Published · By the Aesparrow Security Research Team
Short answer
An internal audit is commissioned by the organisation to independently check its own controls and prepare for certification; an external audit is performed by a certification body or independent auditor who issues a certificate or attestation. Internal audits find and fix problems early and are mandatory for ISO 27001 under clause 9.2.
How do internal and external audits compare?
| Internal audit | External audit | |
|---|---|---|
| Commissioned by | The organisation | The organisation, performed by an independent body |
| Purpose | Find gaps and improve | Certify or attest compliance |
| Output | Internal audit report and corrective actions | Certificate or attestation report |
| Frequency | At planned intervals, at least annually | Per scheme (e.g. annual surveillance) |
| Who performs | Internal team or outsourced internal auditor | Certification body, CPA firm or QSA |
Internal security audit checklist
- Scope and criteria: standard, clauses, controls and locations to audit.
- Policies: approved, current and communicated.
- Risk assessment: up to date, with treatment plans and owners.
- Access control: joiner-mover-leaver, MFA and privileged access reviews.
- Change and vulnerability management: patching, VAPT and remediation evidence.
- Logging and incident response: monitoring, alerting and incident records.
- Suppliers: third-party risk assessments and contracts.
- Business continuity: backups tested and continuity plans exercised.
- Corrective actions: previous findings closed and verified.
How to perform an internal security audit
- 1Plan the auditSet objectives, scope, criteria and a risk-based schedule.
- 2Prepare the checklistTranslate requirements into audit questions and evidence requests.
- 3Collect evidenceInterview control owners, review documents, sample records and run technical checks.
- 4Evaluate controlsDecide whether each control is designed and operating effectively.
- 5Report findingsDocument nonconformities, observations and root causes in the internal audit report.
- 6Follow upTrack corrective actions to closure and verify effectiveness.
FAQ
Frequently Asked Questions
Clear answers about what we do — and what we don’t. If you have any other questions, feel free to reach out to our team.
Why conduct internal audits?
They catch issues before the external auditor, are required by ISO 27001, give leadership independent assurance and drive continual improvement.
How to prepare for a security audit?
Confirm scope, gather policies and evidence, close known gaps, brief staff, and run an internal audit or mock audit first.