ISO 27001 Internal Audits and Continual Improvement

Why internal audits are the backbone of a living ISMS

An ISO 27001 certification is not a trophy — it is a commitment to continual improvement. Clauses 9 and 10 require organisations to evaluate the ISMS, address nonconformities and improve it. Weak internal-audit coverage can allow control failures to persist until a certification or surveillance audit identifies them, increasing remediation effort and certification risk.

The Privacy Act 1988 (OAIC — Privacy Act 1988 and Australian Privacy Principles, accessed 3 November 2026) adds a parallel obligation: Australian Privacy Principle 11 requires organisations to take reasonable steps to protect personal information. A documented internal audit programme can help demonstrate that controls are reviewed and improved. Essential Eight assessments use evidence to determine whether each maturity requirement is met, which can support a similar review discipline without replacing an ISO 27001 audit.

This guide covers every stage of the internal audit lifecycle — from designing your annual programme to preparing for external surveillance — so that your ISMS remains genuinely effective, not merely certified on paper.

1. Designing an annual internal audit programme

ISO 27001:2022 Clause 9.2.1 requires that the audit programme consider the importance of the processes concerned and the results of previous audits. A practical approach is to treat the 3-year certification cycle as a planning horizon, cover the applicable ISMS clauses and Annex A controls across that period, and revisit higher-risk areas more frequently. The audit programme must still reflect the organisation's own risks, process importance and prior results.

Practical programme structure for Australian organisations:

• Quarter 1: Audit governance and leadership controls (Clauses 4, 5, 6) and Annex A organisational controls (A.5, A.6)
• Quarter 2: Audit operational controls (Clause 8) and applicable Annex A.8 technological controls
• Quarter 3: Audit supplier controls (A.5.19–A.5.23), incident management controls (A.5.24–A.5.28), and applicable Annex A.7 physical controls
• Quarter 4: Audit performance evaluation and improvement (Clauses 9, 10) and prepare management review inputs

Document the scope, objectives, criteria, auditor assignments and schedule for each audit. Reference the applicable ISO 27001 clause, control or internal requirement in the audit criteria so findings map to the requirement being tested.

2. Audit scope and sampling methodology

The audit scope should align with the certified ISMS scope document. Review processes, locations and systems added since the previous audit so the programme does not overlook material changes to the operating environment.

Sampling methodology principles:

• Risk-based sampling: Allocate more sample size to high-risk processes (e.g., privileged access management, data classification) than to low-risk administrative controls
• Statistical sufficiency: For larger populations (e.g., user access reviews), select a sample size sufficient to give reasonable confidence in the result rather than testing only a token number of items
• Stratified sampling: Separate populations by risk category before sampling — do not mix administrator accounts with standard user accounts in a single sample
• Carry-forward items: Always include a sample from previously raised nonconformities to verify corrective action effectiveness

The ACSC Essential Eight Assessment Process Guide (ACSC — Essential Eight Assessment Process Guide, accessed 16 June 2026) recommends a similar evidence-based sampling approach when assessing maturity, and Australian organisations certified to ISO 27001 can align their internal audit sampling with ACSC assessment cycles to reduce duplicated effort.

3. Interviewing staff and reviewing evidence

Auditors gather evidence through three primary methods: interviews, observation, and document review. ISO/IEC 19011:2018 (Guidelines for Auditing Management Systems) provides authoritative guidance on each method, and the ISACA CISA certification programme embeds these techniques in its audit competency framework.

Interview best practice:

• Prepare open-ended questions aligned to clause requirements before entering the audit — for example, "Walk me through how you handle an access request for a new contractor" rather than "Do you have an access control process?"
• Interview process owners, not just security staff — Clause 7.3 (Awareness) requires that all relevant personnel understand the ISMS; testing this with frontline staff is essential
• Record responses as factual observations, not conclusions — note what was said and cross-reference with documentary evidence before raising a finding

Evidence review checklist:

• Policies carry version numbers, review dates, and approvals within the last 12 months
• Risk register entries link to treatment decisions and residual risk acceptance
• Access review records show who performed the review, when, and what remediation resulted from anomalies
• Incident logs demonstrate the full lifecycle from detection to closure, with lessons learned documented against A.5.24–A.5.28

4. Writing nonconformity reports

A nonconformity report (NCR) is a formal record of a failure to meet an ISO 27001 requirement. Per ISO 27001:2022 Clause 10.1, the organisation must react to nonconformities, take corrective action, and retain documented information as evidence.

Recommended NCR fields:

• Reference number and date
• Audit area and process owner
• Requirement: The specific ISO 27001 clause or Annex A control not met
• Observation: Objective evidence describing what was found (factual, not interpretive)
• Classification: Major or minor, per ISO/IEC 17021-1 definitions
• Proposed correction: Immediate fix to address the symptom
• Corrective action due date: Agreed with process owner at time of audit

Certification bodies require organisations to analyse the cause of major nonconformities, implement corrective action and provide evidence before a certification decision can be finalised. During surveillance, unresolved major findings can place certification at risk; the exact process and deadlines are set by the certification body.

5. Root cause analysis techniques

Root cause analysis (RCA) helps prevent recurrence by addressing the system failure behind a nonconformity, not just its visible symptom. Common techniques include the Five Whys, Fishbone (Ishikawa) Diagram and Fault Tree Analysis; select a method proportionate to the finding.

Five Whys — worked example:

• Nonconformity: User access review was not completed within the required 90-day cycle.
• Why 1: The IT team was not aware the review was due. Why? The calendar reminder was not set when the review was last completed.
• Why 2: The process for scheduling the next review is not documented. Why? The procedure was never updated after the last team restructure.
• Why 3: There is no owner assigned to maintain the access review procedure. Why? The RACI matrix for ISMS processes was not updated when staff changed roles.
• Root cause: ISMS process ownership records are not maintained as living documents and are not reviewed as part of onboarding or offboarding.

The corrective action must address the root cause — in this case, updating the RACI matrix and embedding a procedure review trigger into the HR offboarding checklist — not merely setting a new calendar reminder.

6. Corrective action plans

A corrective action plan (CAP) is the documented response to a nonconformity. ISO 27001:2022 Clause 10.1(e) requires the organisation to implement corrective actions and evaluate their effectiveness.

CAP minimum fields:

• Root cause statement (from RCA)
• Corrective action description: Specific, measurable steps with named owners
• Target completion date: Realistic and proportionate to risk and the certification body's response requirements
• Verification method: How the auditor will confirm the action was effective (re-test, document review, observation)
• Status: Open, In Progress, Closed, or Verified

Australian organisations should maintain a CAP register that feeds directly into management review inputs. Security-control deficiencies tracked for ISM or Essential Eight work can use the same ownership, due-date and verification discipline, while retaining the evidence required for each framework.

7. Management review meetings under Clause 9.3

ISO 27001:2022 Clause 9.3 requires top management to review the ISMS at planned intervals. The organisation should identify who constitutes top management for the ISMS scope and retain evidence of their participation, decisions and assigned actions.

Mandatory agenda inputs per Clause 9.3.2:

• Status of actions from previous management reviews
• Changes in external and internal issues relevant to the ISMS
• Information security performance: nonconformities, monitoring results, audit findings, objective achievement
• Feedback from interested parties (customers, regulators, suppliers)
• Results of risk assessment and status of risk treatment plan
• Adequacy of resources
• Opportunities for improvement

Required outputs per Clause 9.3.3:

• Decisions on improvement opportunities
• Resource requirements
• Any changes needed to the ISMS

Management review minutes provide evidence that top management considered the required Clause 9.3 inputs and outputs. Retain them according to the organisation's documented retention policy and make them available to certification auditors where they fall within the audit scope.

8. Continual improvement cycles and the Plan-Do-Check-Act model

ISO 27001 is built on the Plan-Do-Check-Act (PDCA) model introduced by W. Edwards Deming and formalised in ISO's High Level Structure. Every internal audit feeds the Check phase; every corrective action feeds the Act phase; the updated risk register and revised controls feed the next Plan phase.

PDCA applied to ISMS operations:

• Plan: Update risk register, revise risk treatment plan, set ISMS objectives and KPIs for the coming period
• Do: Implement controls, deliver security awareness training, execute supplier audits
• Check: Run internal audits, monitor metrics, conduct management review
• Act: Close nonconformities, implement improvements, update procedures and policies

Organisations that also use COBIT 2019 can maintain a documented crosswalk between relevant governance and management objectives and their ISO 27001 processes. Treat the frameworks as complementary rather than claiming one-to-one compliance.

9. Preparing for external surveillance audits

ISO 27001 certification normally operates on a three-year cycle with periodic surveillance audits. Surveillance samples the ISMS rather than repeating the complete certification audit, commonly examining internal-audit effectiveness, corrective actions, management-review records and significant scope or environment changes.

Surveillance readiness checklist:

• Internal audit programme for the past 12 months is fully documented with findings and closure evidence
• All major nonconformities from the previous audit cycle are closed and verified
• Management review minutes from the past 12 months are on file with documented outputs
• Risk register has been reviewed and updated within the past 6 months
• Statement of Applicability reflects current controls and any scope changes
• Staff awareness training records are current (within the last 12 months)
• Incident log demonstrates the full detection-to-closure lifecycle for any incidents in the period

For Australian government contractors, ISM-0041 requires each system to have a system security plan covering the system, its boundary, management and applicable controls. The current ISM control does not prescribe an annual review interval; organisations should set and document a risk-based review cadence. Aligning that review with ISO 27001 management review can reduce duplicated evidence collection.

10. Common reasons organisations lose ISO 27001 certification

Recurring conditions that place certification at risk include:

• Unclosed corrective actions: Organisations raise NCRs but fail to implement, verify, or document closure within agreed timeframes
• No management review records: Meetings occur informally but are not minuted with the mandatory inputs and outputs per Clause 9.3
• Scope drift: Cloud services, new office locations, or outsourced functions added without updating the ISMS scope or Statement of Applicability
• Insufficient internal audit coverage: Entire Annex A control domains go unaudited for multiple years without documented rationale

Loss or suspension of certification can affect contracts that require a current certificate and can create regulatory or customer scrutiny. The consequence depends on the organisation's contractual and regulatory context.

11. Alignment with the Privacy Act 1988 and ACSC Essential Eight

Australian organisations do not operate ISO 27001 in isolation. The Privacy Act 1988 Australian Privacy Principle 11 (APP 11) requires reasonable steps to protect personal information from misuse, interference, loss and unauthorised access. A documented internal audit programme can contribute evidence that security controls are reviewed and improved, alongside the organisation's other APP 11 measures.

The ACSC Essential Eight aligns with ISO 27001 at multiple points:

• Patch management (E8 Controls 2 and 6): Maps to the Annex A technical vulnerability management controls, audited under operations security
• Multi-factor authentication (E8 Control 7): Maps to the Annex A access control requirements, audited under access control
• Daily backups (E8 Control 8): Maps to the Annex A information backup control, audited under operations security

The Essential Eight and ISO 27001 Annex A overlap in several technical areas, but neither framework demonstrates compliance with the other. Organisations should maintain an explicit crosswalk and retain evidence against each applicable requirement.

Call to action

An internal audit programme is not a compliance formality — it is a mechanism for keeping the ISMS aligned with changing threats, risks and operations. Treat findings as improvement inputs, track corrective actions to closure and verify that the changes operate as intended.

Next steps: If your organisation has not yet mapped its internal audit schedule to its ISMS scope and applicable requirements, start with a gap assessment. Use the findings to build a risk-based audit programme, assign clear ownership for corrective actions, and schedule the next management review with documented top-management participation.

Sources referenced in this article: OAIC Privacy Act 1988 and Australian Privacy Principles, ASD Information Security Manual (ISM), ACSC Essential Eight Maturity Model, ACSC Essential Eight Assessment Process Guide, ISO 27001:2022, ISO/IEC 17021-1, ISO/IEC 19011:2018, COBIT 2019, and the Plan-Do-Check-Act model.