Two ISO/IEC 27001 clauses that look simple on paper, the internal audit (9.2) and the management review (9.3), decide whether a certification auditor believes the ISMS actually runs. Both are short in the standard, yet they are the clearest evidence that the management system operates rather than only existing as documents. This guide goes clause by clause through what 9.2.1, 9.2.2, 9.3.1, 9.3.2 and 9.3.3 require in the 2022 edition, how to build an audit programme that stands up, how to run a management review that produces real decisions, and the evidence a certification body expects to see. It is written for ISMS managers, internal auditors and the senior managers who chair the review. For the wider internal audit function and the IIA standards, see the Internal Audit for Cybersecurity Guide; for the full certification journey see the ISO 27001 Certification Guide.
Key takeaways
- The 2022 edition split both clauses into numbered subclauses (9.2.1 and 9.2.2; 9.3.1 to 9.3.3) and added one new management review input: changes in the needs and expectations of interested parties.
- An audit programme is not an audit: 9.2.2 asks for a planned programme with frequency, methods, responsibilities, planning requirements and reporting, shaped by process importance and previous results.
- Objectivity is tested, not assumed: auditors who audit their own work, or a programme that skips Annex A controls for a whole cycle, are the commonest findings.
- Management review must produce decisions: 9.3.3 wants decisions on improvement opportunities and changes to the ISMS, not a slide deck that was "noted".
- The two clauses feed each other and clause 10: audit findings become review inputs, review decisions drive corrective action (10.2), and closed actions are re-tested in the next audit cycle.
What the 2022 clauses require
ISO/IEC 27001:2022 (third edition, as amended by Amendment 1:2024, Climate action changes) follows the harmonised management system structure. The text of the standard is copyright, so the table below summarises the requirements rather than quoting them; check your licensed copy for the exact wording. SGS's transition guidance confirms that 9.2 and 9.3 were restructured into subclauses in 2022, that the documented information wording moved from "retain" to "available as evidence", and that input c) in 9.3.2 is new.
| Subclause | What it requires (summary) | Evidence an auditor asks for |
|---|---|---|
| 9.2.1 General | Internal audits at planned intervals to show whether the ISMS conforms to the organisation's own requirements and to the standard, and is effectively implemented and maintained | Audit schedule, completed audit reports covering both conformity and effectiveness |
| 9.2.2 Internal audit programme | Plan, establish, implement and maintain a programme: frequency, methods, responsibilities, planning requirements and reporting; consider process importance and previous results; define criteria and scope per audit; select auditors to ensure objectivity and impartiality; report results to relevant management; documented information available as evidence | Programme document, risk basis for frequency, audit plans with criteria and scope, auditor selection and independence record, distribution of reports |
| 9.3.1 General | Top management reviews the ISMS at planned intervals for continuing suitability, adequacy and effectiveness | Review calendar, attendance showing top management |
| 9.3.2 Inputs | Status of previous actions; changes in external and internal issues; changes in interested party needs and expectations (new in 2022); feedback on performance, including trends in nonconformities and corrective actions, monitoring and measurement results, audit results and fulfilment of objectives; interested party feedback; risk assessment results and treatment plan status; opportunities for continual improvement | Agenda or pack showing every input, with data, not headings |
| 9.3.3 Results | Decisions on continual improvement opportunities and any need for changes to the ISMS; documented information available as evidence | Minutes with decisions, owners and dates; an action log that links to clause 10 |
Note that the requirements in 9.3.2 are inputs the review must consider. A review that skips one (interested party changes is the one most often missed after transition) is, in our experience, usually raised as a minor nonconformity.
Building the internal audit programme (9.2.2)
ISO 19011:2026 (published 26 May 2026) gives the generic guidance on managing an audit programme, and ISO/IEC 27007:2020 adds ISMS-specific guidance on top of it. Both are guidance, not requirements: certification bodies audit against 27001, but they recognise a programme built on these documents. See the ISO/IEC 27007 and 27008 Guide for the companion standards.
Decide the cycle and the coverage rule
The standard does not set a frequency. The common practice that certification bodies accept is a cycle that covers every clause from 4 to 10 and every Annex A control marked applicable in the Statement of Applicability within the three-year certification cycle, with higher-risk areas audited every year. Our recommendation at NHI Mgmt Group is stricter: clauses 4 to 10 every year, because they are short and they are where certification auditors start.
| Area | Suggested frequency (ours) | Why |
|---|---|---|
| Clauses 4 to 10 (management system) | Annual | Certification bodies sample them every surveillance visit |
| Access control, identity, authentication and privileged access controls | Annual | High change rate, common incident root cause, includes service accounts and API keys |
| Supplier and cloud service controls | Annual | Scope drift as new SaaS is adopted |
| Logging, monitoring and vulnerability management controls | Annual | Operational controls that decay quietly |
| Physical controls for stable sites | Once per three-year cycle | Low change, unless a site or data centre changes |
| Areas with previous major findings | Next cycle, then by risk | 9.2.2 requires previous results to shape the programme |
Write each audit plan
- Criteria: the clauses and controls, plus the organisation's own policies and procedures. The 9.2.1 wording covers both, so an audit that only checks the standard misses half of it.
- Scope: sites, teams, systems and the period under review. Name the cloud tenants and SaaS platforms in scope.
- Methods: interviews, document review, observation, and re-performance or sampling of records. ISO 19011 describes remote audit methods; record which you used.
- Sampling: state the population and sample size, for example 25 joiners out of 410 in the period, so the next auditor can repeat it.
Objectivity, impartiality and auditor competence
Clause 9.2.2 says auditors are selected and audits conducted to ensure objectivity and impartiality. The standard does not require an independent department, which matters for small organisations.
| Option | Works well for | Watch out for |
|---|---|---|
| Internal audit function | Larger organisations with an IIA-based function | Function may lack ISMS or technical depth; pair with a subject matter expert |
| Cross-team peer auditors | Mid-size organisations | Rotate so nobody audits their own process; train them on 27007 |
| Outsourced internal auditor | Small organisations and start-ups | Must not be the same consultant who built the ISMS; keep the programme ownership in-house |
| ISMS manager auditing | Rarely acceptable | Can audit areas they do not run, never the ISMS processes they own (risk method, SoA, document control) |
Keep a competence record per auditor: training (a lead auditor course is useful but not required), audits observed and led, and technical knowledge of the areas they audit. See the ISO 27001 Lead Auditor and Lead Implementer Guide for credential routes.
Running the audit and grading findings
- Opening meeting: confirm scope, criteria, timetable and how findings will be graded.
- Collect evidence: follow the process from policy to record. For each sample, keep the record identifier, not a screenshot of a dashboard.
- Grade findings consistently: use the same scale as your certification body, normally major nonconformity, minor nonconformity and opportunity for improvement, and write each as requirement, evidence and gap.
- Closing meeting and report: report to relevant management within an agreed period (ours: ten working days). 9.2.2 requires reporting; it does not require a format.
- Hand findings to clause 10: each nonconformity gets a correction, a root cause, a corrective action and an effectiveness check, as clause 10.2 requires.
Write findings so they survive the certification audit. "Access reviews not performed" is weak. "Policy AC-03 requires quarterly reviews of privileged roles; no review evidence exists for Q2 and Q3 2026 for the production AWS accounts (sample 2 of 4 quarters)" is a finding a manager can act on and an external auditor can verify.
Where identity fits
Identity controls change constantly, and non-human identities are where access control samples most often come up short in our experience. When auditing the Annex A controls on identity management, access rights and privileged access rights, include service accounts, API keys, OAuth applications and AI agent identities in the population, not only staff accounts. Ask for an owner, a purpose and a last rotation date for each sampled non-human identity. The Audit Readiness for AI Agents and NHIs guide lists the evidence to request.
Running a management review that produces decisions (9.3)
The management review is where top management shows it directs the ISMS. Certification auditors normally ask for the latest minutes early in the visit.
Who and when
- Chair: the senior executive accountable for the ISMS. Clause 5.1 requires top management leadership; a review chaired only by the ISMS manager does not show it.
- Frequency: "planned intervals". Annual is the floor most certification bodies accept; we recommend a full review annually with a short quarterly review of metrics, risks and actions.
- Format: a standalone meeting or a standing item in an existing risk or executive committee. Either works if every 9.3.2 input is covered and decisions are recorded.
Build the pack from the inputs
| 9.3.2 input | What to bring |
|---|---|
| a) Status of previous actions | Action log with status, owner, due date and overdue items |
| b) Changes in external and internal issues | New regulations, restructures, new products, threat changes, climate change relevance (Amd 1:2024) |
| c) Changes in interested party needs | New customer contract clauses, regulator expectations, supplier changes |
| d) Performance trends | Nonconformity and corrective action trends; metrics against targets; audit results; objective status |
| e) Interested party feedback | Customer security questionnaires, complaints, regulator correspondence |
| f) Risk results and treatment status | Top risks, residual risk against appetite, overdue treatment actions |
| g) Improvement opportunities | Proposals with cost and effort, for a decision |
Record the outputs
Minutes need decisions, owners and dates: "Approved funding for privileged access tooling, owner CISO, by Q2 2027"; "Accepted residual risk R-14 until 31 March 2027"; "Scope extended to the Dublin office from January". Decisions on resources (clause 7.1) and objectives (6.2) belong here too. A pack that was "presented and noted" with no decision is the most common 9.3 finding.
Linking 9.2, 9.3 and clause 10
The two clauses only work as a loop. Audit results and nonconformity trends are inputs to the review; review decisions become actions; actions go through clause 10.2 corrective action; and the next audit cycle tests whether they worked.
- Quarter 1: approve the annual audit programme, ideally at the management review.
- Quarters 1 to 3: run audits; log findings in one register with clause 10.2 fields.
- Quarter 3: verify the effectiveness of corrective actions from the previous cycle.
- Quarter 4: hold the management review with full-year audit results, then update the programme for the next year based on what was found.
- Before surveillance: make sure at least one review and the planned audits for the period are complete, with records available.
If you are preparing for initial certification, both must be done before stage 1: see the ISO 27001 Certification Readiness Checklist.
Measuring the programme and framework mapping
- Programme completion: planned audits completed in the period (target 100 percent).
- Coverage: applicable Annex A controls audited at least once in the current certification cycle.
- Corrective action closure: nonconformities closed by due date, and the share that pass the effectiveness check.
- Repeat findings: findings raised again in the same area within two cycles (falling is good).
- External versus internal: nonconformities the certification body found that internal audit missed (target zero).
- Review decision rate: management review items with a recorded decision, owner and date.
| ISO/IEC 27001:2022 | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| 9.2 Internal audit | ID.IM-01 Improvements are identified from evaluations | CA-2 Control Assessments; PM-14 Testing, Training, and Monitoring |
| 9.3 Management review | GV.OV-01, GV.OV-02, GV.OV-03 (oversight of strategy and performance) | CA-7 Continuous Monitoring (reporting to officials) |
| 10.2 Nonconformity and corrective action | ID.IM-03 Improvements from operational processes | CA-5 Plan of Action and Milestones |
The mappings above are ours, at a judgement level. For mapping method see the Control Mapping Guide and the NIST CSF to ISO 27001 Mapping Guide.
Common failure patterns
- One audit, called a programme: a single annual audit by a consultant with no programme document, no risk basis for frequency and no link to previous results.
- Auditing your own work: the ISMS manager audits the risk assessment they wrote. Certification auditors check the auditor name against the process owner.
- Conformity only: the audit checks documents exist but never tests whether controls are effective, which 9.2.1 explicitly requires.
- Missing inputs: management review packs built from the 2013 list that omit changes in interested party needs.
- Noted, not decided: minutes that record presentations but no decisions, owners or dates.
- Corrective actions closed on assertion: findings closed because the owner said so, with no effectiveness check, then raised again by the certification body.
Practitioner checklist
- Write a documented audit programme covering frequency, methods, responsibilities, planning and reporting, with a risk basis.
- Cover every clause and every applicable Annex A control within the certification cycle; clauses 4 to 10 annually.
- Record auditor selection and confirm nobody audits their own work.
- Give each audit written criteria (standard plus own policies), scope, methods and sample sizes.
- Include non-human identities in access control samples.
- Grade findings on the certification body's scale and route every nonconformity through clause 10.2.
- Build the management review pack from all seven 9.3.2 inputs, including interested party changes and any climate-related issues.
- Have top management chair the review and record decisions with owners and dates.
- Update the audit programme after each review and verify corrective action effectiveness in the next cycle.
Standards and references
- ISO: ISO/IEC 27001:2022 Information security management systems, Requirements
- Standards Council of Canada: ISO 19011:2026 Guidelines for auditing management systems
- IEC Webstore: ISO/IEC 27007:2020 Guidelines for information security management systems auditing
- SGS: ISO/IEC 27001 2013 to 2022 guidance document
- ISO27k: ISO/IEC 27001 overview and mandatory documentation
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: ISO 27001 Certification Guide · ISO 27001 Internal Audit Programme Template · Internal Audit for Cybersecurity Guide · ISO 27001 Statement of Applicability Template · Audit Evidence and Continuous Controls Monitoring Guide