How Often Should You Audit? Designing an ISO 27001 Internal Audit Program That Keeps You Ready

Introduction

“The certification audit is in three months. We should probably do an internal audit first.”

If this sentence sounds familiar, you are not alone.

Most organizations treat internal audits as a pre-certification dress rehearsal a once-a-year scramble to check boxes before the real auditor arrives.

This is exactly backwards.

The trade-off is real:

• Audit everything annually → Simple to schedule, but gaps hide for 11 months.
• Spread audits quarterly → More work to coordinate, but issues surface early.

Here is the truth: The right answer is not one or the other. It is both.

In this guide, we’ll show you how to design an internal audit program that keeps you continuously ready without overwhelming your team or your auditors.

Perfect for compliance managers, internal auditors, and anyone tired of the annual audit fire drill.

Why Internal Audit Programs Fail (And How to Fix Them)

Before we dive into scheduling, let’s understand why most internal audit programs fail to deliver value.

The solution is not more auditing.

The solution is smarter auditing.

What ISO 27001 Actually Requires

Let’s start with the standard itself.

Clause 9.2 – Internal Audit

Notice what is missing:

• The standard does not require annual audits
• It does not require auditing everything every time
• It does not prescribe how many audits

The Audit Frequency Trade-Off

The sweet spot for most organizations:

• Critical controls: Quarterly
• High-risk controls: Semi-annually
• Medium-risk controls: Annually
• Low-risk controls: Every 2 years or sample-based

The Risk-Based Audit Schedule

Instead of auditing everything at the same frequency, audit based on risk.

Quarterly Audit Rotation Example

Benefits:

• No single audit overwhelms the organization
• Issues surface within 90 days, not 365
• Auditors become familiar with controls over time
• Certification audit prep is continuous

The 5-Step Internal Audit Program Design

Step 1: Define Your Audit Universe

What to Build in SharePoint:

/Audit Program/
  /Audit Universe/
    - Control Groups List (linked to Annex A)
    - Processes List (key ISMS processes)
    - Departments List (areas of the business)
    - Suppliers List (if in scope)

Questions to Answer:

• What controls need auditing? (All Annex A applicable controls)
• What processes need auditing? (Risk assessment, internal audit, management review)
• What departments need auditing? (IT, HR, Finance, etc.)
• What suppliers need auditing? (Critical vendors)

Output: A complete list of everything that could be audited.

Step 2: Risk-Rank Your Audit Universe

What to Build in SharePoint:

/Audit Program/
  /Risk Rankings/
    - Control Risk Ratings (Critical/High/Medium/Low)
    - Process Criticality Ratings
    - Department Risk Scores
    - Supplier Risk Ratings

Step 3: Build Your Audit Schedule

What to Build in SharePoint:

/Audit Program/
  /Schedule/
    - Annual Audit Calendar (visual)
    - Quarterly Audit Plan
    - Monthly Audit Tasks
    - Auditor Assignments

Annual Calendar View (Power BI or SharePoint Calendar):

Pro Tip: Build in follow-up audits the month after each major audit to verify remediation. This closes the loop and prevents repeat findings.

Step 4: Define Audit Methods and Tools

What to Build in SharePoint:

/Audit Program/
  /Methods/
    - Audit Checklists (by control)
    - Interview Templates
    - Evidence Request Lists
    - Sampling Methodology
  /Tools/
    - Audit Finding Log
    - CAPA Tracker
    - Auditor Calendar

Sampling Guidelines

Pro Tip: Document your sampling methodology in your audit procedure. Auditors will ask how you selected samples. Have an answer.

Step 5: Implement Finding Management (CAPA)

The Mistake: Finding logged. Email sent. Nobody follows up. Next audit, same finding.

The SharePoint Solution: Corrective Action Preventive Action (CAPA) Tracker.

/Audit Program/
  /Findings/
    - Open Findings View
    - Closed Findings View
    - Findings by Owner
    - Repeat Findings Dashboard
  /CAPA/
    - CAPA Form (linked to finding)
    - CAPA Workflow
    - CAPA Status Dashboard

CAPA Workflow:

1. Finding identified during audit
2. CAPA created in SharePoint list
3. Root cause documented (required)
4. Corrective + preventive actions assigned
5. Owner + due date + notifications
6. Verification by auditor
7. Closure with evidence + trend reporting

Pro Tip: Require root cause analysis before approval. “We fixed it” is not enough. “We fixed it and prevented recurrence” is audit gold.

The Audit Schedule Options (With Trade-Offs)

Option 1: The Classic Annual Audit

Best for: Very small organizations (<20 employees), low-risk environments, first-year certification.

Option 2: The Split Annual (Two Halves)

Best for: Small-medium organizations, moderate risk, growing teams.

Option 3: Quarterly Rotation (Risk-Based)

Best for: Medium-large organizations, high-risk environments, mature ISMS.

Option 4: Continuous Auditing (Automated)

Best for: Large enterprises, highly regulated industries, mature automation.

Option 5: Hybrid (Recommended)

Combine approaches:

• Critical controls: Quarterly automated checks
• High-risk controls: Semi-annual manual audits
• Medium-risk controls: Annual sampling
• Low-risk controls: Biennial or integrated with other audits

Practical Use Cases: Audit Programs in Action

Use Case 1: Quarterly Access Control Audits

The Challenge: Access creep happens monthly. Annual audits miss 11 months of drift.

The Solution:

• Quarterly automated review of Azure AD/AD users, service accounts, privileged access
• Sample-based manual checks: terminated users still active, excessive permissions, orphaned accounts
• Findings feed into CAPA tracker + trend dashboard

Outcome: Access risks surface within 90 days, not 365.

Use Case 2: Integrated Supplier Audits

The Solution:

• Supplier risk ratings determine audit frequency
• Findings go into the same CAPA workflow
• Supplier dashboard shows status end-to-end

Use Case 3: Phased Policy Audits

Use Case 4: Continuous Control Monitoring

Outcome: When something fails, you know immediately—not at the next audit.

The Internal Audit Toolkit: What to Build in SharePoint

Here is the complete toolkit for managing your internal audit program all within SharePoint.

1. Audit Program Hub: schedule + findings + CAPA dashboards
2. Audit Plans: annual + quarterly plans, scopes, assignments
3. Audit Checklists: one per control group
4. Findings: open/closed views, repeat finding trends
5. CAPA Tracker: ownership, due dates, verification evidence
6. Reports: quarterly reports + annual report + management review inputs
7. Auditor Resources: training, methodology, sampling guidance

Innovative Ideas: Next-Level Internal Auditing

Idea 1: Risk-Based Audit Scoring

Score audit findings (Critical=10, High=5, Medium=2, Low=1) and trend it by department/control group so leadership sees where risk is accumulating.

Idea 2: Automated Finding Assignment

Log a finding → Power Automate assigns the correct owner → creates tasks → escalates if not acknowledged in 48 hours.

Idea 3: Audit Heat Map

Green/yellow/orange/red dashboard by control health (no findings vs repeat findings) so everyone knows what needs attention.

Idea 4: Continuous Audit Dashboard

Automated checks feed a SharePoint list; Power BI shows pass/fail; alerts go out instantly.

Idea 5: Peer Audit Exchange

Swap auditors with a non-competing org for independence without big consulting bills.

Best Practices for Internal Audit Success

1. Ensure auditor independence. No one audits their own work.
2. Document everything. Plans, checklists, evidence, findings, CAPAs, reports.
3. Train your auditors. ISO 27001 basics + interviewing + report writing.
4. Link audits to risk. High-risk areas get tested more often.
5. Track trends. Repeat findings = root cause not fixed.
6. Report to management. Visual summaries beat long reports.
7. Celebrate improvements. “Red to green” drives engagement.

The 5 Audit Findings You’ll Avoid with Good Planning

Why This Works Better With Our ISMS SharePoint Platform

You can build all of this with native SharePoint and Power Automate. You should.

But if you want to skip the months of building and testing, our ISMS SharePoint Platform delivers it pre-built.

Our ISMS SharePoint Platform is not software. It is 4,000 hours of audit program experience, packaged into a 2-day deployment.

The 15-Minute Audit Program Diagnostic

You do not need to guess whether your audit program will survive certification.

Book 15 minutes with our team. We will open your current audit program (or our demo tenant) and show you:

• Where your audit schedule has gaps (most have 3–5)
• One control group you should audit quarterly (that you currently audit annually)
• How to turn audit from a fire drill into a continuous process

This is not a sales pitch. It is a diagnostic.

The Question That Separates You

“Can we build an audit program with spreadsheets and email?”

Yes. Thousands of organizations do.

“Should we build an audit program with spreadsheets and email?”

Only if you enjoy:

• Finding out about control failures at year-end
• Chasing auditors for reports
• Losing findings in email threads
• Explaining repeat findings to certification auditors
• Recreating audit evidence every year

Conclusion: Your Path to Continuous Audit Readiness

Internal audits are not a certification requirement to check.

They are how you know your ISMS is working.

With a risk-based audit schedule, you can:

• Surface issues within 90 days, not 365
• Focus effort where risk is highest
• Keep leadership informed continuously
• Avoid the annual audit panic
• Enter certification audits with confidence

Ready to master your internal audit program? Explore our ISMS SharePoint Platform and turn audit from a burden into a strategic advantage.

Stay Connected With Canadian Cyber

Follow us for ISO 27001 playbooks, internal audit tips, and ISMS automation workflows: