How can an internal audit help prepare for the certification audit?
Internal audits are a requirement of the ISO27001 standard, clause 9.2 to be specific. A certification auditor will verify that you are carrying out internal audits to your audit schedule, and are providing the relevant audit evidence (reports and any nonconformities) and that the audit programme is being managed. Certification bodies will also check that the outputs of audits are being reviewed in your management review meetings to identify areas of weakness or areas for improvement.
How often does the management system need to be internally audited?
If this is your first certification audit you will need to have completed an internal audit of the full management system and have evidence of this in the form of the report before the stage 2 audit. After this, most certification auditors allow the management system to be internally audited over the three year recertification period of which will be managed with an internal audit program decided by your organization.
How long will an internal audit take?
This depends on the scope of the audit and if there are multiple sites, or business functions that fall under that audit scope. Time also needs to be factored in for evidence gathering, writing the audit report along with any audit findings and nonconformities that may be identified.
What are the additional benefits of an internal audit?
- Confirms the health of your management system, the way it is operating and the efficiency of the business processes i.e. Is it wasting time, effort, and cash on inefficient processes?
- Ensures that your company operations, processes and procedures comply with statutory, regulatory and management system requirements.
- Gives senior management visibility into the effectiveness or weaknesses of the management system as part of the management review requirements.
Does the internal audit need to be outsourced?
No this isn’t a requirement, however it is a requirement that the internal auditor must be independent of the management system. This means if you’ve worked on implementing all or part of the management system you’re not able to audit your own work. This is why many organizations find it easier to outsource this to ensure compliance.
Does the internal auditor need to have qualifications?
Again this isn’t a requirement, however the more experience and knowledge your internal auditor has the better the internal audit will be. From knowing what to look for, what questions to ask departments and ensuring a comprehensive audit that will match the certification auditors so there are no nasty surprises at the stage two certification audit.
Who is required at the internal audit?
Representatives within the scope of activities being audited will need to be interviewed, plus any other representatives as needed. Your internal auditor, whether this is in-house or outsourced will provide you with a schedule of interviewees based on their involvement with a certain business function or within the management system.
How frequently does an organization need an internal audit?
It is a requirement of the standard that an organization defines an audit plan covering a period of time, typically organizations prepare an annual audit schedule showing which functions or areas of the standard are to be audited at a particular time. Internal audits should be carried out in accordance with the audit schedule.
How much do internal audits cost?
This is dependent on multiple factors from audit scope to size of the organization and number of sites. Submitting an enquiry and completing our audit booking form is the best way to get a quote specific to your organization.
