What is an internal audit?
An internal audit is an organization's own review of whether its controls are designed well and working as intended. It runs between external audits and is performed by someone independent of the controls being checked. ISO 27001 clause 9.2 requires internal audits at planned intervals.
What the buyer is really asking
Internal audit means checking your own controls between external audits. Give the cadence and who does it. At a small company it is fine to say a named person reviews controls quarterly against a checklist, as long as they are independent of the work they check.
Other ways buyers ask it
Every one of these wants the same answer:
- “How often do you conduct internal audits?”
- “Do you have an internal audit function?”
- “Are audit and assurance policies established and maintained?”
Evidence to have ready
- The internal audit plan
- Findings from the last internal audit
How Tyrvar answers this
Tyrvar treats every wording above as one question. You write the answer once, attach the evidence, and revisit it when your setup changes. Each buyer gets that approved answer no matter how their questionnaire words it. If you have not answered it yet, Tyrvar flags the question for you and does not make something up. Try it on your own questionnaire.
Related audit and assurance questions
- How do you track and remediate audit findings?
- Describe your compliance monitoring program.
- What formal information security policies do you maintain, and how are they documented, approved, and reviewed?
- What technical and operational security metrics do you define, collect, and report against your business objectives?