What is an ISO 27001 internal audit?

An internal audit is quite simply an opportunity for an organisation to take an ‘inwards look’ to assess how well it is performing against internal systems, policies, procedures etc.  If we apply this to ISO 27001, it provides you with an opportunity to review the effectiveness of your information security management system (ISMS) to try to identify any areas of concern before they develop into more significant problems.The implementation and effective running of your ISMS will require a commitment from all your organisational staff, to varying degrees.  The business environment is constantly changing, and your ISMS will frequently need to be ‘tweaked’ and modified in line with these changes.  An internal audit, also referred to as a first party audit, provides an opportunity to review your ISMS and confirm its continued suitability.  If your organisation is certified to ISO 27001, conducting audits is a mandatory activity that is required as part of the continuous improvement model.