Getting ready for an ISO audit: internal audit, management review and the SoA Management-system certification audits usually have two stages. Stage one checks that documents and system design are complete; stage two checks evidence that the system really runs. Auditors always ask for the Statement of Applicability under clause 6.1.3, internal audit results under clause 9.2 and management review records under clause 9.3. Prepare by planning the internal audit by risk, sampling evidence from real work, closing nonconformities in time and rehearsing the questions before the real day.
A company had a full cabinet of ISO 27001 documents, but in the stage-two audit the auditor asked for real internal-audit records and a management review agenda. The team had only unused templates and got a major nonconformity on the spot.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- Certification audits usually run in two stages: documents, then real evidence
- The SoA must say which controls apply, which do not, and why
- Plan internal audits by risk and past findings
- A management review needs complete inputs and recorded decisions
- A rehearsal audit finds gaps fastest
How to do it in 6 steps
Work through these 6 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Complete the SoAGo through every control, state whether it applies, why, and its implementation status.
- Plan a risk-based internal auditAudit important processes, frequent-incident areas and past findings first and more often.
- Sample evidence from real workPick samples from real records in a way you can explain, not only the good ones.
- Record and fix nonconformitiesClassify major, minor and opportunities for improvement, with owners and close dates.
- Hold the management reviewPresent audit results, metrics, risks and improvements so management decides and the decision is recorded.
- Rehearse the auditHave someone outside the work ask auditor-style questions and see which evidence cannot be found.
What does the certification auditor look at in each stage?
Stage one reviews scope, policy, risk assessment and the SoA for design. Stage two samples evidence that the work is done as written, such as internal audit records, review minutes and corrective actions.
Why plan the internal audit by risk?
The standard asks you to consider the importance of processes and the results of previous audits. Auditing everything equally is not enough; risky or troubled areas deserve deeper checks.
What must a management review include?
It needs the inputs the standard requires and outputs that are management decisions.
- Status of actions from the last review
- Internal and external changes
- Audit results and metrics
- Risks and improvement opportunities
- Decisions and resources needed
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ Internal audit templates exist but no audit was ever run | ✓ Run at least one full internal audit before stage two and keep evidence for every sample. |
| ✗ The SoA gives no reason for excluded controls | ✓ Write a reason for each exclusion, for example the activity is out of scope. |
| ✗ The management review is slides with no decisions | ✓ Record resolutions and owners for each topic, then follow up at the next review. |
Rehearse with a mock auditor before the real day
Every AIPDPA plan includes a 14-topic audit drill asked like a real auditor. The ENTERPRISE plan adds a risk-based internal audit plan, evidence sampled from real records, a management review agenda from live numbers, an SoA exported to Word and a two-stage mock audit.
Included in the ENTERPRISE plans, from 19,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
How often should we run internal audits?
At planned intervals. Most organisations cover every clause at least once a year and audit risky areas more often.
Can people from the same team audit?
Auditors must be objective and should not audit their own work. Use people from another team or an external auditor.
What is the difference between major and minor nonconformities?
A major one means a requirement is not met at all or the system fails. A minor one means it is done but incompletely or inconsistently.
Do the same principles apply to ISO 27701 and 42001?
Yes. These management-system standards share the same clause structure, so one internal audit and management review can cover several standards.
Sources
This guide relies on 4 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- ISO/IEC 27001:2022, clause 9.2 — internal audit (standard, not law)
- ISO/IEC 27001:2022, clause 9.3 — management review (standard, not law)
- ISO/IEC 27001:2022, clause 6.1.3 — risk treatment and the Statement of Applicability
- SBS / European DIGITAL SME Alliance — SME Guide for the implementation of ISO/IEC 27001 (2025)
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
A 5×5 risk register, objectives, internal audit, management review, an SoA exported to Word and a two-stage mock audit like a certification body.
Get started →The 14 topics auditors ask about, chosen from your organisation profile, showing which evidence is not ready, with no AI credits used.
Get started →ISO 27001 · ISO 27701 · ISO 42001 · NIST AI RMF · PDPC guidance: work done once counts across standards, with status calculated live.
Get started →PDPC, ETDA and NCSA requirements in one place — do the work once, evidence several standards.
Get started →A lawyer-led team checks your readiness and sets up PDPA end to end — ideal for SMEs without the time.
See the service →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.