ISO 27001 internal audit and management review: what clauses 9.2 and 9.3 require, how often, and what auditors check

ISO 27001 requires internal audits (clause 9.2) and a management review (clause 9.3), both at planned intervals that you set yourself. The standard names no frequency. In practice both run at least once a year, because Stage 2 and every annual surveillance audit examine them. Internal audits need a written programme and objective auditors. The review has seven mandatory inputs.

This guide covers the clauses, audit frequency, auditor independence, review inputs and frequency, an agenda template, common findings, scheduling, and what a paper audit misses.

	Internal audit (9.2)	Management review (9.3)
Purpose	Does the ISMS conform, and does it work?	Is the ISMS still suitable, adequate and effective?
Who	Objective, impartial auditors	Top management
Frequency	Planned intervals; in practice at least yearly	Planned intervals; in practice at least yearly
Typical finding	Audits run, no programme behind them	Minutes that skip mandatory inputs

Which ISO 27001 clause requires internal audits and management reviews?

Clause 9, Performance evaluation. It has three parts:

• 9.1 Monitoring, measurement, analysis and evaluation: what you measure and who evaluates it.
• 9.2 Internal audit: 9.2.1 General and 9.2.2 Internal audit programme.
• 9.3 Management review: 9.3.1 General, 9.3.2 Management review inputs and 9.3.3 Management review results.

Clause 10.2, Nonconformity and corrective action, closes the loop: fix what the audit finds, deal with the cause, check the fix worked.

Project plans often show these as two single-day tasks near the end. They are systems that must already be running when the certification body examines them at Stage 2, and a common reason that audit slips. Both are cheap to do properly and expensive to do late.

What does clause 9.2 require?

People remember “planned intervals”. What catches projects out is the rest: clause 9.2 asks for a programme, not an audit. In paraphrase:

1. A defined purpose. Audits show whether the ISMS meets your own requirements and the standard’s, and whether it is effectively implemented and maintained.
2. An audit programme. Frequency, methods, responsibilities, planning and reporting, weighted by how important each process is and what earlier audits found. Auditors ask for this first.
3. Criteria and scope for each audit. What is examined, against what, for which systems and period.
4. Objective auditors. Auditors selected, and audits run, so the process is objective and impartial.
5. Reporting to relevant management. Results reach people who can act, and feed the management review.
6. Documented information. Evidence that the programme ran, and the audit results.

Three audit reports with no programme behind them is a nonconformity. Auditor competence sits in clause 7.2, not 9.2: in practice, knowledge of the standard, of auditing and of the technology in scope, on record.

How often must internal audits be done for ISO 27001?

The standard does not say. Your programme sets the intervals, and nothing requires auditing the whole ISMS every twelve months.

Certification rules set the practical minimum. Under ISO/IEC 17021-1, Stage 2 covers internal auditing, so an internal audit, in practice a full-scope one, must run before certification. Surveillance audits follow at least once a calendar year, each reviewing internal audits and management review. A skipped year shows up at the next visit.

A sensible approach is a rolling programme: the whole ISMS covered across the three-year cycle, higher-risk areas and earlier findings audited more often. Expect the auditor to ask for the reason if any part goes unaudited for the whole cycle. Many small companies run one full audit a year; faster-changing ones audit in quarterly slices. How this plays out after certification is in surveillance audits in years two and three.

Can the internal auditor be independent in a small company?

Clause 9.2.2 asks for auditors selected to “ensure objectivity and the impartiality of the audit process”. The 2022 text does not say “do not audit your own work” in those words, but that is how certification auditors read it. ISO 19011, the guidance standard on auditing, treats independence as a principle. Its 2018 edition accepted that internal auditors in small organisations may not be fully independent, provided every effort is made to remove bias.

In a company of forty people, objectivity is a structural problem. The person who built the ISMS understands it best, which is precisely why they cannot audit it, and often nobody else could. Three options:

• Train a second person. Cheapest over time, slowest to arrange, credible only if they are independent of what they audit.
• Use another function or group entity. Works well where a quality function already audits another standard.
• Buy it in. External internal audit for an SME scope typically runs €4,000 to €12,000 a year, every year of the certificate. Budgets often miss it.

Whichever route you take, document why the auditor is independent. “They did not build this part”, written down before the audit, is worth more than an explanation offered afterwards. In practice the ISMS owner is internal, and top management cannot delegate the review (clause 9.3.1); the auditor is the one role that contracts out cleanly, as ISO 27001 without a security team explains.

What are the ISO 27001 management review inputs?

Under clause 9.3.1, top management reviews the ISMS at planned intervals to check it remains suitable, adequate and effective. Clause 9.3.2 lists what the review must consider. Treat it as the agenda. In paraphrase:

1. Status of actions from previous reviews.
2. Changes in external and internal issues relevant to the ISMS.
3. Changes in the needs and expectations of relevant interested parties.
4. Feedback on security performance, including trends in nonconformities and corrective actions, monitoring and measurement results, audit results, and fulfilment of security objectives.
5. Feedback from interested parties.
6. Results of risk assessment and status of the risk treatment plan.
7. Opportunities for continual improvement.

Item 3 is new in the 2022 edition. Items 2 and 3 revisit the issues and interested parties from clauses 4.1 and 4.2. Since Amendment 1:2024, clause 4.1 also asks whether climate change is a relevant issue. A sensible approach is to record the answer, even “not relevant”, and revisit it here.

Clause 9.3.3 sets the output: decisions on continual improvement and on any changes the ISMS needs, with documented evidence.

Item 1 makes the first review different from every later one. There are no previous actions yet. Later reviews are judged partly on whether earlier decisions were closed, and fresh actions that never close form a pattern auditors look for.

Item 4 assumes you have been measuring something. If the clause 6.2 objectives were written as aspirations rather than things with numbers, this is the meeting where that becomes obvious.

How often should the management review be held?

Planned intervals again. Once a year is the practical minimum, because every surveillance audit reviews it. Twice a year or quarterly suits a changing estate, and Stage 2 then sees a pattern rather than one event. A leadership meeting can host it only if it covers every input and records its own decisions.

ISMS MANAGEMENT REVIEW                    Date:
Attendees (top management):               Chair:

1. Actions from previous reviews: open, closed, overdue
2. Changes in external and internal issues (4.1),
   incl. whether climate change is relevant
3. Changes in interested parties' needs and expectations
4. Security performance
   4a. Nonconformities and corrective actions (trend)
   4b. Monitoring and measurement results
   4c. Internal and external audit results
   4d. Security objectives: target vs actual
5. Feedback from interested parties
6. Risk assessment results, risk treatment plan status
7. Opportunities for continual improvement

DECISIONS
ID | Decision | Owner | Due | Resources
Changes needed to the ISMS (scope, policy, controls):
Approved by:

What do auditors raise against clauses 9.2 and 9.3?

Against 9.2:

• Audits performed, but no audit programme.
• Coverage incomplete across the cycle, with no risk-based rationale.
• Auditor independence not documented.
• Corrective actions with no root cause, or closed without checking they worked. Clause 10.2 requires both.
• Results never reported to management, so the link into 9.3 is broken.
• Audits run too close to certification to fix what they find.

Against 9.3:

• Minutes that miss mandatory inputs. Avoidable by using the list as the agenda.
• Delegates attending instead of top management.
• No documented decisions. A record of discussion is not a record of decisions.
• Inputs not prepared, so the meeting trades impressions instead of audit results and risk data.

When should you schedule them before Stage 2?

An internal audit a fortnight before Stage 2 leaves no time to fix what it finds. Finding nothing is worse: it tells the auditor the audit was not searching. A working sequence:

When	What
Month 1	Write the audit programme. Book the reviews for the year
Month 2 onward	First management review, even with thin data. It starts the action trail
3 to 4 months before Stage 2	First internal audit, full scope, expecting findings
Following 6 weeks	Corrective actions, with root cause and effectiveness checks
6 to 8 weeks before Stage 2	Management review covering those audit results
Stage 2	Auditor sees findings raised, actions closed, effectiveness verified

Nonconformities your own audit raised and closed properly are an asset at Stage 2. Teams hide them, and that instinct is the wrong way round. The timing must also fit the evidence period in how long ISO 27001 really takes.

The technical reality: what a document-based internal audit misses

Clause 9.2.1 asks whether the ISMS is effectively implemented. Most SME internal audits answer a narrower question: does the control exist, and is there a record.

An auditor can confirm that A.8.8, management of technical vulnerabilities, has a procedure, monthly scans and a report while critical findings sit open for months. The control asked for a process and got one. Logging exists and nobody queries it (A.8.15). Backups run and nobody has restored one (A.8.13). Access reviews are signed and the leaver still has a token (A.5.18). Each passes a paper audit, and each is a common way a company this size gets breached or fails to recover.

The fix is not more auditing. Write the programme so operational controls are tested, not reviewed: restore a backup and time it, hunt for a leaver’s live credentials, follow a scanner finding to closure.

The review has the same weakness. Input 4 is only as good as its data. Figures gathered by hand the week before are a snapshot; evidence collected continuously from the systems, with a person reviewing exceptions, is a trend, as in evidence that assembles itself. That is how the CloudSoul platform works, as an automated platform with human-in-the-loop expertise, and how we run ISO 27001 programmes.

ISO 27001 internal audit and management review checklist

• Write a risk-weighted audit programme covering the whole ISMS over three years.
• Record why each internal auditor is competent and objective.
• Run the first full-scope internal audit three to four months before Stage 2.
• Close corrective actions with a root cause and an effectiveness check.
• Use the seven 9.3.2 inputs as the fixed review agenda, with top management in the room.
• Minute decisions with owners and dates, and close them.
• Hold at least one internal audit and one management review between certification visits.

Sources

• ISO/IEC 27001:2022, clauses 4.1, 4.2, 6.2, 7.2, 9.1, 9.2, 9.3 and 10.2, Annex A 5.18, 8.8, 8.13 and 8.15, ISO.
• ISO/IEC 27001:2022/Amd 1:2024, Climate action changes, ISO.
• ISO/IEC 17021-1:2015, requirements for certification bodies, clauses 9.1.3.3 (surveillance frequency), 9.3.1.3 (Stage 2) and 9.6.2 (surveillance content), ISO.
• ISO 19011:2018, auditing guidelines, clause 4 (principles), replaced by ISO 19011:2026 in May 2026, ISO.

Frequently asked questions