The internal audit readiness checklist

Thirty-nine plain-English checks that tell you whether your internal audit programme would satisfy Clause 9.2 of ISO 27001, ISO 42001 or ISO 22301, and survive the certification body's scrutiny. Written by Lead Auditor trained practitioners.

Eight sections Programme, independence, planning, evidence, findings, corrective action, management review and the external auditor's view.
Standard-agnostic Clause 9.2 works the same way across ISO 27001, ISO 42001 and ISO 22301; the checklist covers all three.
Honest about independence Including when the right answer is that your team is too small to audit itself.

Tick items off as you go: your progress saves automatically and helps us tailor any follow-up conversation. Anything you cannot tick is worth that conversation.

1. The audit programme

Clause 9.2 asks for a programme, not an event. External auditors read the programme first.

A documented internal audit programme exists and covers every requirement of your standard across the certification cycle, including the Annex A controls for ISO 27001.
Frequency, methods and responsibilities are defined, and one named person owns the programme.
The programme is risk-based: more attention where things changed, failed before or matter most.
Audits are scheduled to leave time for fixing findings before the external audit arrives.
The programme itself is reviewed: is the cycle genuinely covering the standard?

2. Independence and competence

An organisation cannot mark its own homework. This is where small-company programmes most often fail.

No auditor audits work they built, own or operate day to day.
Auditor competence is defined and evidenced: training, qualifications or demonstrable experience.
If your team is too small to audit itself with real independence, you have considered outsourcing the internal audit or a reciprocal arrangement, rather than pretending.
Conflicts of interest are declared and recorded before each audit.
Whoever audits can explain the standard's requirements in their own words, not just read them aloud.

3. Scope, criteria and planning

Each audit needs its own definition of done before fieldwork starts.

Each audit has a documented scope, criteria and method agreed before fieldwork.
The audit plan is organised by subject matter, and the auditee puts the right people in the room for each subject.
Previous findings and their corrective actions are reviewed at the start of every audit.
Working papers or checklists exist, so the audit is repeatable by someone else.
Interviewees know in advance what the audit covers and how long it needs them.

4. Evidence and fieldwork

A finding you cannot trace to evidence will not survive scrutiny, yours or anyone else's.

Every finding traces to a specific record, statement or observation that can be cited.
Sampling is recorded: what was sampled, how much and how it was selected.
Interviews test what actually happens, not whether people can recite the policy.
Claims are verified against documents and systems rather than accepted as testimony alone.
Notes are kept in a form the auditor could defend a year later.

5. Findings and reporting

Consistent classification is what separates an audit from a list of opinions.

Findings are classified consistently, with written definitions for nonconformity and opportunity for improvement.
Every nonconformity cites the requirement it is raised against.
The report is dated, distributed and retained as documented information.
Nothing in the report is a surprise: findings were discussed during fieldwork, not revealed afterwards.
Positive findings are recorded too, because an audit that only hunts faults teaches the organisation to hide things.

6. Corrective action and follow-through

The most common external audit finding about internal audit: closures without root cause.

Each nonconformity gets a correction, a root cause analysis and a corrective action, with dates and owners.
Closure is verified with evidence, and effectiveness is checked again later, not just at closure.
No finding is closed on a promise.
Trends across audits are analysed, because three small findings in one area usually point at one bigger cause.
Actions from previous audits are actually done, and you can show it.

7. Feeding management review

Internal audit results are a mandatory management review input. The loop has to visibly close.

Internal audit results are a standing input to management review, minuted with decisions.
The programme's resourcing is genuinely allocated, not assumed.
Management sees trends and repeat findings, not just a count.
Decisions from review visibly change the next audit programme.

8. What the external auditor will check

When the certification body examines your internal audit, this is the short list.

The programme demonstrably covers all clauses and the applicable control set within the cycle.
Independence is demonstrable for every audit performed.
Reports exist and contain real findings. A stream of flawless internal audits reads as a weak audit, not a strong system.
Corrective actions are closed with evidence and checked for effectiveness.
If internal audit is outsourced, the contract, the auditor's competence records and the reports are all available.

What to do with the gaps

If several of these are unticked, your internal audit programme is the finding. This is exactly the work we do: independent internal audits under Clause 9.2 for ISO 27001, ISO 42001 and ISO 22301, delivered at a fixed fee agreed at scoping. Request an audit or read about the internal audit service.