# Internal Audits
URL: https://docs.autociso.io/console/iso/internal-audits/
Description: ISO 27001 clause 9.2 requires periodic internal audits to verify that the ISMS conforms to the standard and to your own policies. This page lists all your internal audits.

*This is the help text the console shows in the help panel on this page.*

ISO 27001 clause 9.2 requires periodic internal audits to verify that the ISMS conforms to the standard and to [your own policies](https://docs.autociso.io/console/iso/policies/). This page lists all your internal audits.

### Audit Cards
Each card shows:
- **Audit name**, the auditor and the start date
- **Status**: Draft, In Progress, Completed or Signed (plus a **Signed** tag)
- **Controls reviewed**: "n/m controls reviewed" with a progress bar
- **Open NCs**: the number of open nonconformities, or "All NCs closed"

### Creating an Audit
Click **Create Audit**, enter an audit name (e.g., "Internal Audit — Q1 2026") and a start date. AutoCISO creates a checklist of your ISO 27001:2022 Annex A controls (93 in the full set) and pre-fills each control's status from your [latest gap analysis](https://docs.autociso.io/console/iso/gap-analysis/): compliant controls start as **OK**, and partial or missing controls start as **Minor NC** or **Major NC** (blocking ones as Major). Review and adjust each one.

### Conducting the Audit
Click an audit to open the [execution view](https://docs.autociso.io/console/iso/internal-audit/), where you review each control, record findings and document nonconformities.

### Audit Frequency
ISO 27001 expects internal audits at planned intervals. Many organizations run a full audit every year and spot checks in between.

## Fields

### Audit Name

A descriptive name for this audit campaign.

**Examples:** `Annual Internal Audit 2025`, `Q3 Surveillance Audit`, `Post-Implementation Review`.

### Start Date

The date on which the audit period begins. This appears in the signed audit report and is used to track audit frequency compliance.