Internal audits are the discipline of independently verifying that controls operate as designed. Required by ISO 27001 (clause 9.2), referenced in SOC 2 Common Criteria, and a generally good idea — they catch issues before external auditors find them, before regulators find them, and before incidents reveal them. This module covers running internal audits that produce real value, not just paperwork.
Internal vs external — different jobs
- External audit — independent third party (CB, CPA firm) assesses against a standard. Outcome: certification or attestation. Annual or biennial
- Internal audit — performed by your own org’s audit function (or competent staff outside the audited area). Continuous improvement. As-needed and on schedule
Internal audits should make external audits boring. If your external auditor finds issues your internal audit didn’t, your internal audit isn’t working.
Independence — the harder-than-it-sounds rule
Auditor must be independent of the audited area. Practically:
🔐 Intermediate Module · Basic Tier
Continue reading with Basic tier (₹499/month)
You've read 23% of this module. Unlock the remaining deep-dive, quiz, and every other Intermediate module.
99+ modulesAll levels up to this tier
20-question quizzesUnlimited retries with explanations
Completion certificatesShareable on LinkedIn
7 more sections locked below