ISMS Internal Audit Report Template (ISO/IEC 27001 clause 9.2)

ISMS Internal Audit Report: [Organization name] [IA-YYYY-NN]

Report format for one internal audit of an information security management system (ISMS) under ISO/IEC 27001:2022 + Amd 1:2024, clause 9.2 (internal audit). An audit only counts if the managers who can act on it see the outcome and a record of it survives for the next auditor. This report records the scope and criteria, the audit team and its independence, the sampling, the findings with evidence and clause references, the conclusions, the distribution and the follow-up. Method follows the guidance of ISO 19011:2026 and ISO/IEC 27007:2020. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Executive summary
2. Audit objectives, scope and criteria
3. Audit team, independence and impartiality
4. Audit plan and method
5. Sampling and evidence reviewed
6. Summary of findings
7. Detailed findings
8. Positive practices
9. Conclusions
10. Follow-up of previous findings
11. Corrective action and follow-up
12. Distribution and confidentiality
13. Size tiers
14. Records and evidence
15. References

1. Executive summary

[Two or three short paragraphs: what was audited, the overall conclusion, the most important findings, any decision needed from top management.]

Example (Quillmere Analytics Ltd, IA-2027-01): The internal audit on 15 to 17 March 2027 covered clauses 4 to 10 of ISO/IEC 27001:2022 + Amd 1:2024 and 30 Annex A controls from the 2027 rotation set. The audit found 0 major nonconformities, 2 minor nonconformities, 1 observation and 1 opportunity for improvement.

The ISMS conforms to the standard and to the organization's own requirements for most of the audited scope and is effectively implemented in risk management, incident handling, supplier management and backup. Two weaknesses need corrective action before the Stage 2 audit planned for May 2027 (2027-05-10 to 12): measurement results are collected but not analysed or evaluated (clause 9.1), and access for departing contractors is removed late because contractor departures do not reach IT through the HR leaver process (control A.5.18 as implemented by the access control policy).

Decision needed: top management to confirm the owner for contractor offboarding, which today sits between Finance (contracts) and Engineering Operations (accounts).

2. Audit objectives, scope and criteria

3. Audit team, independence and impartiality

Confirmations:

• No auditor audited a process they operate, designed or manage.
• Clause 9.2 was audited by someone other than the audit programme manager.
• Audit evidence was stored in the agreed restricted location.
• Any AI-based tool used to summarise evidence was agreed in the audit plan and its output checked against source records. [Not used / Tool and use]

4. Audit plan and method

5. Sampling and evidence reviewed

Documents reviewed: [list with IDs and versions]. Example: DOC-ISMS-001 v2.0, DOC-ISMS-002 v1.2, DOC-ISMS-010 v2.0, DOC-ISMS-011 v1.1, DOC-ISMS-013 v1.3, DOC-ISMS-016 (export 2027-03-10), DOC-ISMS-024 v1.0, DOC-ISMS-041 v1.0, DOC-ISMS-080 v1.0.

6. Summary of findings

Results by clause (Example, from checklist section 17):

7. Detailed findings

7.1 Finding format

7.2 Findings

AF-2027-001 (Example): Minor nonconformity, clause 9.1

AF-2027-002 (Example): Minor nonconformity, control A.5.18 as implemented by the access control policy

AF-2027-003 (Example): Observation, clause 7.5.3

AF-2027-004 (Example): Opportunity for improvement, clause 6.2

8. Positive practices

9. Conclusions

9.1 Conformity

[Statement on conformity with ISO/IEC 27001:2022 + Amd 1:2024 and with the organization's own requirements, for the audited scope.]

Example: The ISMS conforms to the requirements of clauses 4 to 10 for the audited scope, except for clause 9.1 (AF-2027-001). The sampled Annex A controls operate as described in the SoA, except A.5.18 for contractor leavers (AF-2027-002).

9.2 Effectiveness

[Statement on whether the ISMS is effectively implemented and maintained, and whether it achieves its intended results.]

Example: The ISMS is effectively implemented and maintained. Risk management, incident handling, supplier management and backup produce reliable records. Performance evaluation is the weakest process and needs correction so that the first management review before Stage 2 is based on evaluated data.

9.3 Objectives and limits

Limits on the evidence: [None / description]. Example: judgement-based samples; the conclusions apply to the sampled period and items and do not give statistical assurance over the whole population.

9.4 Disputed facts

[None / finding ID, the auditee's position and the lead auditor's response.]

10. Follow-up of previous findings

11. Corrective action and follow-up

12. Distribution and confidentiality

Classification: [Confidential]. Do not share the report outside the distribution list without approval from the ISMS manager. Customers asking for audit evidence receive a summary or the certificate, not the internal report, unless a contract says otherwise.

13. Size tiers

14. Records and evidence

15. References

Official text (purchase or licensed access): ISO/IEC 27001 https://www.iso.org/standard/82875.html and Amd 1 https://www.iso.org/standard/88435.html; ISO 19011 https://www.iso.org/standard/88984.html; ISO/IEC 27007 https://www.iso.org/standard/77802.html; ISO/IEC 17021-1 https://www.iso.org/standard/61651.html.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clause 9.2 (internal audit), with reporting practice following ISO 19011:2026 and ISO/IEC 27007:2020. The report structure, grading definitions, field descriptions and worked example are original wording written for this template; no ISO or IEC text, tables or definitions are reproduced. Use the official standards, which are copyrighted and sold by ISO, IEC and national standards bodies, as the audit criteria. Check the current editions before use: ISO/IEC 27007 is under revision. An internal audit report does not certify anything; certification decisions belong to the accredited certification body. Template licence: MIT.