Clause 9.2.1 Internal audit: general
Clause 9.2.1 in ISO 27001:2022 (ISO/IEC 27001:2022). All ISO 27001:2022 controls held. Open ISO 27001:2022 on the standards site.
The control as we hold it
Internal audit: general. Internal audits must be carried out at planned intervals to give information on whether the ISMS conforms to the organization's own ISMS requirements and to this standard, and whether it is effectively implemented and maintained.
Reviewed and closest counterparts in the other frameworks
We hold no cross-framework row for Clause 9.2.1 yet. The reviewed pairs page lists the released pairs and their coverage.
What an auditor commonly asks for
General guidance for this control area (domain: Clause 9), in our words, not a statement of the standard and not binding on an assessor.
- Internal audit reports assessing conformity to the organization's requirements and to ISO/IEC 27001
- Evidence audits covered implementation and maintenance, not only documentation
- An audit schedule showing planned intervals
- Over the audit cycle, coverage of every clause and every Annex A control that applies