Career guide

What Is an ISO 27001 Internal Auditor?

An ISO 27001 Internal Auditor is a professional who audits their own organization's information security management system (ISMS) at planned intervals, as clause 9.2 of ISO/IEC 27001:2022 requires, to check that it conforms to the standard and to the organization's own rules and that it works in practice.

This guide explains what an Internal Auditor does, how an internal ISMS audit runs, how the role compares with Lead Auditor and Lead Implementer, and how to get certified.

  • ISO/IEC 27001:2022
  • No formal prerequisites
  • Exam in 3 languages

What does an ISO 27001 Internal Auditor do?

Internal Auditors are the organization's own early-warning system. They find gaps in the ISMS before an external certification body does, and they give top management objective information for its decisions. They can be employees from another area or an external consultant hired to run the internal audit, as long as they are objective and impartial.

  • Help plan the internal audit program and the scope of each audit
  • Prepare checklists and sampling plans from the standard and the organization's ISMS documents
  • Interview people, observe work and review records as objective evidence
  • Record nonconformities and opportunities for improvement
  • Report results to the relevant managers
  • Check that corrective actions were taken and are effective

Where internal audit fits in the ISMS

  • Clause 9.2Internal audit

    Checks at planned intervals that the ISMS conforms and is effectively implemented and maintained.

  • Clause 9.3Management review

    Top management reviews audit results, among other inputs, and decides on changes to the ISMS.

  • Clause 10.2Corrective action

    Each nonconformity is corrected, its cause is analyzed and action is taken so it does not happen again.

What clause 9.2 of ISO/IEC 27001:2022 requires

Internal audit is mandatory: an organization cannot conform to ISO/IEC 27001, or be certified, without it. In the 2022 version, clause 9.2 has two parts, 9.2.1 General and 9.2.2 Internal audit programme. Together they ask the organization to:

  • Audit the ISMS at planned intervals
  • Plan and maintain an audit program, with frequency, methods, responsibilities and reporting
  • Define the criteria and scope of each audit
  • Choose auditors who keep the audit objective and impartial
  • Report the results to relevant management
  • Keep documented evidence of the program and its results

The standard does not fix how often to audit. Many organizations cover the whole ISMS scope every year so results are ready for management review and the external surveillance audit.

What an Internal Auditor checks

ISO/IEC 27001 is the international standard for information security management systems, published by ISO and IEC. Over the audit program, the Internal Auditor checks the requirements in clauses 4 to 10 and the controls the organization chose from Annex A.

  • 4Context of the organization
  • 5Leadership
  • 6Planning
  • 7Support
  • 8Operation
  • 9Performance evaluation
  • 10Improvement

Annex A: 93 controls in four themes

37
Organizational controls
8
People controls
14
Physical controls
34
Technological controls

The organization decides which controls apply and justifies it in its Statement of Applicability, which is a key document in every audit. The 2022 version replaced ISO/IEC 27001:2013, whose 114 controls were regrouped and updated.

How an internal ISMS audit works

ISO 19011 provides guidance on auditing management systems. An internal audit usually follows these five steps.

  1. Plan the audit program

    Decide which processes, sites and clauses to audit and when, giving more attention to high-risk areas and to the results of previous audits.

  2. Prepare the audit

    Agree on the scope and criteria, read the relevant policies, procedures and risk records, and prepare a checklist and a sampling plan.

  3. Collect evidence

    Hold a short opening meeting, then interview people, observe activities and sample records to see whether controls work as described.

  4. Report findings

    Compare evidence with the criteria, record nonconformities and opportunities for improvement, present them at the closing meeting and send the report to management.

  5. Follow up

    Verify that corrective actions remove the cause of each nonconformity. The results feed the management review.

Internal Auditor vs. Lead Auditor vs. Lead Implementer

Feature Internal Auditor Lead Auditor Lead Implementer
Main goal Checks that the organization's own ISMS conforms to its rules and to ISO/IEC 27001 Leads audits, including supplier and certification audits, and directs the audit team Designs, implements and maintains the ISMS
Key question “Are we doing what our ISMS says, and does it work?” “Does this ISMS conform to ISO/IEC 27001 and work in practice?” “How do we build an ISMS that meets ISO/IEC 27001?”
Typical output Internal audit report for management review Audit plan, findings, nonconformities and audit conclusion Scope, risk assessment, Statement of Applicability, policies and controls
Independence Must not audit their own work Independent from the organization being audited Part of the team that builds the ISMS
CertiProf certification I27001IA I27001LA I27001LI

Skills an ISO 27001 Internal Auditor needs

  • ISO/IEC 27001:2022 requirements
    • Interpret clauses 4 to 10
    • Know the 93 Annex A controls
  • Audit principles
    • Apply the guidance of ISO 19011
    • Stay objective and evidence-based
  • Evidence and sampling
    • Interview, observe and review records
    • Judge whether controls are effective
  • Reporting
    • Write clear, objective nonconformities
    • Explain findings to managers

How to become an ISO 27001 Internal Auditor

  1. Learn ISO/IEC 27001

    Understand the ISMS requirements and the Annex A controls. CertiProf's ISO 27001 Foundation guide is a good starting point.

  2. Learn how audits work

    Study the audit principles and steps in ISO 19011: planning, evidence, sampling, findings and follow-up.

  3. Get certified as Internal Auditor

    Validate your knowledge with the CertiProf I27001IA online exam. There are no formal prerequisites.

  4. Practice on real audits

    Join your organization's internal audits as a team member, then audit processes on your own.

  5. Keep growing

    The certification is valid for 3 years and is renewed through CertiProf's renewal process. Many Internal Auditors later move on to Lead Auditor.

The ISO 27001 certification path at CertiProf

Four certifications cover the main ISMS roles. Going for three? The ISO 27001 bundle includes Foundation, Internal Auditor and Lead Auditor for USD 350. See all of them on the ISO/IEC 27001 page.

Start hereFoundationI27001FYou are hereInternal AuditorI27001IALead auditsLead AuditorI27001LABuild the ISMSLead ImplementerI27001LI

Who it's for and career outlook

Internal audit skills are useful in any organization that holds or pursues ISO/IEC 27001 certification. Typical job titles include internal auditor, IT auditor, ISMS coordinator, compliance analyst and GRC specialist.

USD 87,742

Median base salary for IT auditors in the United States, based on 234 salary profiles. Source: Payscale, updated July 16, 2026. Pay varies by country, experience and employer.

Who takes this certification

  • ISMS team members
  • Internal and IT auditors
  • Compliance and GRC analysts
  • Information security officers
  • Risk managers
  • Quality and management-system auditors
  • IT and process managers
  • Consultants who run internal audits

Get your ISO 27001 Internal Auditor certification

CertiProf ISO 27001 Internal Auditor (I27001IA)

40 multiple-choice questions · 60 minutes · 80% to pass (32 of 40) · no formal prerequisites.

  • 100% online, any day
  • English, Spanish or Portuguese
  • 2 exam attempts
  • Voucher instantly by email
  • Open Badges 3.0, valid 3 years
Exam language

USD 1302 attempts · voucher valid 6 months

Buy now · go to checkoutSee full exam detailsPlanning 3 ISO 27001 certifications? Bundle: USD 350

Already have a voucher?

Start your ISO/IEC 27001:2022 Internal Auditor exam in your language.

Companies with CertiProf-certified professionals

  • Grupo Salinas
  • Elektra
  • Banco Azteca
  • Claro
  • Kyndryl
  • DC Dinsmore Compass
  • Guide
  • UTEC
  • Certus
  • IDAT

Frequently asked questions

What does an ISO 27001 Internal Auditor do?

An ISO 27001 Internal Auditor audits their own organization's information security management system (ISMS) at planned intervals. They prepare the audit, collect evidence through interviews, observation and records, report nonconformities and opportunities for improvement to management and check that corrective actions work.

Is an internal audit mandatory under ISO/IEC 27001?

Yes. Clause 9.2 of ISO/IEC 27001:2022 requires internal audits at planned intervals, an audit program, defined criteria and scope for each audit, objective and impartial auditors, reporting to management and documented evidence of the results. An organization cannot be certified without it.

How often should ISO 27001 internal audits be done?

ISO/IEC 27001 does not set a fixed frequency; it asks for audits at planned intervals based on the importance of the processes and previous results. Many organizations audit their whole ISMS scope every year, in one audit or spread over several, so the results are ready for management review and the external surveillance audit.

Who can be an ISO 27001 internal auditor?

Any competent person who can keep the audit objective and impartial, such as an employee from another department or an external consultant. Auditors should not audit their own work. Knowing ISO/IEC 27001 and the audit guidance of ISO 19011 is what matters most.

What is the difference between an ISO 27001 Internal Auditor and a Lead Auditor?

An Internal Auditor audits the ISMS of their own organization. A Lead Auditor leads audits, including supplier and certification audits, and directs the audit team. CertiProf offers both certifications: I27001IA for internal auditors and I27001LA for lead auditors.

Do I need experience to take the ISO 27001 Internal Auditor exam?

No. CertiProf's I27001IA exam has no formal prerequisites and does not require previous auditing experience, but you should understand ISO/IEC 27001 requirements and basic audit concepts. If the standard is new to you, start with ISO 27001 Foundation (I27001F).

How do I get ISO 27001 Internal Auditor certified with CertiProf?

Buy the I27001IA exam voucher (USD 130) and take the exam online in English, Spanish or Portuguese. It has 40 multiple-choice questions, lasts 60 minutes and requires 80% to pass. The voucher includes 2 attempts and is valid for 6 months; the certification is valid for 3 years.

ISO/IEC 27001 is a standard published by ISO and IEC, and ISO 19011 is published by ISO. CertiProf is not affiliated with either organization.