An ISO 27001 internal audit is not a rehearsal where someone checks whether the policy folder looks complete. It is a structured test of whether the information security management system (ISMS) is implemented, operating, and producing evidence that the organization is doing what it says.
For a growth-stage SaaS company preparing for certification, the internal audit is one of the best opportunities to find problems before the certification audit. A strong internal auditor will sample evidence, interview owners, test control operation, and identify nonconformities that need corrective actions before Stage 1 and Stage 2.
Why the Internal Audit Matters
ISO/IEC 27001:2022 requires organizations to conduct internal audits at planned intervals. Clause 9.2 focuses on whether the ISMS conforms to the organization’s own requirements and the standard, and whether it is effectively implemented and maintained.
That makes the internal audit different from a gap analysis. A gap analysis often asks whether required components exist. An internal audit tests whether the system is actually operating.
The internal audit also differs from the external certification audit performed by a certification body. The internal auditor should not assess work they own or perform, which is why many SaaS companies use external auditors or internal audit services when they do not have an independent internal function.
What the Auditor Tests in the ISMS
Scope, Context, and Risk Assessment
The auditor will first look at whether the ISMS scope matches the business and technology environment. They may review the risk assessment methodology, risk register, treatment decisions, and the relationship between identified risks and selected security controls.
A common weakness is a risk assessment that exists on paper but does not influence operational decisions. The auditor may test whether risk treatment actions were completed, whether owners are assigned, and whether changes in the business trigger new assessment work.
Information Security Policy and Governance
The auditor will review the information security policy and supporting internal policies. They may test whether policies are approved, communicated, reviewed, and aligned with actual practice.
Management review is another key component. The auditor may inspect meeting records, metrics, risk decisions, audit results, corrective actions, and evidence of leadership involvement.
Statement of Applicability and Annex A Controls
The Statement of Applicability connects the risk assessment to Annex A controls. The auditor will check whether included and excluded controls are justified and whether selected controls are implemented.
This is where documentation review turns into operational testing. If the Statement of Applicability says access control is implemented, the auditor may inspect identity settings, access reviews, and evidence of user removal.
How Auditors Sample Evidence
Internal auditors rarely inspect every transaction. They use sampling to test whether controls are operating consistently.
For access control, they may sample user onboarding and offboarding records. For change management, they may inspect a set of production changes. For vulnerability management, they may review scans and remediation records. For vendor management, they may sample third-party reviews.
Supporting evidence can include tickets, logs, screenshots, reports, approvals, and system exports. The key is traceability: the auditor should be able to connect the control requirement to the evidence that proves operation.
Nonconformities and Corrective Actions
When the auditor finds a problem, it may be documented as a nonconformity or observation depending on the audit approach. A nonconformity means a requirement is not being met.
The corrective actions should address the root cause, not just the symptom. If access reviews were missed because no one owned the process, completing one late review does not solve the underlying issue. The corrective action should establish ownership, cadence, evidence, and monitoring so the failure does not repeat.
Continuous improvement is central to the ISMS model. Findings should feed back into risk management, policy changes, training, or technical controls as appropriate.
What Happens Before Stage 1 and Stage 2
A certification audit normally has two major phases. A Stage 1 audit focuses heavily on documentation, scope, readiness, and whether the management system is sufficiently established to proceed. A Stage 2 audit tests implementation and effectiveness in more depth.
Before Stage 1, the company should have its ISMS, risk assessment, Statement of Applicability, internal audit, and management review in place. Before Stage 2, the organization needs evidence that controls have been operating and that findings from the internal audit have been addressed.
The certification body will issue the certification decision. Accredited certification bodies may operate under national accreditation systems such as UKAS, the United Kingdom Accreditation Service, depending on geography and customer expectations.
Surveillance Audits and Recertification Audits
ISO 27001 certification is not a one-time event. Surveillance audits occur after initial certification to test continued conformity, and a recertification audit occurs at the end of the certification cycle.
That means the internal audit process should become part of normal operations. Waiting until the next external audit creates unnecessary risk.
A mature audit program includes planned internal audits, management review, corrective actions, ongoing risk assessment, and evidence collection throughout the year.
Common Problems Internal Auditors Find
SaaS companies often struggle with the same categories:
- outdated risk assessments
- evidence that cannot be tied to a control owner
- inconsistent access reviews
- policies that do not match actual workflows
- incomplete vendor reviews
- unresolved findings
- weak management review records
- missing proof of security-control operation
The issue is usually not that the team has no security program. It is that the program is not consistently documented and maintained as an ISMS.
How ISO 27001 Connects to Other Frameworks
Many controls overlap with SOC 2 and other cybersecurity frameworks. Access control, risk management, incident response, vendor oversight, and security posture are common themes.
But the assurance models differ. SOC 2 involves an attestation report from a CPA firm. ISO 27001 uses a certification body. Internal and external audits therefore serve different purposes even when they test similar operational controls.
An organization may also operate under GDPR or other regulatory obligations. A well-designed ISMS can support those programs, but certification does not automatically prove compliance with every law.
Preparing for the Internal Audit
A practical preparation sequence is:
- confirm the ISMS scope
- update the risk assessment
- verify the Statement of Applicability
- review the information security policy and supporting procedures
- collect evidence for selected controls
- confirm management review has occurred
- build an audit plan with scope, criteria, and sampling
- conduct the ISO 27001 internal audit independently
- document nonconformities
- complete corrective actions before certification
The internal audit should be challenging enough to reveal real weaknesses. A superficial audit may feel easier, but it simply pushes findings into the certification audit.
Terms the Audit Team Should Define Up Front
A clear audit scope prevents confusion about which sites, services, teams, and controls the review covers. The audit plan should identify the lead auditor, criteria, sampling approach, and evidence needed for audit readiness. Some organizations shorten Statement of Applicability to SoA.
During the ISO 27001 audit process, findings may be categorized as minor nonconformities or major nonconformities depending on severity and the certification body’s rules. The initial certification audit includes Stage 1 and Stage 2, while the broader ISO 27001 certification process continues through surveillance and recertification.
ISO is the International Organization for Standardization, while IEC is the International Electrotechnical Commission; together they publish ISO/IEC 27001. The standard’s information security controls can support cyber resilience, business continuity, and protection against data breaches and cyber-attacks, but certification is not a guarantee that incidents will never occur. An ISO 27001 certification audit tests conformity to the management-system standard, not perfection.
The Bottom Line
The internal auditor is testing whether the ISMS works, not whether the company has enough documents. Expect sampling, interviews, documentation review, control testing, and follow-up on corrective actions.
SCI can perform standalone ISO 27001 internal audits or support the broader compliance program. For SaaS teams that need more than an audit report, an embedded compliance model can also help maintain the controls, evidence, and risk processes the next surveillance audit will test.