October 2026. ISO 27001 has several audit moments, and they are often confused. The internal audit is mandatory (clause 9.2) and carried out by or on behalf of yourself. The external audit by the certification body decides whether you obtain or keep the certificate. Here is the difference and what to expect of each.
The internal audit: your own check
The internal audit tests whether the ISMS meets the standard and your own requirements, and whether it is effectively carried out. The auditor must be independent of the area being reviewed; small organisations therefore often hire an external party. Schedule the audit at least annually, before the external audit, so findings can still be fixed. See internal audit planning and the internal audit.
Stage 1: is the documentation in order?
The first phase of the certification audit tests the design: scope, policy, risk assessment, Statement of Applicability and whether the organisation is ready for stage 2. It is mainly a document review with a few conversations. Outcomes are points of attention you must resolve before the second phase.
Stage 2: does it actually work?
In the second phase the auditor tests execution: evidence, interviews, samples in systems and processes. He checks whether what you describe actually happens and whether controls are effective. Findings come out here: minor and major nonconformities, with majors blocking certification until resolved.
Surveillance and recertification
A certificate is valid for three years. In the years between, a surveillance audit tests part of the standard and the follow-up of earlier findings. After three years a recertification covers the whole ISMS again. See also ISO 27001 certification.
What to take from this
Do not treat the internal audit as a formality: a good internal audit finds what the external auditor would find. Register findings as corrective actions with an owner and due date, and include them in the management review. Audit preparation covers the rest of the route.