Step 6 · Audit and improvement
Internal audit Check yourself before others do.
In an internal audit you check whether your management system meets the requirements and is effectively implemented – before an external auditor arrives.
What it is about
ISO/IEC 27001 clause 9.2 requires internal audits at planned intervals under an audit programme with frequency, methods, responsibilities and reporting. Auditors must be objective and impartial, and results go to the relevant management. Under NIS2, assessing effectiveness is one of the minimum measures (Section 30(2) No. 6 BSIG).
- Major 1
- Minor 4
- Observation (OFI) 6
Corrections closed · 9 / 11
Sample values
How to go about it
- 01
Plan an audit programme for the cycle.
- 02
Set criteria and scope for each audit.
- 03
Audit with interviews, samples and evidence.
- 04
Report findings and start corrective action.
Common mistakes
- The auditor checks their own work.
- The audit stays a document review without sampling in operations.
- Findings have no corrective action and no deadline.
What an auditor wants to see
- Audit programme and audit plan
- Audit reports with findings
- Follow-up of corrective actions
How UniqSuite helps
In UniqSuite you plan audits, record findings and create a corrective action with owner and deadline for each. You generate the audit report at the push of a button.
References
- ISO/IEC 27001, clause 9.2
- ISO/IEC 27001, clause 10.2: nonconformity and corrective action
- Section 30(2) No. 6 BSIG
- ISO 19011 as guidance for auditing
Frequently asked questions
Who may audit internally?
Someone objective and impartial, who does not audit their own work. That can be staff from other areas or external auditors.
How often do we audit?
At planned intervals. It is common to cover all areas within a certification cycle and important areas every year.
Must an internal audit take place before certification?
Yes. In stage 1 of certification, the certification body checks whether internal audits and the management review have been planned and performed. Only then is the system considered ready for stage 2.
What is a nonconformity?
The non-fulfilment of a requirement. Under clause 10.2 you react to it, deal with the consequences and evaluate how to eliminate the cause so that it does not recur.
Do internal auditors need a certificate?
The standard does not require one. Under clause 7.2 they must be competent, for example through training or experience, and audit objectively.
See what this looks like in UniqSuite.
In half an hour we walk you through it with your own questions.