Internal Audit Independence Before Certification
Brightline Manufacturing is a 150-person firm pursuing certification. The Quality Manager, who also owns the ISMS documentation, conducted the internal audit. She audited all clauses and all Annex A controls in scope, interviewed department heads, and produced a report with three minor findings. She is also the person who wrote the risk treatment plan and the Statement of Applicability. The audit report is dated six weeks before the Stage 2 audit. The certification body's auditor asks for the internal audit records and the auditor's competence evidence. Separately, the last management review was held 13 months ago and its minutes record no decisions on resources or improvement. Two of the three internal findings remain open with no corrective action plan.
1. Assess the internal audit against Clause 9.2. What are the nonconformities, and how serious are they?
Read the worked answer
Clause 9.2 requires internal audits at planned intervals, with defined criteria and scope, auditors who are objective and impartial, results reported to relevant management, and records retained.
Nonconformities:
- Impartiality (9.2.2): the Quality Manager audited her own work - the documentation, the risk treatment plan, and the SoA. Clause 9.2.2 requires auditors to be objective and impartial; auditing one's own outputs is a direct breach. This is typically a major nonconformity because it undermines the reliability of the entire audit conclusion.
- Competence evidence: the auditor asked for the auditor's competence evidence and none was described. Clause 7.2 applies to auditors; records should show competence.
- Follow-up (10.1/10.2): two findings open with no corrective action plan means the audit did not drive improvement. Clause 10.2 requires action to eliminate causes and records of results.
Severity: the impartiality breach is the serious one - it can invalidate the audit as evidence that the ISMS was checked. The open findings are a lesser but clear nonconformity.
2. The management review is 13 months old with no resource or improvement decisions. What does Clause 9.3 require, and what is the risk to the certification timeline?
Read the worked answer
Clause 9.3 requires management review at planned intervals, with defined inputs (audit results, risk status, performance, nonconformities, interested-party feedback, etc.) and outputs that include decisions and actions related to opportunities for improvement and any need for changes to the ISMS. A review that records no decisions on resources or improvement fails the output requirement.
A 13-month gap is also a planning failure - the organization must define its review interval and keep to it. If the interval is annual and the review is due, 13 months is late; if the intent was more frequent, it is worse.
Timeline risk: the certification body will sample management review as evidence of top-management engagement (Clause 5.1, 9.3). With a stale, decision-free review and an internal audit of doubtful impartiality, the Stage 2 audit is at risk of a major nonconformity or a recommendation to delay.
The remediation is to hold a properly constituted management review now - with the required inputs, real decisions on resources for the open findings, and a documented improvement action - and to re-perform or supplement the internal audit with an independent auditor before Stage 2.