ISO 27001 internal audit

Clause 9.2 makes an internal audit mandatory before certification and every year afterwards. The constraint that catches small Canadian companies is not the work, it is that whoever built the management system is not allowed to audit it.

Last reviewed 2026-08-31Written by Jacob Masse, TrazTech Inc.

An outsourced ISO 27001 internal audit costs $6,000 to $15,000 CAD a year in Canada, takes three to eight days of elapsed effort, and has to be complete before a certification body will run stage 2. Clause 9.2 requires it at planned intervals, requires the auditors to be objective and impartial, and requires the results to be reported to management. It is not a rehearsal for the real audit. It is a required part of the management system, it recurs every year for as long as you hold the certificate, and it is the line most first-time budgets leave out.

Who is allowed to run it

Clause 9.2.2 c) says the auditors must be selected to ensure objectivity and impartiality of the audit process, and adds that auditors shall not audit their own work. That single sentence is what makes this a purchase for most Canadian companies under about a hundred people, because the person who wrote the policies, built the risk register and configured the controls is usually the only person who understands them.

The third row is the one to think hardest about. Using your implementation consultant is cheaper and it is the option most likely to produce an internal audit report with no nonconformities, which is itself a finding at stage 2. If budget forces it, at least have a different person from that firm run it, and expect to defend the arrangement.

What it has to cover

The whole management system, not a sample of the controls you feel good about. That means clauses 4 through 10 as well as the Annex A controls you declared applicable in your Statement of Applicability. The clause half is where first audits find the most, because the technical controls tend to exist and the management practices tend not to.

Clause coverage

Context and interested parties, leadership and policy, risk assessment and treatment, objectives, competence and awareness, documented information, operational planning, monitoring, previous audits and management review, nonconformity and corrective action.

Annex A coverage

Every control marked applicable, tested against evidence rather than against the policy that says it happens.

Audit program

Clause 9.2.2 asks for a planned program covering frequency, methods, responsibilities and reporting. One document, reviewed annually, and the thing auditors ask for before they ask for the report.

Records

The plan, the evidence sampled, the findings, and proof the results reached management. The report on its own is not enough.

You do not have to cover everything in one pass. A program that audits the whole system across three visits a year is acceptable and often better, provided the program is written down and the full system is covered within the cycle. What is not acceptable is a single two-hour meeting that produces a clean report.

Where it sits in the project

After the management system has been running long enough to have records, and before stage 2. Both halves of that matter. Audit too early and there is nothing to sample, so the report is about documents rather than practice. Audit too late and the nonconformities you find have to be closed while the certification body is waiting, which is the version that costs six weeks.

1. Run the system for at least three months so access reviews, supplier reviews, incidents, backups and training have produced records.
2. Book the internal auditor. Independent auditors are scheduled weeks out, and this is the step that slips.
3. Run the internal audit and log the findings honestly, including the uncomfortable ones.
4. Raise corrective actions with owners and dates, and close what you can before stage 1.
5. Hold the management review, which takes the internal audit results as a required input.
6. Go to stage 1 with the report, the corrective actions and the review minutes in hand.

What the report has to produce

A findings list, classified. Major nonconformity where a requirement is entirely absent or a failure is systemic, minor where a requirement is met inconsistently, and observation or opportunity for improvement where nothing is broken yet. Each finding needs the requirement it fails against, the evidence, an owner and a date. Corrective action under clause 10.2 asks for more than a fix: it asks what caused it and whether the same cause exists elsewhere.

That root cause step is the one companies skip, and surveillance auditors check it specifically, because a corrective action log full of one-line fixes tells them the improvement process is cosmetic. What happens to all of this in years two and three is on surveillance audits.

Budgeting for it properly

Price it as a recurring annual cost from year one, alongside the surveillance audit and the penetration test. On a three-year view an outsourced internal audit adds $18,000 to $45,000 CAD, which is a material share of the total on the cost page and is routinely missed. If nobody internally owns the management system between audits, a fractional CISO can hold that ownership, but the same person then cannot be your internal auditor, which is the trade to think through before you sign either contract.

Common questions