Requirement 9.2
What is an ISO 27001 internal audit?
The objective of conducting an internal audit for the ISO/IEC 27001:2022 standard is to independently and systematically evaluate the organization's Information Security Management System (ISMS), in order to:
- Verify the degree of conformity with the requirements of the ISO/IEC 27001 standard and with the internal policies, procedures, and controls established by the organization.
- Identify gaps, non-conformities, and opportunities for improvement in the implementation and operation of the ISMS.
- Evaluate the effectiveness of security controls, including those established in Annex A of the standard.
- Provide objective information and documented evidence to support decision-making by senior management.
- Contribute to preparation for certification or surveillance audits, ensuring that the ISMS remains adequate, effective, and aligned with business risks.
The methodology followed by Internet Security Auditors aims to ensure a complete and correct evaluation of the Information Security Management System and its security controls; the methodology covers the following aspects:
01Planning, Document Review, and Audit Plan
- A basic familiarization process regarding the ISMS will be conducted with the person in charge
- Review of the documentation supporting the ISMS
- Preparation of the Audit Plan
02Audit Execution
In this phase, the meetings established in the Audit Plan from the previous phase will be executed, beginning with the opening meeting in which the objective and scope of the audit will be presented; a review of compliance with the clauses of the ISO/IEC 27001:2022 international standard and the security controls listed in the annex of the same standard will be carried out, provided they apply to the Organization according to its Statement of Applicability (reviewed in the previous phase).
The evaluation consists of interview processes, process observation, document review, physical observations, and systems review with the aim of determining compliance with the standard and the controls defined by the organization.
03Audit Report
Audit that will present the process details and results obtained, specifying the list of evaluated controls, detailed audit findings, and opportunities for improvement.
The categorization of non-conformities will be established in accordance with the methodology and formats defined in the information security management system and the internal audit manual to which Internet Security Auditors adheres to demonstrate that official ISMS documentation defined under industry best practice guidelines is used. A closing meeting will be held where the main strengths and weaknesses detected in the process will be presented.
04Deliverables
- Audit plan
- Executive Summary
- Internal Audit Report
