ISO 27001
Internal Audit
Clause 9.2
Canada
Overdue ISO 27001 Internal Audit in Canada: What to Do Before Your Next Certification Audit
Is your ISO 27001 internal audit overdue? Learn how to recover, prepare current evidence, address missed audit activities, and reduce certification or surveillance risk.
Your Internal Audit Was Due. It Did Not Happen. What Now?
Your certification audit is approaching.
Then someone checks the ISMS calendar.
The internal audit should have happened two months ago.
Now the questions begin.
An overdue ISO 27001 internal audit should not be ignored.
However, missing a planned audit date does not mean you should panic.
It also does not mean you should create evidence that never existed.
The stronger response is to understand the delay, complete the audit properly, address findings, and preserve evidence of how the organization recovered.
Quick Answer
What Should You Do if Your ISO 27001 Internal Audit Is Overdue?
- Review your approved internal audit program.
- Confirm exactly which audit activities are late.
- Document why the planned audit was missed.
- Assess any additional ISMS risk caused by the delay.
- Select a competent and objective auditor.
- Prepare current ISMS evidence.
- Complete the audit properly.
- Record findings and corrective actions.
- Verify important remediation.
- Update management before the external audit.
Clause 9.2 requires internal audits at planned intervals.
It does not prescribe one universal annual schedule for every organization.
What Does “Overdue” Actually Mean?
An internal audit becomes overdue when a planned audit date or audit-program commitment passes without the required audit work taking place.
Example
Audit program: Access Control Audit – June 2026
Current date: October 2026
Status: Audit never completed
That activity is overdue.
Another organization may use a different risk-based schedule.
Does an Overdue Internal Audit Mean Automatic Certification Failure?
Not automatically.
However, the external auditor may question whether the internal audit program was effectively implemented.
Expect questions such as:
- What was the planned audit schedule?
- Why was the audit missed?
- When was the delay identified?
- Has the audit now been completed?
- Did the delay affect high-risk processes?
- Were audit findings addressed?
- Did management review the issue?
- What prevents recurrence?
An organization that identifies the problem, responds transparently, and improves its process is in a stronger position than one that ignores the missed date.
First: Do Not Backdate the Audit
This is critical.
- Do not perform the audit today and pretend it happened months ago.
- Do not create old meeting minutes.
- Do not alter dates on reports.
- Do not manufacture evidence.
Record what actually happened.
The Q3 internal audit was scheduled for August 15 but was not completed because of resource constraints. The delay was identified on October 5. An independent auditor was engaged, and the audit was rescheduled for October 20.
Step 1: Review Your Internal Audit Program
Start with the records that define your planned audit activities.
Review:
- Internal audit program.
- Audit schedule.
- Audit calendar.
- Previous internal audit reports.
- Open corrective actions.
First ask:
Then compare that with:
Step 2: Find Out Why the Audit Was Missed
Treat the missed audit like another process failure.
Common causes include:
- The internal auditor left.
- Certification responsibilities changed hands.
- The ISMS manager became overloaded.
- The audit was repeatedly postponed.
- Nobody monitored the audit calendar.
- The organization lacked an independent auditor.
- Implementation work took priority.
- The audit program was unrealistic.
- Management did not provide enough resources.
Avoid stopping at:
Instead ask:
Step 3: Assess the Risk Created by the Delay
Not every overdue audit creates the same level of risk.
A missed audit covering one stable administrative process is different from an overdue review of:
Step 4: Decide Whether to Use an Independent Auditor
Lack of internal independence is one reason audits become overdue.
The same person may have:
- Built the ISMS.
- Written the policies.
- Maintained the risk register.
- Implemented controls.
- Collected audit evidence.
Then that person is expected to audit the same work.
An independent external auditor may be useful when:
- Your audit is already overdue.
- Your team lacks audit capacity.
- Internal staff would audit their own work.
- Certification or surveillance is approaching.
- Management wants an independent readiness view.
Is Your ISO 27001 Internal Audit Already Overdue?
Canadian Cyber can perform an independent ISO 27001 internal audit and help you identify the most important gaps before certification or surveillance.
The sooner the audit is completed, the more time you have to address findings properly.
Step 5: Do Not Rush a Weak Checklist Audit
When teams discover an overdue audit, there is often pressure to finish quickly.
That can create a second problem.
Weak audit question:
Do you have an access control policy?
Answer: Yes.
That does not prove the control works.
If you are already late, make the audit useful by testing real evidence and control operation.
What Evidence Should You Prepare?
Prepare an evidence pack before the auditor starts.
Core ISMS Evidence
- ISMS scope.
- Information security policy.
- Risk assessment.
- Risk treatment plan.
- Statement of Applicability.
- Security objectives.
- Asset inventory.
- Supplier register.
Operational Evidence
- Access reviews.
- Joiner and leaver records.
- Privileged access evidence.
- Vulnerability reports.
- Patch records.
- Incident records.
- Backup and recovery evidence.
- Security-awareness records.
- Supplier assessments.
- Change records.
- Monitoring results.
- Secure-development evidence.
Management-System Evidence
- Previous internal audit report.
- Audit program.
- Corrective-action register.
- Management review records.
- Monitoring and measurement results.
Step 6: Review Previous Findings Before the Audit
Before beginning the overdue audit, review earlier findings.
- Were they actually closed?
- Was effectiveness verified?
- Did the issue return?
- Are corrective actions overdue?
Example
Step 7: Complete Corrective Actions Properly
The audit matters only if findings lead to action.
For significant findings, record:
Do not close findings because someone says “fixed.”
Corrective action: Automated offboarding checklist introduced.
Verification: Sample five recent terminated employees.
Step 8: Retest Important Fixes
If certification is close, prioritize high-risk findings.
Was excessive access actually removed?
Does a rescan confirm remediation?
Was restoration actually tested?
Was the overdue assessment completed?
Can records now be retrieved reliably?
Step 9: Update Management
Do not hide the overdue audit from leadership.
Management should understand:
- Why the audit became overdue.
- What audit work is now complete.
- Which findings were identified.
- Which corrective actions remain open.
- Whether certification readiness is affected.
- Which resources are required.
How to Recover When Certification Is Very Close
If the external audit is only weeks away, prioritize.
Priority 1
Complete the internal audit properly.
Do not sacrifice objectivity or evidence quality.
Priority 2
Address high-risk findings.
Focus first on issues affecting ISMS effectiveness.
Priority 3
Document remaining actions.
Record owners, deadlines, risk, and temporary controls.
Priority 4
Brief management.
Leadership should understand the remaining certification risk.
What if the Internal Audit Is Overdue Before Surveillance?
The same recovery principles apply.
However, surveillance creates another concern.
The certification body is checking whether the ISMS continued to operate after certification.
Therefore, also review whether these activities are overdue:
- Management review.
- Risk reviews.
- Access reviews.
- Policy reviews.
- Supplier reassessments.
- Corrective actions.
Several overdue activities together may suggest wider ISMS maintenance problems.
What if You Missed an “Annual” Internal Audit?
First, check your actual audit program.
ISO 27001 requires audits at planned intervals rather than prescribing one universal twelve-month deadline for every organization.
Missing that date still needs to be addressed.
Do not quietly change the schedule after the fact. Review whether a different future frequency is justified and document that decision properly.
Signs You Should Call an Independent Auditor Now
Do not delay further if:
- Your planned audit date already passed.
- Stage 1 or Stage 2 is approaching.
- A surveillance audit is scheduled soon.
- Your internal auditor is unavailable.
- Your only auditor would be auditing their own work.
- Previous findings remain open.
- Your ISMS changed significantly.
- A cyber incident occurred since the last audit.
- Management does not know whether the ISMS is certification-ready.
Overdue ISO 27001 Internal Audit Recovery Checklist
Use this checklist before your external assessment.
☐ Confirm the missed audit date.
☐ Review the internal audit program.
☐ Document why the audit was missed.
☐ Identify the affected scope and processes.
☐ Assess the risk of the delay.
☐ Assign an audit owner.
☐ Select a competent and objective auditor.
☐ Confirm audit criteria and scope.
☐ Gather current ISMS evidence.
☐ Review previous audit findings.
☐ Conduct interviews and evidence sampling.
☐ Issue the internal audit report.
☐ Assign corrective actions.
☐ Prioritize high-risk findings.
☐ Retest important corrections.
☐ Update the corrective-action tracker.
☐ Inform management.
☐ Review whether the audit schedule needs improvement.
☐ Retain evidence of the recovery process.
☐ Prepare for the external assessment.
Need to Recover Before Certification or Surveillance?
Canadian Cyber can independently review your ISMS, complete internal audit testing, identify findings, and help you understand what needs urgent attention before your external assessment.
Frequently Asked Questions
Is an annual ISO 27001 internal audit mandatory?
ISO 27001 requires internal audits at planned intervals. It does not define one universal annual frequency for every organization.
What happens if an ISO 27001 internal audit is overdue?
Identify why it was missed, assess the impact, reschedule promptly, complete the audit objectively, and address resulting findings.
Will an overdue internal audit automatically cause certification failure?
Not automatically. The outcome depends on the circumstances, significance, evidence, corrective action, and certification body’s evaluation.
Can we complete the internal audit just before the external audit?
Yes, but waiting until the last moment leaves less time to correct findings and verify important fixes.
Can an external provider perform our ISO 27001 internal audit?
Yes. A competent external provider can perform an internal audit on behalf of the organization where suitable objectivity is maintained.
What evidence will the internal auditor need?
Expect to provide your audit program, risk assessment, Statement of Applicability, policies, operating evidence, previous findings, corrective actions, and records relevant to the audit scope.
Should management know the internal audit was overdue?
Yes. Management should understand important ISMS performance issues, findings, corrective actions, resource needs, and certification-readiness risk.
The Takeaway
An overdue internal audit is a problem.
However, doing nothing is a bigger problem.
ISO 27001 requires a planned internal audit program.
If you missed your planned interval:
That gives your organization a stronger position before certification or surveillance.
Is Your ISO 27001 Internal Audit Overdue?
Canadian Cyber provides independent ISO 27001 internal audit support for organizations preparing for certification, surveillance, and ongoing ISMS assurance.
Our support can include independent internal auditing, readiness review, corrective-action verification, evidence testing, and certification preparation.
Stay Connected With Canadian Cyber
Follow Canadian Cyber for practical guidance on ISO 27001 internal audits, certification readiness, surveillance, corrective actions, and ISMS improvement.
