Monitoring, Internal Audit and Management Review (Clause 9)
Monitoring and measurement (9.1)
The organization decides what to monitor and measure, the methods, when it happens, who analyses and evaluates results, and when evaluation occurs - and retains evidence. Monitoring is ongoing checking; measurement assigns values; analysis and evaluation turn data into judgement about ISMS performance and effectiveness. Typical sources: objective progress, incident and nonconformity trends, control test results, supplier and awareness metrics.
Internal audit (9.2)
An audit programme must be planned, considering the importance of processes, changes affecting the organization, and previous audit results. Each audit needs defined criteria and scope, auditors must be objective and impartial (no one audits their own work), and results must be reported to relevant management. Evidence of the programme and results must be retained. ISO/IEC 19011 provides guidance on auditing management systems.
Management review (9.3)
Top management reviews the ISMS at planned intervals. Inputs include status of previous actions, changes in issues and interested-party requirements, feedback on performance (nonconformities, corrective actions, monitoring and measurement results, audit results, objective fulfilment), risk assessment results and the status of the risk treatment plan. Outputs include decisions on improvement opportunities and any need for changes to the ISMS.
Traps. Questions mix up monitoring, measurement and internal audit; auditing is an independent conformity check against criteria, not a KPI report. Another trap is accepting a review chaired by an IT manager as a management review - the standard requires top management. Frequency is not fixed, but it must be at planned intervals. A final trap is accepting an audit programme that samples only technical controls and never covers Clauses 4–10.
Rule of thumb. Build the audit programme across the three-year certification cycle so every clause and every implemented control is examined at least once; leave a nine-month audit desert before certification and it will show.