One of the most common questions I get from clients going through ISO 27001 or other ISO certification: "Do we really need an internal audit? Can we just do it ourselves?"
The short answer to both: yes and yes. But with caveats that matter.
When you need an internal audit
If you're pursuing ISO 27001 certification , an internal audit is required. It's not optional. The standard (Clause 9.2) mandates that you conduct internal audits at planned intervals to verify your information security management system is conforming to requirements and operating effectively. You can't skip this and expect to pass your certification audit.
SOC 2 or HITRUST don't formally require an internal audit, but many companies do one as a readiness exercise before their external audit. It's not mandatory but it's smart.
Beyond framework requirements, internal audits are useful any time you want to check whether your security program is actually working the way you think it is. Policies get written and forgotten. Controls get implemented and drift. People change roles. Systems change. An internal audit is a reality check.
Can you do it yourself?
Yes. ISO 27001 allows you to conduct your own internal audit. You don't need to hire an outside firm. But there's a catch: the person conducting the audit can't audit their own work. If your security lead built the controls, they can't be the one testing whether those controls work. You need someone with enough independence to give an honest assessment.
For small companies, this creates a practical problem. If one person owns your entire security program, who audits them? You have a few options:
Someone from a different department. Have someone from a different department conduct the audit with guidance from your security lead. This works if you have someone with enough technical understanding to evaluate the controls meaningfully.
Your vCISO or security advisor. This is the most common approach for companies under 100 employees. Your advisor knows the program but didn't implement every control, and they can provide the objectivity the standard requires.
An independent firm. Hire an independent firm specifically for the internal audit. This is the most thorough option but also the most expensive. It makes sense for larger companies or those going through their first ISO 27001 certification.
The key requirement is objectivity and competence. The auditor needs to be independent enough to report findings honestly and knowledgeable enough to test the controls meaningfully. Your marketing manager reading a checklist doesn't count.
What an internal audit actually looks like
It's simpler than most people think. The auditor reviews your ISMS documentation (policies, procedures, risk assessment, statement of applicability), tests a sample of controls to verify they're operating as described, interviews team members to understand how processes actually work (not just how they're documented), and produces a report with findings, observations, and recommendations.
The output is an internal audit report. It should document what was audited, what was tested, what worked, and what didn't. Findings are categorized as nonconformities (controls that aren't meeting the standard), observations (things that aren't broken but could be improved), or opportunities for improvement.
For most small-to-midsize companies, an internal audit takes 1 to 3 days of actual audit work plus a few days for planning and reporting.
What to look for in an internal audit
Whether you do it yourself or hire someone, here's what a good internal audit should cover:
Policy vs. practice. Does your team actually do what your policies say? Your access review policy says quarterly. Have you actually done four in the last year? Your incident response plan says the CTO is the primary contact. Does the CTO know that?
Evidence gaps. Can you produce evidence for every control? Not just “yes we do this” but actual documentation: screenshots, logs, tickets, sign-offs. If the evidence doesn't exist, the control didn't happen as far as any auditor is concerned.
Risk assessment currency. When was your last risk assessment? Does it reflect your current environment? If you've added new systems, new vendors, or new products since the last assessment, it's outdated.
Access management. This is where most findings live. Orphaned accounts, over-privileged users, shared credentials, missing MFA, access reviews that were done but not documented.
Vendor management. Have you reviewed your critical vendors' security posture? Are BAAs and DPAs current? Is your vendor register up to date?
Change management. How does code get to production? Is there a review process? Is it documented? Are emergency changes tracked?
Training. Has everyone completed security awareness training? Can you prove it? Are there employees who joined after the last training cycle and haven't been trained?
The part nobody tells you
A clean internal audit does not mean you'll have a clean external audit.
I need to be direct about this because I've seen companies get a false sense of confidence from their internal audit results and then get surprised during the real thing.
Here's why:
Different scope. Your internal audit might cover 70% of your controls thoroughly but miss areas that the external auditor digs into. Especially if you're auditing your own program, you'll naturally focus on the areas you're most familiar with and skip the blind spots.
Different rigor. An internal audit is a self-assessment at its core, even when conducted by an advisor. You're testing your own program with your own understanding of what “good” looks like. An external auditor brings a different perspective, different testing methodology, and different expectations.
Different sampling. Your internal audit might sample 10 access changes. The external auditor samples 25 and catches the 3 exceptions you missed. Different sample sizes produce different results.
Different interpretation. You might look at a control and say “this is working well enough.” The external auditor looks at the same control and says “the evidence doesn't fully demonstrate operating effectiveness.” Both interpretations can be valid, but the external auditor's opinion is the one that goes in the report.
Timing. Your internal audit covered January through June. Your external audit review period is January through December. Controls that were operating in the first half might have drifted in the second half. Six months is a long time for things to change.
How to use the internal audit effectively
The right way to think about an internal audit is as a dry run, not a dress rehearsal. It's your chance to find and fix the obvious gaps before the external auditor shows up. But it's not a guarantee that the external audit will be clean.
Use it to fix the easy stuff: missing evidence, orphaned accounts, outdated policies, incomplete training records. These are the findings that make you look sloppy in an external audit but are completely avoidable if you catch them early.
Use it to identify the hard stuff: controls that technically exist but aren't really operating consistently, processes that work differently than how they're documented, areas where the team has drifted from the policy without realizing it. These take longer to fix but they're the ones that turn into nonconformities if you don't address them.
Don't use it to convince yourself you're ready when you're not. If your internal audit found 15 findings, you probably have 25. Fix the 15, assume there are more, and go into the external audit prepared to respond to findings you didn't anticipate.
The bottom line
Internal audits are a required part of ISO 27001 and a smart practice for any company with a security program. You can do them yourself as long as the person doing it has independence and competence. They're not expensive and they're not complicated.
But they're a checkpoint, not a finish line. A clean internal audit means you've done your homework. It doesn't mean the test will be easy.
Farbod Fakhrai is the founder of Com-Sec, a cybersecurity and compliance consulting firm supporting startups and growth-stage companies.