ISO Internal Audit: Requirements, Duration and Who Can Conduct It

In a world of risk management and statutory governance, internal audit has stopped being a box to tick. It measures how well an organisation is achieving its strategic objectives within the risk appetite it has set, and certification bodies expect it to be finished before they arrive. Here is what an ISO internal audit covers, how much of it you need, and who is allowed to carry it out.

Internal audit is not a rehearsal for the external audit

An external auditor exists to render an opinion for members and shareholders on whether your management system meets its objectives. Internal audit goes wider and deeper: it assesses risk, tests controls, reports inside your governance structure, and carries an advisory role the external auditor does not have.

	Internal audit	External audit
Reports to	Senior management and the board, inside your governance structure	Members and shareholders outside it
Objective	Assess risk management, governance and the efficacy of controls	Express an opinion on the management system
Improvement	A core objective, with coaching and guidance	No responsibility, though a duty to report problems found

How many audit days does it take?

More than most teams budget for, and the number scales with headcount, complexity and the number of standards in scope. Three real engagements show the range: a 175-person technology firm certified to ISO/IEC 27001 required 13 audit days; a 425-person pharmaceutical company holding ISO 14001 and ISO 9001 required 21 days across both, run by two auditors in parallel; a cloud provider of more than 2,000 staff holding ISO/IEC 27001, 27017, 27018 and 27701 required 42 days. Effort is sized against the audit-time tables in ISO/IEC 27006, the same benchmark certification bodies use.

Two ways to deliver the same requirement

A Management System Internal Audit Engagement is a one-off piece of work against a defined scope, usually scheduled just before the external audit. Internal Audit as a Service spreads the identical requirement across the year on a monthly cadence, so 24 days of ISO 27001 audit becomes two days a month. Both satisfy the standard and cost about the same annually. The difference is whether your people absorb the disruption in one block or in a steady rhythm, and how early problems surface.

The auditor has to be independent and qualified

Certified organisations and many public sector bodies must be audited by an independent, qualified assessor, which rules out auditing your own work. The practical test is whether the auditor holds certification in the standard in scope and can hold a credible conversation with senior management about strategy and risk, rather than walking a checklist.

Which management systems this covers

Audits run across ISO/IEC 27001, 27017, 27018, 27701 and 20000, and ISO 9001, 14001, 22301, 28000, 31000, 45001 and 55001. Organisations holding several certifications normally run one integrated programme rather than repeating the same interviews for each standard.

Planning your next audit cycle? Allendevaux & Company's certified lead auditors deliver internal audit as a scheduled engagement or as a year-round subscription across the ISO management systems. Contact our team, or email info@allendevaux.com.

Frequently asked questions

How many days of internal audit do we need?

It depends on headcount, complexity and the standards in scope: 13 days for a 175-person single-standard ISMS, 42 days for a large multi-standard cloud provider. The ISO/IEC 27006 time tables are the usual benchmark.

Can we run our own internal audit?

Only if the auditor is independent of the work being audited and qualified in that standard. Small teams usually bring in an external lead auditor to meet both conditions.

What is the difference between internal and external audit?

Internal audit reports to your board and advises on improvement. External audit gives an opinion to stakeholders outside it and leads to the certificate.

Is a monthly subscription better than a single engagement?

Annual cost is similar. A monthly cadence spreads stakeholder time and surfaces findings earlier; a single engagement concentrates the effort immediately before the external audit.

When should the internal audit happen?

Early enough to fix what it finds. Days before the external audit, findings become risks rather than repairs.