Internal Audit For ISO 27001 Requirement 9.2

What is covered under ISO 27001 Clause 9.2?

Clause 9 of the management requirements for ISO 27001:2013 is performance evaluation.  9.2 says the organisation shall conduct internal audits at planned intervals to provide information on whether the information security management system:

  • Conforms to the organisation’s own requirements for its information security management system; and meets the requirements of the ISO 27001 international standard;
  • Whether the ISMS is effectively implemented and maintained

To achieve those goals the ISO auditor will look to see that the organisation has:

  • Planned, implemented and maintained an audit programme
  • Defined the audit criteria and scope for each audit
  • Selected auditors who will be objective and impartial
  • Ensured that audits are reported to relevant management
  • Retained documented information as evidence

How to conduct internal audits on an information security management system to comply with ISO 27001 9.2

Alongside information security risk management, internal audits are popular in creating anxiety for those new to ISMS’ and in particular organisations that are going for their first ISO 27001 certification. As such we have written a separate article on demystifying the internal audit requirements and expressing how an organisation can achieve it’s internal audit goals with much less stress and anxiety than first thought.

 

Ready to take action?

Discover how ISMS.online can help you achieve or improve on your ISMS objectives

Need ISO 27001 policies and controls for your ISMS?

ISMS.online includes practical policies and controls for your organisation to easily adopt, adapt and add to, giving you up to
77% head start with ISO 27001 documentation. 

Ready to take action?

Discover how ISMS.online can help you achieve or improve on your ISMS objectives

ISMS Online Rating: 5 out of 5
Share This