ISO 27001 for IT managers 6: run an internal audit and useful management review

Internal audit is a test of the system

By this point you should have a scope, risks, controls and operating records. Internal audit evaluates whether the ISMS meets its requirements and works as intended. It is not merely asking the person who wrote a policy whether they like it. Use the licensed standard, your own approved arrangements and relevant obligations as audit criteria.

Plan an audit programme that reflects the importance of processes, changes and previous results. Cover the management system as well as selected controls: leadership, risk decisions, competence, measurement and improvement can be weak even when laptops are patched. A technical vulnerability scan is useful evidence, but it is not an internal ISMS audit by itself.

Choose competent auditors and preserve objectivity and impartiality. Avoid having someone audit their own work. A small organisation may use a capable colleague from another function or external support, with clear scope and confidentiality. The IT manager can explain evidence without being the only person deciding whether their own control is effective.

Write a small audit plan before collecting evidence

State the process, criteria, scope, people, records and timing. Tell participants what the audit will examine and arrange access that does not expose unnecessary personal data or secrets. Choose samples from a meaningful population, not only records volunteered because they are tidy.

Illustrative audit plan: leaver access
Criteria: approved leaver procedure and relevant ISMS requirements
Population: departures in the defined review period
Sample approach: include an ordinary user and a privileged/supplier case where present
Trace: HR notification → approval → account/session action → service-owner confirmation
Auditor: person independent of operating this process
Output: evidence references, findings, owners and follow-up date

If the period contains no leavers, say so. Review the process design and any labelled test evidence, then plan an appropriate future operational check. Do not invent a historical case to satisfy the sample plan.

Record a finding that can be acted on

A finding should connect a criterion to evidence and explain the gap. “Access management needs work” is difficult to resolve. A fictional finding might say: “The approved procedure requires confirmation across listed services; two of five sampled leaver records lack confirmation for the CRM, and one corresponding account remains enabled.”

That wording distinguishes missing records from an observed live account. Check facts with the process owner before finalising the report. Avoid assuming that absence of a screenshot proves the control never operated; equally, do not accept an unsupported verbal assurance as sufficient evidence of completion.

Keep strengths and improvement suggestions separate from nonconformities. Do not dilute a real failure into a suggestion because a colleague is uncomfortable. The purpose is to correct the system before it causes harm or reaches the external audit.

Turn findings into owned work

For the example, first investigate and remove unauthorised access safely. Then establish why the CRM was missed. Perhaps the application inventory is not connected to the leaver checklist. Correct the process and check the wider population, not only the sampled account.

Assign responsibility and a due date, record the action and verify effectiveness later. Part 8 develops corrective action in more detail. Keep unresolved findings visible when assessing readiness; a signed internal-audit report is not evidence that its findings have been closed.

Prepare management review as a decision meeting

Management review examines whether the ISMS remains suitable, adequate and effective. Prepare the required inputs against the current standard rather than relying on a slide template. Bring previous actions, relevant changes, performance and objectives, audit results, incidents/nonconformities, risk and treatment status, interested-party feedback and improvement opportunities as applicable.

Translate technical issues into decisions. “Three critical services have no current recovery exercise” is clearer when paired with the consequence, proposed work, resource need and owner. “Everything is green” is not useful if the team quietly excluded systems it could not measure.

Minutes should capture what management decided, who will act and when follow-up occurs. Do not write minutes for a meeting that never happened or treat a circulated dashboard as proof of decisions nobody made. Leaders need to participate in their actual responsibilities.

Readiness exercise

Have an authorised colleague choose an internal-audit finding and a management-review action. Demonstrate the evidence, decision, owner and current status without reconstructing the story from memory. Check that open items appear in the programme's readiness assessment.

You finish with an audit programme, completed audit records, real findings and management decisions. Ask your certification body about the required readiness and operational evidence before proceeding. Part 7 prepares the external Stage 1 and Stage 2 assessments using those records.

Check your understanding