ISO 27001 Internal Audit Plan

Description

The Ultimate ISO 27001 Internal Audit Plan Template

Is Your Internal Audit Just a Box-Ticking Exercise?

Your ISO 27001 internal audit is your most powerful tool for checking the health and effectiveness of your ISMS. But are you just randomly checking controls and hoping for the best? A haphazard audit approach leads to missed non-conformities, wasted effort, and a lack of confidence from your certification body. To be effective and compliant, your audits must be systematic and meticulously planned.

Our ISO 27001 Internal Audit Plan Template provides the professional framework you need to schedule, scope, and execute your entire internal audit program. It helps you create both a high-level annual audit schedule to ensure every part of your ISMS is covered, and detailed individual audit plans for each specific engagement. This ensures your audits are consistent, thorough, and add genuine value.

From the Experts at ISO 27001 Pro

From the experts at ISO 27001 Pro, this template is designed by certified lead auditors who know exactly what certification bodies look for in an internal audit program. This plan provides the structure and detail required to demonstrate that your internal audits are impartial, competent, and based on a risk-informed strategy, transforming them from a chore into a powerful tool for improvement.

In-Depth ISO 27001 Compliance Breakdown

This template is your direct response to the mandatory requirements of ISO 27001 Clause 9.2 (Internal audit). It provides the necessary documentation to prove to an external auditor that you have a fully compliant audit program.

• Plan, establish, and maintain an audit programme (9.2.a): The template includes an annual audit programme schedule, allowing you to plan your audits based on the risk and importance of different processes, ensuring full coverage of your ISMS over time.
• Define audit criteria and scope for each audit (9.2.b): For each individual audit, the template provides a detailed plan to clearly define the objectives, the specific ISO 27001 clauses and controls being audited, the departments involved, the agenda, and the methods to be used.
• Ensure objectivity and impartiality of the audit process (9.2.e): The plan includes dedicated sections to formally assign auditors and document their independence from the area being audited. This is a key requirement to prove the integrity of your findings.
• Retain documented information as evidence (9.2.g): This completed plan and your subsequent audit reports become the essential records (documented information) that prove your audit program has been planned and executed systematically, as required by the standard.

FAQ: Common Questions about ISO 27001 Internal Audits

• What’s the difference between an ‘audit plan’ and an ‘audit programme’? The audit programme is the high-level overview or schedule for all your audits over a period (e.g., one year), showing what processes will be audited and when. The audit plan is the detailed, day-to-day agenda for a single audit within that programme, outlining its specific scope, objectives, and criteria. Our template pack provides layouts for both.
• How often do we need to conduct internal audits? ISO 27001 requires you to conduct internal audits at ‘planned intervals’. For most organizations seeking certification, this means auditing the entire ISMS at least once a year. High-risk areas, such as incident management or access control, might be audited more frequently (e.g., every six months). Our programme template helps you schedule this based on risk.
• Can we audit ourselves, or do we need to hire an external consultant? You can use your own internal staff to conduct audits, but the standard has two key requirements: they must be competent (understand auditing and ISO 27001) and impartial (they cannot audit their own work). For example, the Head of IT cannot be the lead auditor for the IT department’s controls. This plan helps you document your selection of auditors to prove their impartiality.
• What are the ‘audit criteria’ we are supposed to audit against? The audit criteria are the rules you are checking for compliance against. This template helps you define this for each audit. The criteria are typically: 1) The requirements of the ISO 27001 standard itself, and 2) Your own organization’s documented policies, procedures, and requirements for your ISMS. In short, you are checking if you are doing what you say you are doing.