Internal Audit Plan

Internal audit is the ISMS checking itself. Done well, it is the cheapest source of findings you will ever get: problems surface on your own schedule, with time to fix them before a certification or surveillance audit. Done as a box-ticking exercise, it produces a clean report that the external auditor promptly contradicts. This template gives you a starting structure for an annual plan with scope and schedule. The guidance below covers what the plan must contain, how to prioritize, and how to stay independent when your team is small.

What ISO 27001 clause 9.2 requires

ISO/IEC 27001:2022 clause 9.2 requires internal audits at planned intervals to determine whether the ISMS conforms to the organization's own requirements and to the standard, and whether it is effectively implemented and maintained. The organization must plan, establish, implement, and maintain an audit programme covering frequency, methods, responsibilities, planning requirements, and reporting, taking into account the importance of the processes concerned and the results of previous audits.

• Define audit criteria and scope for each audit.
• Select auditors and conduct audits so the process is objective and impartial.
• Report results to relevant management.
• Retain documented information as evidence of the programme and the audit results.

Certification bodies generally expect at least one completed internal audit and a management review of the ISMS before the Stage 2 certification audit. ISO 19011 provides general guidance on auditing management systems, and ISO/IEC 27007 applies that guidance to information security management systems.

Build the plan from risk, not from the clause list

Start with an audit universe: every ISMS clause (4 through 10) and every applicable control from your statement of applicability. Then prioritize. Areas with high risk ratings, recent incidents, previous findings, significant change, or immature processes get audited earlier and more deeply. Stable, low-risk areas can be covered more lightly, as long as the full scope is covered across the certification cycle. Pull the risk ratings directly from your risk register so the rationale is traceable.

Independence when the team is small

Auditors must not audit their own work. In a small company where one person built most of the ISMS, that takes deliberate arrangement. Workable options include:

• Cross-auditing: a trained colleague from another function audits security processes, with the security lead auditing areas they do not operate.
• Outsourcing: an external consultant or vCISO performs some or all internal audits. The organization still owns the programme and the follow-up.
• Hybrid: outsource audits of areas the security lead owns and perform the rest internally.

Grading and reporting findings

Each audit report should state scope, criteria, auditor, dates, what was sampled, findings with evidence, and a conclusion. Nonconformities flow into corrective action under clause 10.2, and a summary of audit results is an input to management review under clause 9.3. A CAPA process keeps each finding tied to a root cause, an action, and verification of effectiveness.

Beyond ISO 27001

SOC 2 CC4.1 expects ongoing or separate evaluations to confirm controls are present and functioning, and CC4.2 expects deficiencies to be communicated to those responsible for corrective action. The HIPAA Security Rule requires periodic technical and nontechnical evaluation under §164.308(a)(8). An internal audit plan built on a shared control set can test controls once and report against several frameworks.

Asurvo's Audit product supports internal as well as external audit workflows, with requests, evidence, findings, and remediation in one place. The internal auditor role page describes how that looks day to day.