Complass
Internal audit and management review under ISO 27001
Six weeks before the surveillance audit the auditor asks for your audit programme and for a corrective action that has been overdue for months.
ISO/IEC 27001 requires internal audits at planned intervals and a management review by top management in clause 9, and a defined handling of nonconformities up to the effectiveness check in clause 10. Together they form the loop by which certification bodies see whether a management system works.
The whitepaper explains the audit programme across the three-year certification cycle, the audit plan and the independence of the lead auditor, findings and corrective actions, the seven inputs of the management review and working with external auditors, with an 8-step plan and a practice example.
Each chapter includes a short "Implementation in Complass" box; only published features are named. Standard texts are not quoted but paraphrased with the clause reference.
10 pages · Version 1.0 · as of 18.10.2026 · Author Marc Linden, Complass GmbH i. G.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.