic requirement of being completed while still providing relatively little value to the organisation. Avoiding common auditing mistakes helps ensure the process provides a meaningful assessment of the Information Security Management System (ISMS).
Treating the Audit as a Checklist Exercise
A checklist can provide useful structure, but an ISO 27001 internal audit should not consist simply of ticking off requirements.
Auditors should gather objective evidence and determine whether processes and controls are implemented and effective in practice.
Auditing Only the Annex A Controls
ISO 27001 is not simply a list of Annex A controls. The audit programme should consider the requirements of the wider ISMS, including areas such as context, leadership, risk management, objectives, performance evaluation and improvement.
Applicable Annex A controls should be assessed in conjunction with the organisation’s Statement of Applicability and risk treatment process.
Auditors Reviewing Their Own Work
Auditors must be selected and audits conducted in a way that ensures objectivity and impartiality.
Allowing the person responsible for implementing a process or control to be solely responsible for auditing it can undermine the independence of the audit.
Focusing on Documents Rather Than Implementation
Having a policy or procedure does not demonstrate that it is being followed.
Auditors should look for evidence of implementation through interviews, observations, records and appropriate sampling.
Using Samples That Are Too Limited
Reviewing a single record may not provide sufficient evidence to determine whether a process is consistently implemented.
Sampling should be appropriate to the nature, significance and risk of the process being assessed.
Poorly Written Nonconformities
Audit findings should clearly identify the requirement that has not been met and the objective evidence supporting the finding.
Vague findings such as “access control needs improvement” make it difficult to understand the problem, investigate its cause or determine appropriate corrective action.
Closing Findings Without Checking Effectiveness
Completing an action does not necessarily mean the underlying problem has been resolved.
Where appropriate, organisations should verify that corrective actions have been effective and that the nonconformity is unlikely to recur.
Treating the Internal Audit as a Certification Exercise
The objective of an internal audit should not simply be to prepare for the next certification body visit.
A strong internal audit programme provides ongoing assurance that the ISMS remains suitable and effective as the organisation, its technologies and its information security risks change.
Using an External ISO 27001 Internal Auditor
Organisations can conduct ISO 27001 internal audits using appropriately competent internal personnel, but this is not always practical. Smaller organisations in particular may find it difficult to demonstrate sufficient objectivity and impartiality when the same people are responsible for developing, implementing and maintaining the Information Security Management System (ISMS).
Using an external ISO 27001 internal auditor can provide an independent assessment of the ISMS while also bringing additional experience from auditing different organisations and information security environments.
An external auditor can help organisations to:
- Provide greater independence and impartiality.
- Assess the ISMS against the requirements of ISO/IEC 27001:2022.
- Review the implementation and effectiveness of relevant processes and controls.
- Identify nonconformities and opportunities for improvement.
- Evaluate the Statement of Applicability and risk treatment activities.
- Review evidence objectively rather than relying solely on internal assumptions.
- Provide documented audit findings and reports.
- Support preparation for certification and surveillance audits.
- Verify the effectiveness of corrective actions where follow-up is required.
ISO 27001 Internal Auditing with Patient Guard
Patient Guard provides ISO 27001 internal auditing services to help organisations independently assess their ISMS and prepare for external certification and surveillance audits.
Our auditors can review your ISMS against the requirements of ISO/IEC 27001:2022, assess relevant documented information and implementation evidence, interview personnel and provide clear findings to help your organisation address nonconformities and strengthen its information security management system.
External internal auditing can also be particularly valuable where your organisation does not have suitably independent personnel available internally or where additional ISO 27001 expertise is required.
Frequently Asked Questions About ISO 27001 Internal Audits
Yes. ISO/IEC 27001:2022 Clause 9.2 requires organisations to conduct internal audits at planned intervals to determine whether the ISMS conforms to the organisation’s own requirements and the requirements of ISO 27001, and whether it is effectively implemented and maintained.
ISO 27001 does not prescribe a specific frequency such as once per year. Organisations must establish an audit programme and conduct audits at planned intervals, taking into account factors such as the importance of processes, organisational changes and previous audit results.
Not necessarily in a single audit. Organisations can use a rolling audit programme covering different processes, controls or areas at different times. The overall programme should provide appropriate coverage to determine whether the ISMS continues to conform to requirements and operate effectively.
Internal audits can be conducted by competent employees or external auditors. Auditors should have appropriate knowledge and skills and must be selected in a way that ensures objectivity and impartiality.
Auditors should not be placed in a position where their involvement compromises the objectivity and impartiality of the audit. Where appropriate independence cannot be achieved internally, particularly in smaller organisations, using an external auditor can be an effective solution.
Not automatically. The audit should assess the ISMS against the relevant audit criteria and consider applicable controls identified through the organisation’s risk treatment process and Statement of Applicability. Annex A should not simply be treated as a 93-point audit checklist.
Evidence may include policies and procedures, risk assessments, the Statement of Applicability, training records, incident records, access-control records, supplier assessments, monitoring results, management review records and previous corrective actions. Interviews and observations may also provide objective evidence.
The organisation should respond appropriately to the nonconformity, including taking action to address the issue and, where necessary, investigating its cause and implementing corrective action to prevent recurrence. The effectiveness of corrective action should also be reviewed.
No. An internal audit is conducted on behalf of the organisation as part of maintaining and evaluating its ISMS. A certification audit is conducted by an independent certification body to determine whether the organisation meets the requirements for ISO 27001 certification.
Yes. Patient Guard provides independent ISO 27001 internal auditing services, including review of the ISMS against ISO/IEC 27001:2022, assessment of implementation evidence, identification of nonconformities and opportunities for improvement, and support in preparing for certification and surveillance audits.
References
This guide is based on ISO/IEC 27001:2022 and current international guidance for auditing management systems. The references below support the requirements and good practices discussed throughout this guide, including internal audit programmes, auditor impartiality, objective evidence, information security controls, audit findings and certification.
| Organisation | Reference | Why it's relevant |
|---|---|---|
| ISO / IEC | ISO/IEC 27001:2022 – Information Security Management Systems | The international standard specifying requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS). Clause 9.2 establishes the requirements for internal audits, including audit programmes, scope, criteria, auditor objectivity and reporting of audit results. |
| ISO | ISO 19011:2026 – Guidelines for Auditing Management Systems | Provides current international guidance on auditing management systems. It covers auditing principles, managing an audit programme, conducting audits, reporting results and evaluating auditor competence. It is particularly relevant when establishing a structured and evidence-based ISO 27001 internal audit process. |
| ISO / IEC | ISO/IEC 27002:2022 – Information Security Controls | Provides guidance on information security controls and supports the controls referenced in Annex A of ISO/IEC 27001:2022. It can assist auditors when evaluating the implementation and operation of applicable controls identified through an organisation's risk treatment process and Statement of Applicability. |
| ISO / IEC | ISO/IEC 27001:2022/Amd 1:2024 – Climate Action Changes | Introduces climate change considerations into management system requirements concerning organisational context and interested parties. Where relevant to the ISMS, these requirements should be considered when defining audit criteria and assessing conformity with ISO/IEC 27001. |
| Information Commissioner's Office | ICO – A Guide to Data Security | Provides UK regulatory guidance on protecting personal information through appropriate technical and organisational security measures. It can provide relevant audit criteria and context where an organisation's ISMS includes the protection of personal data under the UK GDPR. |
| Information Commissioner's Office | ICO – Security Outcomes | Provides practical security outcomes covering areas such as governance, risk management, asset management, access control, system security and supply-chain security. These areas may provide useful supporting evidence when auditing information security arrangements involving personal data. |
| ISO / IEC | ISO/IEC 17021-1:2015 – Requirements for Management System Certification Bodies | Specifies requirements for bodies providing audit and certification of management systems. While it applies primarily to certification bodies rather than internal auditing, it helps explain the distinction between an organisation's Clause 9.2 internal audit and the independent certification audit process. |
| United Kingdom Accreditation Service | UKAS – Accredited Certification | UKAS is the UK's national accreditation body and accredits management system certification bodies. Organisations seeking accredited ISO/IEC 27001 certification can use UKAS information to understand the role of accreditation and the distinction between internal auditing and third-party certification. |
ISO standards are periodically reviewed and updated. Organisations should verify that they are working to the current editions of ISO/IEC 27001, ISO 19011 and other applicable standards, amendments, regulatory guidance and certification requirements. ISO 19011:2026 replaced ISO 19011:2018 in 2026.
Patient Guards Recent Posts
FDA Medical Device Classification: Class I, Class II and Class III Explained
Does your medical device require FDA 510(k) clearance? This step-by-step guide explains the 510(k) process, substantial equivalence, predicate devices, testing, eSTAR submissions, FDA review and what manufacturers need to do after clearance.
FDA 510(k) Clearance: A Step-by-Step Guide for Medical Device Manufacturers
Does your medical device require FDA 510(k) clearance? This step-by-step guide explains the 510(k) process, substantial equivalence, predicate devices, testing, eSTAR submissions, FDA review and what manufacturers need to do after clearance.
FDA Medical Device Regulations: A Complete Guide for Manufacturers
Planning to place a medical device on the US market? This complete guide explains FDA medical device regulations, including device classification, 510(k), De Novo and PMA pathways, QMSR and ISO 13485, establishment registration, device listing, U.S. Agent requirements, UDI and post-market obligations.
Patient Guards Related Services
Patient Guards Regulatory Tools
Need Training?
Do you need training on Quality Management Systems or EU MDR/ EU IVDR? then check out our training courses.
