The organization shall conduct internal audits at planned intervals to verify conformity and effective implementation and maintenance.
Put simply: Verify compliance from the inside—plan and run audits to confirm the ISMS is implemented and working, and follow up issues.
More specifically, this requires that the organization:
a. Plans an audit program (scope, criteria, frequency) considering risk and past results.
b. Uses objective auditors and a consistent audit process (plan, execute, report, follow-up).
c. Reports results to management and tracks corrective actions to closure.
