ISO/IEC 27001 Internal Audit: Preparing Evidence and Closing Gaps
Published by Horus Consultancy · About us
An ISO/IEC 27001 internal audit should help you understand whether your information security management system meets the agreed criteria and operates as intended. Preparation starts with clear scope, accessible evidence and control owners who understand their responsibilities.
ISO/IEC 27001:2022 specifies requirements for an information security management system. Its risk-based approach should be applied in the organization’s context. Confirm the applicable edition and amendments when agreeing an audit; this article is a practical preparation guide, not a clause-by-clause interpretation.
Connect scope to business reality
Identify the services, locations, people, systems and interfaces within the assessment. Make outsourced dependencies visible. A narrowly described scope can be misleading if the service relies on a shared identity platform, a supplier or an operational team outside the stated boundary.
Explain your control decisions
Prepare the relevant risk assessments, treatment decisions and Statement of Applicability. The audit conversation should connect identified risks and requirements to the controls selected and the evidence available. Avoid treating a large policy library as proof that the underlying risks are managed.
For example, an access-control policy is more useful when it can be followed through to an approval, an account change and a completed access review. Where an exception exists, retain the rationale and the authority for accepting it.
Prepare evidence by process
- Access: account populations, approval records, privileged access and periodic reviews.
- Change: testing, authorization, deployment and emergency-change follow-up.
- Operations: incidents, monitoring, backup restoration tests and relevant remediation records.
- Suppliers: agreed responsibilities, assessments and follow-up on material issues.
- Management: objectives, decisions, previous findings and improvement actions.
The actual requests depend on scope and sampling. Agree the evidence period and secure transfer arrangements with the auditor rather than sending every available file.
Make findings actionable
For each finding, distinguish the immediate correction from action addressing its cause. Assign an owner, a target date and a way to verify effectiveness. Closing a ticket is not enough if the same issue appears in the next sample.
An illustrative access-review finding might require removing an inappropriate account immediately, then examining why the review process did not detect it. The longer-term action should address that failure and be tested.
Plan the external audit separately
Horus Consultancy can conduct internal audit work and facilitate contact with MSECB for an external certification enquiry, subject to MSECB’s acceptance and impartiality requirements. MSECB publicly lists Islam Elzayat as an auditor, including ISO/IEC 27001 experience. MSECB controls certification auditor assignment and certification decisions; an auditor must not independently assess their own consultancy work.
Does a successful internal audit guarantee certification?
No. Internal audit findings inform your improvement work. The certification body performs its own evaluation and makes its own decision.
Where should we begin if evidence is scattered?
Build one evidence register with owners, periods, file locations and open requests. Our IT audit evidence checklist provides a starting structure.
Need ISO/IEC 27001 audit training?
If you will plan or conduct ISMS audits, explore Horus Academy’s ISO/IEC 27001 Lead Auditor course. If your main responsibility is implementing or improving the ISMS and addressing gaps, consider ISO/IEC 27001 Lead Implementer.
Check the course page for current delivery options, prerequisites and credential requirements. Training supports professional development; completing a course does not itself certify an organization or authorize a certification audit.
Related guidance
- AI Governance: A Practical Starting Plan for Your Organization
- AI Risk Management: Build a Risk Register Around Real Use Cases
- ISO/IEC 42001 Readiness: From AI Policy to Evidence of Practice
- ISO/IEC 20000-1 Readiness: Connect Service Management to Evidence
Discuss your next step
Horus Consultancy provides IT GRC consulting and internal audit support for organizations in North America and the Gulf, with a physical base in Canada. Explore our services, read our FAQ, or book a call with Islam Elzayat. For professional education, visit Horus Academy.