An audit date is not yet an audit programme

Ask about the internal audit and you often get a date. Usually it falls in autumn, a few weeks before the surveillance audit, and it was carried out by the person who also runs the ISMS. The report is tidy, the nonconformities are minor.

That is an audit. It is not yet an audit programme.

What clause 9.2 requires

In clause 9.2, ISO/IEC 27001 distinguishes between the individual audit and the programme that carries the audits. In substance, the standard requires:

• Planned intervals: internal audits take place at planned intervals and provide information on whether the ISMS conforms to the organisation's own requirements and the standard, and whether it is effectively implemented.
• A programme with content: frequency, methods, responsibilities, planning requirements and reporting are defined.
• Weighting: the programme takes into account the importance of the processes concerned and the results of previous audits.
• Criteria and scope per audit: each audit has defined audit criteria and a scope.
• Objectivity: auditors are selected and audits conducted so that objectivity and impartiality are ensured.
• Reporting and evidence: results go to relevant management, and the programme and results are retained as documented information.

The text of the standard is protected by copyright, so this is in substance only. The third point is the decisive one: the programme is not a calendar but a weighing.

Where a date is not enough

The same interval for everything. An annual audit that brushes the same clauses every year treats access management like the upkeep of document templates. A process with a major nonconformity last year belongs back on the plan earlier and deeper than one without findings. That is exactly what "taking into account the results of previous audits" means.

No scope, no criteria. "Internal audit ISMS" is not a scope. Which sites, which processes, against which requirements: without that definition, nobody can say afterwards what was audited and what was not. In practice, certification bodies also expect the entire scope to be covered once over the certification cycle.

The ISMS audits itself. Whoever built the ISMS is auditing their own work. In small organisations this is hard to avoid and still the most common weak point. The standard does not require an external audit, but it does require impartiality. Workable approaches: colleagues from other areas audit crosswise, the audit of one's own core processes is given to an external party, or the plan records who does not audit which area.

Findings with no way back. An audit does not end with the report. Whether the corrective action worked is only decided in the follow-up, and its result is the basis for the next programme.

The programme before the year

A robust programme is created before the audit year, not after it. It lists the planned audits with scope, criteria, auditor and the reasoning behind the weighting, and it is approved by management. If something changes along the way, for example due to an incident or a new requirement, the programme is updated and the previous version remains traceable.

How isidaten represents this

In Audit Management, the audit plan is an object of its own per year or period. Each entry carries scope, process or organisational unit, lead auditor, risk classification and priority. The plan is approved through an approval workflow and sealed from the moment approval is requested. A new revision is possible, and the previously approved version is kept as evidence. An entry turns into the audit with the template's audit steps, and it can only be completed after approval has been granted and under the four-eyes principle: whoever approves does not complete it themselves. Findings carry category, reference to the standard, responsible person and deadline, can be linked to measures and the risk register, and only count as done after verification. Which auditor is objective is still decided by the planning, not by the system.

The check question

Which process sits earlier in your next audit programme than in the last one, and why?

If there is none, the programme is probably a copy of last year's. How the internal audit relates to the other clauses of the standard is covered in The standard does not start at Annex A.

Sources

ISO/IEC 27001:2022, clauses 9.2.1 and 9.2.2 (in substance, text of the standard protected by copyright). Guidelines for auditing management systems: ISO 19011:2018.