The internal auditor who audits their own work
Clearview Legal is a 90-partner law firm with a 25-person IT team. Its ISMS covers client matter management and email. The Information Security Manager (ISM) built the ISMS, writes the policies, runs the risk assessment and also performs the internal audit because 'no one else understands ISO 27001'. The most recent internal audit report found two minor observations in the IT operations team, which the ISM also manages. The audit report was reviewed by the managing partner, who noted that the audit had not covered the ISM's own access to the matter management system or the change management process for the client portal. The firm is preparing for its first certification audit. The ISM has proposed a corrective action to 'provide more audit training to the ISM' and to add a checklist item for access reviews.
1. Does the internal audit arrangement meet ISO/IEC 27001 clause 9.2? Explain the specific deficiencies.
Read the worked answer
No. Clause 9.2 requires the internal audit programme to be planned, established, implemented and maintained, including frequency, methods, responsibilities, planning requirements and reporting. It also requires auditors to be objective and impartial, and explicitly states that auditors shall not audit their own work. The arrangement fails on several points.
First, independence: the ISM designed and operates the ISMS, manages IT operations and then audits those same areas. The two minor observations in IT operations are exactly the kind of finding that an auditor with an interest in the outcome may soften. Second, coverage: the audit omitted the ISM's own privileged access and the client portal change process, both high-risk areas. Third, competence: no auditor competence criteria have been defined, and the proposed training does not address the structural conflict. Fourth, reporting: the report does not demonstrate that audit results were reported to relevant managers or that the programme was risk-based.
The managing partner's observation is evidence that top management has noticed the gap. The proposed corrective action treats a symptom, not the cause. Adding a checklist item does not make an auditor independent of the process being checked.
2. What corrective actions should be taken, and how should they be implemented before the certification audit?
Read the worked answer
The root cause is lack of independent audit capability, not lack of checklists. The firm should restructure the audit arrangement:
- Appoint an auditor who is independent of the ISM's responsibilities. Options include a trained auditor from another function (for example, finance or compliance) with no operational ISMS role, or a qualified external auditor. If an external auditor is used, the firm still needs a documented internal audit process and management oversight.
- Define auditor competence criteria covering ISO/IEC 27001 requirements, audit techniques and the firm's technology and legal context. Record how competence was evaluated.
- Revise the audit programme to cover all clauses and the in-scope Annex A controls over a defined cycle, explicitly including privileged access, change management and the ISM's own activities.
- Re-perform the affected audit areas and document findings, evidence and closure.
- Implement corrective action for the deficiencies found, with owners and dates, and verify effectiveness.
- Report the results to top management and record the decision in management review.
The certification audit will look for evidence of an operating programme, not a one-off report. A short, honest re-audit with proper independence is stronger than a comprehensive report produced by the person being audited.
3. What should management review conclude about the internal audit programme?
Read the worked answer
Management review should conclude that the programme was not effective because it lacked objectivity, did not cover significant areas and had no defined competence criteria. It should record that the previous audit results cannot be relied upon without re-performance, and that the corrective action must address the structural conflict rather than only training.
The review should also consider resourcing: does the firm have enough independent audit capacity, and if not, should it budget for external support? It should set expectations for the next audit cycle, including scope, frequency, reporting lines and follow-up of findings. It should confirm that audit results feed into risk assessment, corrective action and continual improvement, and that top management receives meaningful information rather than a compliance checklist.
Finally, the review should challenge whether the ISM role itself is overloaded. Combining ISMS ownership, IT operations management and internal audit in one person is a design weakness. Separating these responsibilities reduces the risk of future nonconformity and improves the credibility of the ISMS both internally and to the certification body.