ISO27001 Internal Audit

Internal audits are a requirement of clause 9.2 of many ISO standards.  A certification auditor will verify that you are carrying out internal audits to your audit schedule, and are providing the relevant audit evidence (reports and any nonconformities) and that the audit programme is being managed.  Certification bodies will also check that the outputs of audits are being reviewed in your management review meetings to identify areas of weakness or areas for improvement.

This depends on the scope of the audit and if there are multiple sites, or business functions that fall under that audit scope.  Time also needs to be factored in for evidence gathering, writing the audit report along with any audit findings and nonconformities that may be identified.

• Confirms the health of your management system, the way it is operating and the efficiency of the business processes i.e. Is it wasting time, effort, and cash on inefficient processes?

• Ensures that your company operations, processes and procedures comply with statutory, regulatory and management system requirements.

• Gives senior management visibility into the effectiveness or weaknesses of the management system as part of the management review requirements.

No this isn’t a requirement, however it is a requirement that the internal auditor must be independent of the management system. This means if you’ve worked on implementing all or part of the management system you’re not able to audit your own work. This is why many organisations find it easier to outsource this to ensure compliance.

Again this isn’t a requirement, however the more experience and knowledge your internal auditor has the better the internal audit will be. From knowing what to look for, what questions to ask departments and ensuring a comprehensive audit that will match the certification auditors so there are no nasty surprises at the stage two certification audit.

Representatives within the scope of activities being audited will need to be interviewed, plus any other representatives as needed. Your internal auditor, whether this is in-house or outsourced will provide you with a schedule of interviewees based on their involvement with a certain business function or within the management system.

It is a requirement that an organisation defines an audit plan covering a period of time, typically organisations prepare an annual audit schedule showing which functions or areas of the standard are to be audited at a particular time.  Internal audits should be carried out in accordance with the audit schedule.

This is dependent on multiple factors from audit scope to size of the organisation and number of sites. Submitting an enquiry and completing our audit booking form is the best way to get a quote specific to your organisation.