In November somebody notices that this year's internal audit is still missing. The ISMS owner takes two days, works through the chapters of the standard, notes fourteen findings and sends the report to the management team. They take note of it. In spring the certification auditor is satisfied, because an internal audit took place. Nothing changed.
That is the normal case in an SME, and it is expensive because it looks like work. An internal audit under ISO 27001 is the one appointment in the year where a company systematically checks whether what it decided is actually happening in the business. In our experience it is the cheapest honest status report a management team can get. Most companies give it away to the standard.
An internal audit does not check whether documents exist. It checks whether the rules you decided on hold up in daily operations and still fit the business. As a compliance exercise for the certifier it costs the same as it does as a status report for management. Three things make the difference: who audits, which samples get pulled, and whether every finding ends up with a name and a date on it.
Why the internal audit decays into a mandatory appointment
Three mechanics sit behind it, and none of them has anything to do with a lack of diligence.
The first is the audit plan. It follows the chapters of the standard, because the standard supplies the structure for free. So the audit looks where the documentation is thinnest instead of where the business has the most to lose. Those are rarely the same places. An audit plan that starts with the three processes carrying revenue, production and personal data costs not a franc more and produces a different result.
The second is who does it. The person who built the ISMS audits it. That is organisationally obvious and methodically worthless, because nobody finds their own blind spot. The findings then get phrased so they sound actionable, and cut small enough that nobody has to explain themselves.
The third is the ending. The report goes to the management team, the management team takes note of it, and with that the audit has become a document instead of a decision. "Noted" is not a result. It is the polite form of nothing.
What does an internal audit actually check?
For each rule it checks three things: whether the rule still applies, whether it is lived in daily operations, and whether anyone notices when it is not. Documents are an aid here, not the subject. Check only documents and you get a verdict on the quality of the documentation and none on security.
The third question matters most, because it separates lived from described. A rule whose breach nobody notices is not a control. It is a statement of intent with a version number.
In practice that means samples instead of completeness. A usable audit grabs three leavers from the past six months and looks at which accounts are gone and which ones still generate licence fees. It takes two supplier approvals and sees whether the agreed route held or whether procurement decided around it under time pressure. It dials one number from the emergency contact list. Samples of that kind say more about an ISMS than forty checked document versions.
Part of it is talking to people who do not work in IT. An audit that only happens inside IT audits IT. The rules apply in production and in finance. Ten minutes of conversation there tells you more about whether a policy works than half a day of document review. That is exactly the part missing from most of the internal audits we take over.
Who is allowed to run an internal audit in an SME?
Somebody who did not build and does not run the thing being audited. Independence is a question of role, not of certificates. Auditor training helps with method, but it does not solve the underlying problem: hardly anybody audits their own work strictly.
Three constellations work in an SME:
- The quality manager takes the process part. Someone who audits ISO 9001 or an industry standard anyway knows audit method, knows the business and has no interest in making IT look good. In our experience that is the most frequently unused resource in an SME.
- Cross-auditing between departments. IT audits business processes, the business audits IT processes. Both find more than expected, because both are allowed to ask naive questions.
- External for the rest. Meaning the topics the ISMS owner built themselves and therefore cannot judge neutrally.
In a company of a hundred people, full independence is a fiction. So you write it down instead of claiming it: who checked what, and where the proximity to the subject sits. The certification auditor asks exactly that, and an honest answer is cheaper there than a constructed one.
The most common finding in our internal audits is not a gap, it is a surplus. A policy nobody needs any more. A tool that gets paid for and whose alerts nobody reads. A report generated monthly and never opened. Those findings are the cheapest ones, because acting on them frees money instead of costing it. More protection. Fewer tools. Lower cost.
How much effort an internal audit realistically takes
For an SME with a normal ISMS scope it is three to five working days a year on the audit side, in our experience: half a day of planning and sample selection, two to three days of conversations and checking, half a day for the report, an hour to debrief the management team. That is the smaller part of the bill.
The larger part sits afterwards with the owners of the findings, and annual planning forgets it regularly. An audit that finds fourteen points creates fourteen jobs in teams that are already full. Plan for that or you get the same list next year, only longer.
Two topics per quarter beat one block in November. Rolling across the certification cycle, every topic comes up, and the findings hit operations in digestible portions. That only works if somebody owns the plan. Without an owner, the rolling plan slides back into November too.
How this looks in a food producer with 260 employees
A Swiss food processing company with two production sites, ISO 27001 for two years, food safety standards for many years. Audits are nothing new in that house. The IT manager had built the ISMS with external support, and he had audited it himself ever since. The findings were technical, actionable and inconsequential every year.
In the third year they swapped the roles. The quality manager, who audits the production standards anyway, took over the process part of the ISMS audit. The IT manager audited the topics he does not run himself. Nobody got trained, nobody bought anything, the effort stayed at four days.
After that the findings became less technical and considerably more uncomfortable. One supplier approval had been granted around the agreed route, because a filling line had stopped and the spare parts supplier needed access to machine data immediately. The emergency contact list named a person who had left the company eight months earlier. And the monthly report from a security product went to a shared mailbox that nobody owned.
Two of the findings ended up lowering cost: a module switched on for a project and never cancelled, and a second product covering the same function as one already paid for. The management team received one page with seven points, each with a name, a date and a type of decision. In the next maintenance audit, the certification auditor spent more time with the internal audit report than with the policies. That is a good sign, even if it does not feel like one at the time.
What has to happen with the findings
Every finding needs three things: a name, a date and a type of decision. Fix, accept or remove. No further categories are needed, and "noted" is not one of them.
The type of decision is the part usually missing in an SME. Not every finding has to be fixed. Some risks a company carries deliberately, because the measure costs more than the possible damage. That is a decision for the management team and not for IT, and it belongs in the register with a signature. Who is actually allowed to accept a risk is something we took apart in the piece on IT risk management in an SME.
Four decisions come up here, and all four belong to the management team: which findings get budget. Which risks the company carries deliberately and who signs. What gets removed. Which rule changes because the business changed rather than the threat situation. Prepared, that is thirty minutes.
What the certification auditor does with your internal audit
They read it early, often before the policies, because nothing shows faster how honest an organisation is with itself. An internal audit without findings is not proof of maturity to them, it is a hint that nobody looked properly. Hard findings of your own with visible follow-up are a better starting point for a certification conversation than a flawless green list.
Then there is the mechanics of the cycle. According to the certification body SQS, the certificate is valid for three years, with one maintenance audit in each of the two following years, then recertification. Between those appointments nothing keeps the ISMS awake except your own audit. That is why certified companies can still run a paper ISMS: the cycle demands evidence, not effectiveness. Effectiveness is only checked by whoever does it themselves.
Is an internal audit worth it without certification?
Yes, and for the same reason. The value does not hang on the certificate, it hangs on the sample. Without certification you only need a structure to check yourself against. BACS, the Swiss federal cyber security office, provides an assessment tool as a free Excel file alongside its ICT minimum standard, including sector-specific variants. For a first honest self-assessment that is enough.
For organisations subject to the ISG, the Swiss Information Security Act, there is also the requirement to have a working ISMS by the end of 2026. Working means checked. An ISMS nobody checks does not know whether it works either.
If there is nobody in your company who can run the audit with enough distance from the subject, that is a question of role rather than of training. How we take this on inside a mandate, and what happens in the first weeks, is set out in how a mandate runs.
Frequently asked questions
Is one internal audit per year enough?
For the standard it is enough if the audit plan covers all relevant topics across the cycle. For steering the business, twice is better, because a finding in February can still be fixed inside the current budget year and one in November cannot. More important than frequency is that a topic comes back when something was left open the year before.
Can we buy the internal audit in externally?
Yes, and for the topics nobody internally can check with any distance, that is the cleanest route. Two limits: the firm that built your ISMS would be auditing its own work, and the body that issues your certificate is not allowed to run the internal audit, because it would be preparing its own examination. The process part is better kept in house, because that is where the knowledge about daily operations sits.
What if the audit finds more than we can fix?
That is the normal case and no reason to find less. What moves things is an order based on business consequences rather than effort, plus a documented, time-limited decision for the rest. A long list without prioritisation is an audit that did not finish its job. A short list with owners moves more.