ISO 27001 Internal Audit and Management Review: Clauses 9.2 and 9.3 in Practice

The audit programme clause 9.2.2 actually requires, how to keep impartiality in a small team, findings that survive challenge, root cause under clause 10.2, and a management review that covers every input and produces decisions.

Short answer

Internal audit and management review are the two clauses most likely to cost you your certification date, and neither can be produced retrospectively. Clause 9.2 requires internal audits at planned intervals, conducted so that objectivity and impartiality are assured, with results reported to relevant management. Clause 9.3 requires top management — not the ISMS manager acting on their behalf — to review the ISMS against nine specified inputs and produce decisions. Both must have genuinely happened before a Stage 2 auditor arrives.

The two most common failures are an internal audit report with zero findings, which tells an experienced auditor the audit was not real, and management review minutes that record attendance but no decision. Clause 9.3.3 requires the results of the review. A meeting that decided nothing produced no results, and that is a nonconformity against a clause, not a presentational quibble.

Internal audit

Clause 9.2

9.2.1 purpose and 9.2.2 programme. Both are auditable.

Management review

Clause 9.3

By top management, against nine inputs, producing decisions.

Impartiality requirement

9.2.2 b)

Objectivity and impartiality of the audit process must be ensured.

Corrective action

Clause 10.2

Correction, cause, similar occurrences, effectiveness review.

This page is the performance-evaluation companion to our full guide on ISO 27001 certification in the Philippines. For where these two clauses sit in the project, see the certification process and timeline.

Why these two clauses delay more certificates than any control

An organisation can be missing a technical control at Stage 2 and take a minor nonconformity for it. An organisation that arrives without a completed internal audit is missing an entire clause of the standard, and that is normally classified major — which means no certification recommendation until it is corrected and the correction verified, usually by a chargeable follow-up audit.

The reason it happens is scheduling psychology. Implementation feels urgent because it is visible; internal audit feels like something you do once everything else is finished. But you cannot audit a process that has not run, and you cannot review performance that has not been measured. These two clauses sit at the end of a dependency chain that starts months earlier, and they are the reason our certification process and timeline puts a hard floor under every project.

Sequence that cannot be compressed: controls operate → clause 9.1 monitoring produces results → internal audit tests the system and produces findings → findings are actioned under clause 10.2 → management review considers all of it and makes decisions → Stage 2. Every step needs the output of the one before it to exist.

Clause 9.2.1 — what an internal audit is for

Clause 9.2.1 requires internal audits at planned intervals to provide information on whether the ISMS conforms to the organisation’s own requirements for its ISMS and to the requirements of ISO/IEC 27001, and whether it is effectively implemented and maintained.

Read that carefully, because it contains three separate tests and most internal audits only perform one:

The test What it means How it is usually missed
Conformity to your own requirements Do you do what your own policies, procedures and SoA say you do? If your access review procedure says quarterly, are there four reviews? Rarely missed — this is the part everyone audits.
Conformity to ISO/IEC 27001 Does the ISMS meet the requirements of clauses 4 to 10 of the standard itself, independent of your documents? Frequently missed. An audit programme built only from your own procedures never tests clause 4.1, 6.2, 7.4 or 9.3.
Effective implementation and maintenance Is the ISMS achieving its intended outcomes, or merely running? Effectiveness is about results, not activity. Almost always missed. An audit that confirms the process ran and stops there has tested conformity, not effectiveness.

“Planned intervals” does not mean annually as a rule of the standard — the standard does not set a frequency. It means intervals you have planned and can justify, and clause 9.2.2 tells you the justification: the importance of the processes concerned and the results of previous audits. A process that failed last year and a process that has never had a finding should not be on the same frequency.

Clause 9.2.2 — the audit programme, requirement by requirement

Clause 9.2.2 requires you to plan, establish, implement and maintain an audit programme, and it specifies what the programme must include. This is the requirement that a single annual audit report does not satisfy: a report is not a programme.

What 9.2.2 requires What satisfies it What a Stage 2 auditor does with it
Frequency Stated per process or area, justified by importance and previous results — not a single date. Checks whether the frequency you set is the frequency you achieved.
Methods Interview, document review, record sampling, technical verification, observation. Remote versus on site. Asks how you concluded a control was effective, and whether the method could have supported that conclusion.
Responsibilities Named auditors, a named programme owner, and who receives the reports. Tests the reporting line: results must reach relevant management.
Planning requirements Audit criteria and scope defined for each audit — clause 9.2.2 a) is explicit about this. Pulls one audit and asks what its criteria and scope were. “The ISMS” is not a scope.
Reporting Results reported to relevant management, with evidence they were received and acted on. Follows a finding from the report to the corrective action to the verification of effectiveness.
Consideration of importance and previous results Written justification for why the programme covers what it covers, referencing last cycle’s findings. Compares this year’s programme with last year’s findings. No relationship is a finding in itself.
Documented information Evidence of the implementation of the programme and of the audit results. This is one of the fifteen mandatory items — see the mandatory documents checklist.

Impartiality: what the clause says, and what people think it says

Be precise here, because the received wisdom is a paraphrase of a different standard. Clause 9.2.2 b) of ISO/IEC 27001:2022 requires you to select auditors and conduct audits in a manner that ensures objectivity and the impartiality of the audit process. It does not contain the sentence “auditors shall not audit their own work”. That formulation comes from older ISO 9001 editions and from ISO 19011 guidance.

The distinction matters in a small company. The requirement is a property of the audit process, not a headcount rule. Auditing your own work is the classic way of failing it, but it is not the only way, and organisations that cannot achieve perfect separation can still satisfy the clause if they can demonstrate how objectivity was assured.

Situation Does it satisfy 9.2.2 b)? Why
The IT manager audits the IT controls they implemented. No. The auditor is evaluating their own decisions. No documented mitigation makes this defensible.
The ISMS manager audits the whole ISMS, including clause 6 and 9 processes they own. No. The most common version of the failure, and the easiest for a Stage 2 auditor to spot from the org chart.
Finance audits IT, IT audits HR, HR audits finance — cross-functional peer auditing, with trained auditors. Yes, if competence is evidenced. Nobody audits their own area. Clause 7.2 competence records for the auditors are what makes it stand up.
An external auditor is contracted to run the internal audit programme. Yes. Legitimate and common. It remains your internal audit and you remain responsible for the programme, the findings and the actions.
Your certification body offers to run your internal audits. Not from your certification body. Under ISO/IEC 17021-1:2015 a certification body may not provide internal audits or management system consultancy to an organisation it certifies. See accredited certification bodies and the three roles.
A 12-person company where one person implemented everything. Only with an external auditor. Honest answer: there is no internal separation available. Buy the independence; it is cheaper than a major nonconformity.

ISO 19011:2018 gives useful guidance on auditor competence and audit programme management. It is guidance, not a certification requirement, and you are not audited against it. Citing it in your procedure is fine; claiming it is mandatory is not.

Building an audit programme that covers the whole ISMS

For a first certification, the programme must cover the entire ISMS before Stage 2. There is no partial-coverage concession for a new system: the clauses must all have been audited, and the applicable controls sampled. After certification you can move to a cycle in which coverage is achieved across a defined period, weighted by risk.

Audit Criteria and scope Typical effort
Context, leadership and planning Clauses 4, 5 and 6, including the 4.1 climate-change relevance determination added by Amendment 1:2024, the risk process, and the SoA against the risk register. 0.5–1 day
Support Clauses 7.1 to 7.5: resources, competence, awareness, communication and control of documented information. 0.5 day
Operation Clause 8, and the operational Annex A controls in your SoA — access, change, backup, logging, supplier, incident, physical. 1–3 days depending on scope
Performance evaluation and improvement Clauses 9.1, 9.3, 10.1 and 10.2. Note that clause 9.2 itself must be audited by someone independent of the audit programme owner. 0.5 day
Technical verification Sampling of actual system configuration against the controls claimed implemented in the SoA. 0.5–2 days
The programme must state the criteria and scope for each audit individually — clause 9.2.2 a). A programme that says “annual ISMS audit, scope: the ISMS” fails this sub-clause on its face, before anyone looks at whether the audit was any good.

Conducting the audit: sampling, evidence and interviews

An internal audit that reads documents and stops has tested document control. Evidence comes in three forms and a defensible audit uses all three.

  • Records. Sample across the whole period, not the last month. If access reviews are quarterly and you sample only Q4, you have not tested the frequency requirement at all. Take the population, state the sample size, and record which items you took.
  • Systems. Look at the actual configuration. If the SoA claims multi-factor authentication is implemented, open the identity provider and check the enforcement policy and the exception list. The exception list is where the finding usually is.
  • People. Interview the person who performs the control, not the person who wrote the procedure. Ask them to show you the last time they did it. This is exactly what your Stage 2 auditor will do, and it is the fastest way to find out whether the ISMS reaches the floor.

Record enough that someone else could repeat the audit: what you sampled, from what population, what you saw, and the conclusion you drew from it. An audit report whose evidence column says “verified — OK” is unauditable, and a Stage 2 auditor who finds it will start treating your internal audit as unreliable, which changes how deeply they sample everything else.

Writing a finding that survives challenge

Every nonconformity needs three components. Findings that get argued away in the closing meeting are missing one of them.

Component What it is Example
The requirement The clause, control or internal document the situation departs from — quoted by reference, not from memory. ISO/IEC 27001:2022 clause 9.1: documented information shall be available as evidence of the monitoring and measurement results.
The evidence What was seen, where, when, and how it was sampled. Specific enough to be re-verified by a third party. Sample of 8 monthly measurement records requested for the period January to August 2026; records exist for June, July and August only. Confirmed with the ISMS manager on 14 September 2026.
The statement of nonconformity One sentence stating the gap between the requirement and the evidence. No opinion, no proposed solution. Monitoring and measurement results were not retained for five of the eight months sampled.

Do not put the corrective action in the finding. The auditor’s job is to state the gap; the process owner’s job is to determine the cause and decide the action. An auditor who prescribes the fix has taken ownership of the outcome and compromised the objectivity clause 9.2.2 b) requires.

Zero findings across a whole first-year ISMS audit is not a triumph, it is a finding. No system implemented for the first time is conforming everywhere. A Stage 2 auditor reading a clean internal audit report will conclude either that the audit was superficial or that findings were suppressed, and will audit you accordingly.

Root cause and corrective action under clause 10.2

Clause 10.2 is where most internal audit programmes quietly fail, because organisations record a correction and call it a corrective action. They are different things and the clause requires both.

Clause 10.2 requires What it means What we typically see instead
React: control and correct it, deal with the consequences Fix the specific instance. Recreate the missing record, revoke the access, restore the backup. Done well — this is the part everyone does.
Evaluate the need to eliminate the cause Review the nonconformity, determine its causes, and determine whether similar nonconformities exist or could occur elsewhere. Cause recorded as “human error” or “oversight”, which is a description of the event, not a cause. And the “elsewhere” question is almost never asked.
Implement any action needed The systemic fix: change the process, the tooling, the reminder, the competence, the accountability. A note that staff were “reminded”. Reminders are not corrective actions; they are corrections applied to people.
Review the effectiveness of the action taken Come back later and check it worked. This is a separate, dated step with its own evidence. The action is marked closed on the day it was implemented, which cannot demonstrate effectiveness of anything.
Make changes to the ISMS if necessary Update the risk assessment, procedure, SoA or objective the nonconformity exposed. The document that was wrong stays wrong until the next audit finds it again.
Retain evidence of the nature of the nonconformities and the results of corrective action A nonconformity log with all of the above, per finding. A spreadsheet with a status column reading “Closed”.

The “or occur elsewhere” requirement in clause 10.2 b) 3) is the one to take seriously. If a joiner’s access was not revoked in one department, the question the clause forces you to ask is whether the same failure exists in the other five. Answering it honestly is what separates a management system from a defect log.

Clause 9.3 — management review is top management’s job

Clause 9.3.1 requires top management to review the ISMS at planned intervals to ensure its continuing suitability, adequacy and effectiveness. The subject of that sentence is top management. A review chaired by the ISMS manager, attended by IT, with the CEO copied on the minutes, does not satisfy the clause — and this is one of the first things a Stage 2 auditor tests, because the attendance list is on the first page.

“Top management” means the person or group that directs and controls the organisation at the highest level, within the scope of the ISMS. In a Philippine subsidiary of a foreign group, that is normally the local managing director and leadership team, not the regional office — the ISMS scope defines whose review it is.

Frequency is not specified by the standard. Annual is the minimum that most organisations can defend; quarterly is common where the risk profile or the client base demands it. What is not defensible is a review held two weeks before Stage 2 and never again.

The nine inputs clause 9.3.2 requires — all of them

Clause 9.3.2 specifies what the management review must include consideration of. Missing one is a nonconformity, and the most commonly missing are the ones that require someone to have prepared data in advance.

Clause 9.3.2 Input What must be in the pack
a) Status of actions from previous management reviews Every decision from the last review, with its current status. A first review states that there is no previous review, which is itself the record.
b) Changes in external and internal issues relevant to the ISMS Movement against your clause 4.1 determination: new regulation, new client requirements, restructuring, new sites, new technology, and the climate-change relevance question added by Amendment 1:2024.
c) Changes in the needs and expectations of interested parties Separate from b) in the 2022 edition, and separately auditable. New client security schedules, regulator expectations, new contractual obligations.
d) 1) Trends in nonconformities and corrective actions Counts and trends, not a list. Are findings rising or falling, and are they recurring in the same processes?
d) 2) Trends in monitoring and measurement results The clause 9.1 metrics over time. A single month’s figures is not a trend.
d) 3) Trends in audit results Internal audit findings this cycle against previous cycles, plus external audit results where applicable.
d) 4) Fulfilment of information security objectives Each objective from clause 6.2, its target, its actual, and what happens to the ones that were missed.
e) Feedback from interested parties Client security questionnaires, audit reports received from clients, complaints, regulator correspondence, supplier assurance.
f) Results of risk assessment and status of risk treatment plan Current risk profile, risks that changed level, new risks, and the treatment plan by completion status. See risk assessment and the SoA.
g) Opportunities for continual improvement Tabled as items for decision, not as a closing pleasantry.
Counting convention: clause 9.3.2 lists seven lettered items, but item d) has four numbered sub-items that are separately auditable, which is why practitioners speak of nine or ten inputs. Cover every lettered item and every sub-item of d) and the counting argument never arises.

An agenda that maps one-to-one onto the clause

The simplest way to never fail clause 9.3.2 is to stop writing agendas from scratch. Number your agenda items with the clause references. The minutes then demonstrate coverage without anyone having to argue for it, and the auditor’s check takes two minutes instead of twenty.

  • 1. Opening — attendance, confirming top management present, period under review.
  • 2. Status of previous actions — 9.3.2 a).
  • 3. Context and interested parties — 9.3.2 b) and c), including the climate-change relevance determination.
  • 4. Performance — 9.3.2 d) 1) to 4): nonconformity trends, measurement trends, audit results, objectives achievement.
  • 5. External feedback — 9.3.2 e).
  • 6. Risk and treatment status — 9.3.2 f).
  • 7. Improvement opportunities — 9.3.2 g).
  • 8. Decisions — 9.3.3: decisions on continual improvement and on any need for change to the ISMS, each with an owner and a date.
  • 9. Resources — what the decisions require, which is also evidence for clauses 5.1 and 7.1.

Attach the data pack to the minutes. A minute that says “performance was reviewed” without the numbers cannot demonstrate that the input was considered.

Clause 9.3.3 — a review that decided nothing produced no results

Clause 9.3.3 requires the results of the management review to include decisions related to continual improvement opportunities and any need for changes to the ISMS, and requires documented information to be available as evidence of those results.

The word doing the work is decisions. Discussion is not a result. “The team noted the increase in phishing attempts” is a note; “approved an additional simulated phishing cycle per quarter, owner: Head of IT, from Q1, funded from the security training budget” is a decision. Every decision needs an owner, a date and a resource position, because the next review has to report on its status under 9.3.2 a).

Minute reads Clause 9.3.3 satisfied? Why
“Management reviewed the ISMS and confirmed it remains suitable, adequate and effective.” No. A conclusion with no decisions attached. It also asserts effectiveness without showing the evidence considered.
“Nine attendees. Presentation delivered. No issues raised.” No. Records that a meeting occurred. Produces no results and evidences no consideration of the 9.3.2 inputs.
“Objective 3 (patch SLA) achieved 71 per cent against a 95 per cent target. Decision: SLA revised to 30 days for medium severity and a patch automation tool approved at PHP 480,000; owner CIO; review at Q3 review.” Yes. Input considered, gap identified, decision taken, owner and date assigned, resources committed. This one minute evidences 9.3.2 d) 4), 9.3.3, 10.1 and 7.1 simultaneously.

How clause 9.1 feeds both

Neither clause 9.2 nor clause 9.3 can function without clause 9.1, and this is the dependency most implementation plans miss. Clause 9.1 requires you to determine what needs to be monitored and measured including information security processes and controls, the methods to be used so that results are valid, when the monitoring and measurement is performed, who performs it, when results are analysed and evaluated, and who analyses and evaluates them. Documented information must be available as evidence of the results.

The methods have to be defined before the numbers are produced. Measuring something for six months and then deciding what it means is not what the clause describes, and the standard notes that the methods selected should produce comparable and reproducible results to be considered valid.

Metric Method defined in advance What it lets the management review decide
Percentage of critical patches applied within SLA Source system, severity definition, SLA in days, exclusions, monthly, owner: IT operations. Whether patching capacity or the SLA itself is wrong.
Access reviews completed on schedule Population of systems in scope, review frequency per system, evidence of completion, quarterly, owner: system owners. Whether the review frequency is realistic or theatrical.
Time to detect and time to contain incidents Incident categories, start and stop definitions, source of timestamps, per incident, owner: incident manager. Whether detective controls are working or incidents are only found when someone complains.
Awareness completion and phishing simulation failure rate Population including contractors and new joiners, deadline from hire date, simulation frequency, owner: HR with security. Whether awareness is reaching the floor, which is what clause 7.3 requires it to do.
Open corrective actions past due date Source: the nonconformity log; ageing bands; monthly; owner: ISMS manager. Whether clause 10.2 is functioning or accumulating debt.

Small teams, outsourced auditors and the Philippine reality

Most of the organisations we certify in the Philippines do not have an internal audit department. That is not an obstacle to conformity; it is a design constraint with known solutions.

Constraint What actually works
No independent internal auditor available Contract an external internal auditor, or train two people in different functions to audit each other’s areas. Retain clause 7.2 competence evidence for whoever you use. What does not work is the ISMS manager auditing the ISMS.
Group-level shared services A regional or group internal audit function can run the audit provided the auditors are independent of the audited area and their competence is evidenced. The results still have to be reported to local relevant management.
Top management travelling or offshore A management review may be held remotely and may be split across sessions, provided all clause 9.3.2 inputs are covered and decisions are recorded. What fails is delegating the review itself to someone who is not top management for the ISMS scope.
BPO shift patterns Schedule audit interviews across shifts. Auditing only the day shift leaves half your control population untested, and a Stage 2 auditor will ask for night shift specifically.
Multi-site operations Every site in scope has to be covered by the internal audit programme, whether or not the certification body samples sites for its own audit. Their sampling decision does not reduce your clause 9.2 obligation.
Data Privacy Act obligations running in parallel Privacy compliance under the DPA is audited by a different authority against different requirements. Combining the audits is efficient; conflating the requirements is not. Keep the criteria distinct in the audit plan.

Eight ways these two clauses fail at Stage 2

In rough order of how often we see them in this market.

  • The internal audit has not happened. Normally a major nonconformity against clause 9.2, and it cannot be remediated on the day.
  • Zero findings. Reads as either a superficial audit or suppressed findings, and changes how deeply everything else is sampled.
  • The ISMS manager audited their own ISMS. Visible from the org chart in the first hour, and fails clause 9.2.2 b).
  • Management review minutes with no decisions. Fails clause 9.3.3, which requires the results of the review.
  • Missing 9.3.2 inputs. Usually c) changes in interested party needs, d) 2) measurement trends, or e) external feedback — the ones that require data to be prepared.
  • Top management absent. A review chaired by the quality or IT manager fails clause 9.3.1 on the attendance list.
  • Corrective actions closed the day they were raised. Fails the effectiveness review clause 10.2 d) requires, because effectiveness cannot be demonstrated instantly.
  • No relationship between this year’s programme and last year’s findings. Fails the requirement in clause 9.2.2 to consider the results of previous audits.
Every item on that list is preventable at zero technical cost. They are scheduling and discipline failures, not capability failures — which is why they are the most irritating nonconformities in the standard to receive.

Sterling Academy · e-learning for your people

Training that stands up in your ISO 27001 audit

Sterling consulting clients benefit from preferential course access and special pricing on Sterling Academy through their Sterling consultant, including complimentary ISO 27001 awareness training for your people as part of your engagement. Your consultant sets up your client administrator, you add your people, and every learner who completes a course and its final exam receives a numbered Certificate of Completion, verifiable online.

Completion records and certificates are your evidence for ISO/IEC 27001:2022 clauses 7.2 (competence) and 7.3 (awareness) and for Annex A control 6.3, information security awareness, education and training — the items a certification auditor tests by interviewing your staff.

Courses for an information security management system

End to end with Sterling: your ISO 27001 engagement includes

  • Implementation consulting through Design™ (guided) or Drive™ (fully managed), up to the certification audit
  • Sterling Academy e-learning for your people: preferential course access and special pricing, with complimentary ISO 27001 awareness training
  • Live internal auditor training for your audit team
  • Effivity ISMS software subscription
  • Vulnerability assessment by Cyber Vantage 360
  • Sustain™ post-certification support: internal audits, management reviews and surveillance preparation

List price from US$19 per learner per course (51–200 learners) · 12 months’ access · final exam included

Contact usSee the course on Sterling AcademyWatch the sample video →

Certificate of Completion issued after the final exam, numbered and verifiable online · Sterling consultant, client administrator and learner roles as on Sterling Academy

Internal audit and management review: frequently asked questions

1. Is an internal audit mandatory before the Stage 2 audit?
Yes, and there is no exemption for a first certification. Clause 9.2 of ISO/IEC 27001:2022 requires internal audits at planned intervals covering conformity to your own ISMS requirements, conformity to the standard, and effective implementation and maintenance. Arriving at Stage 2 without a completed internal audit is normally a major nonconformity, which means no certification recommendation until it is corrected and verified.

2. Can our ISMS manager conduct the internal audit?
Not of the ISMS they manage. Clause 9.2.2 b) requires the selection of auditors and the conduct of audits to ensure objectivity and the impartiality of the audit process, and an auditor evaluating their own design decisions cannot satisfy it. They can manage the audit programme and be audited by someone else. In small organisations the workable options are cross-functional peer auditing with evidenced competence, or a contracted external internal auditor.

3. Does ISO 27001 say auditors must not audit their own work?
Not in those words, and the distinction is worth knowing. Clause 9.2.2 b) of ISO/IEC 27001:2022 requires objectivity and the impartiality of the audit process. The phrase “auditors shall not audit their own work” comes from older ISO 9001 editions and from ISO 19011 guidance. Auditing your own work is the standard way of failing the impartiality requirement, but the requirement is a property of the audit process, which matters when you are designing an audit programme in a small team.

4. How often must internal audits be conducted?
ISO/IEC 27001:2022 does not set a frequency. Clause 9.2.1 requires audits at planned intervals, and clause 9.2.2 requires the programme to consider the importance of the processes concerned and the results of previous audits. In practice the whole ISMS must be covered before initial certification, and thereafter most organisations run an annual programme with more frequent audits of higher-risk or previously non-conforming areas.

5. Who has to attend the management review?
Top management — the person or group that directs and controls the organisation at the highest level within the ISMS scope. Clause 9.3.1 places the obligation on them, not on the ISMS manager acting on their behalf. A review chaired by the IT or quality manager with top management copied on the minutes does not satisfy the clause, and the attendance list is on the first page a Stage 2 auditor reads.

6. What must a management review cover?
Everything clause 9.3.2 lists: the status of actions from previous reviews; changes in external and internal issues; changes in the needs and expectations of interested parties; feedback on information security performance including trends in nonconformities and corrective actions, monitoring and measurement results, audit results and fulfilment of objectives; feedback from interested parties; the results of risk assessment and the status of the risk treatment plan; and opportunities for continual improvement. Number your agenda with the clause references and coverage becomes self-evident.

7. How often is a management review required?
The standard requires it at planned intervals and does not specify a number. Annual is the minimum most organisations can defend, and quarterly is common where the risk profile or client base is demanding. What does not survive Stage 2 is a single review held shortly before the audit with no evidence of a planned interval and nothing scheduled afterwards.

8. What is the difference between a correction and a corrective action?
A correction fixes the instance; a corrective action removes the cause so it does not recur or occur elsewhere. Clause 10.2 requires both, plus a determination of whether similar nonconformities exist elsewhere, a review of the effectiveness of the action taken, and changes to the ISMS where necessary. Recording “staff were reminded” and closing the action on the same day satisfies neither the cause requirement nor the effectiveness review.

9. Can we outsource our internal audit?
Yes, and for small teams it is often the only way to achieve genuine impartiality. It remains your internal audit: you own the programme, the findings and the corrective actions, and clause 9.2.2 still requires the results to be reported to relevant management. The one supplier you cannot use is your own certification body, because under ISO/IEC 17021-1:2015 a certification body may not provide internal audits or management system consultancy to an organisation it certifies.

10. Is zero findings a good internal audit result?
No. In a first-year ISMS it is a warning sign, and experienced Stage 2 auditors treat it as one. Every management system implemented for the first time has gaps between what the documents promise and what the records show. A clean report suggests either that the audit did not sample deeply enough or that findings were negotiated away, and either conclusion leads the certification body to sample your controls more aggressively.

Get an internal audit that finds things before the auditor does

Sterling runs contracted internal audits for organisations that cannot achieve impartiality in-house, and trains internal auditors for those that can. Either way you get findings written the way a certification body writes them, with root cause analysis your management review can actually act on — which is the point of the exercise.

Talk to a Sterling ISO 27001 consultant

11. Is training included with Sterling’s ISO 27001 consulting?
Every Sterling engagement includes live internal auditor training for your audit team and preferential access to Sterling Academy, with complimentary ISO 27001 awareness training for your people as part of the engagement. Special pricing applies to the wider catalogue — Information Security Essentials, 93 Annex A Controls (ISO/IEC 27002:2022) and Risk Management — through your Sterling consultant. Learners who complete a course and its final exam receive a numbered Certificate of Completion, verifiable online, and the completion records serve as evidence for clauses 7.2 and 7.3 and Annex A control 6.3.

Where to go next

Written and maintained by the ISO 27001 practice at Sterling International Consulting, Philippines. All clause and control references are to ISO/IEC 27001:2022 including Amendment 1:2024. Last updated: 1 August 2026.