# Clause 9.2: Internal audit

Audit the BCMS internally on a planned basis, and run the audit programme that makes those audits objective, competent and consequential.

Cloud: Internal audit should be able to follow a critical service from the business activity through the provider to the evidence. If the audit stops at the contract, the cloud part of the system has not been audited.

Evidence: Audit programme and completed audit reports; Auditor independence evidence; Findings tracked to closure.

Test: Check the audit programme includes at least one provider-dependent service end to end.

Citation: ISO 22301:2019, clause 9.2. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.