Guide 02 · Step 5 of 5

Run the internal audit and review

The dry run is not a rehearsal for the auditor. It is the last moment you can find out something is missing cheaply.

Independent guidance from Synergy. ISO/IEC 27001 and ISO 22301 are published by ISO/IEC, which has no affiliation with Synergy and has not reviewed this material. This material is provided for informational purposes only and does not constitute compliance or legal advice. Always work from the published text of the standard.

Clause 9.2 requires an internal audit; clause 9.3 requires a management review. Both are mandatory, both are commonly done badly, and both are checked at stage 1 before anyone looks at your controls.

Internal audit: independence is the point

The person who built the ISMS should not be the only person who audits it. In a small organisation that is genuinely difficult — the answer is not to skip it, but to document how you achieved objectivity: a different department, an external reviewer, or a peer reviewer from another entity.

• Audit against the standard and your own SoA, not against your intentions.
• Sample, do not survey. Pick three access reviews and check them. Pick two incidents and follow them end to end.
• Record nonconformities honestly. An internal audit that finds nothing is a finding in itself.

Management review closes the loop

Clause 9.3 lists required inputs — audit results, risk status, performance, feedback, and improvement opportunities — and required outputs: decisions and actions. Minutes with decisions in them are the evidence.