The Internal Audit Is a Protective Control

I delivered six ISO/IEC 27001 Clause 9.2 internal audits for external client organizations. Each was planned and executed as a full-scope audit against two things at once: the standard, and the client's own documented information. That second reference matters more than people expect. A client rarely fails the standard outright. A client fails its own policy, because the policy was written for a certification project two years earlier and operations have moved on.

The most common pattern was a control that existed on paper, was believed to operate, and produced no evidence. Access reviews that were scheduled quarterly and last performed eleven months before. A supplier register that listed every vendor except the two added since the last audit. An incident log that recorded the incidents somebody thought were serious and none of the near misses. None of this is negligence. It is what happens when a control has no owner watching the evidence trail rather than the activity.

The second pattern was scope drift. The management system said it covered a defined set of assets and locations, and the business had quietly added a site, a cloud service, or a client category that nobody had brought inside the boundary. An audit that starts by re-reading the scope statement against the current org chart finds this in the first hour. An audit that starts with the control checklist finds it never.

Every finding in those six audits was classified by severity before it was presented. A major nonconformity is a control that is absent or has failed in a way that defeats the objective it serves. A minor nonconformity is a lapse in a control that otherwise operates. An observation is a weakness that has not yet produced a lapse. The classification is not a courtesy to the client. It is what lets leadership allocate attention, because a list of forty undifferentiated findings produces forty shrugs.

The closing meeting is the point of the audit. Findings were presented to client leadership, with the evidence behind each one, and with the corrective action inputs the client would need to proceed. My part ended there in every case: the clients took certification in-house afterwards, and the certification outcomes are not known to me. That boundary is worth stating plainly, because an internal auditor who also claims the certificate has stopped being independent.

What leadership owes the closing meeting is a decision on each major finding: fix it, accept the risk in writing, or dispute the finding with evidence. What they do not owe is agreement. ISO 31000:2018 describes monitoring, reviewing, and continually improving risk management as criteria, not aspirations, and a closing meeting that ends without decisions has failed the criterion.

Information security has a certification industry that forces the audit habit. Physical security and executive protection have inspections, walk-throughs, and client satisfaction reviews, which are not the same thing. An inspection checks whether the guard is at the post. An audit checks whether the post order exists, whether it matches the risk assessment that justified the post, whether the officer was trained to it, whether the training record exists, and whether anyone reviewed the post order after the last incident.

At a national security services firm I led, the organization held an ISO/IEC 27001 certificate, built from inception in 2020 and sustained through the standard's revision to 2024, with a certified scope covering federal and government contracts and headquarters. The discipline that certificate imposed on the information domain had no natural counterpart on the protective side, and I ran it anyway: post orders, training expectations, escalation protocols, incident reports, and customer reporting held to standard across 238 sites in 28 states. In a later role, the licensing, training, personnel, incident, post coverage, payroll, and billing records were held audit-ready, because external audits, inspections, and regulatory review ask for them without notice.

The gap is closing. The ANSI-accredited executive protection standard, ANSI/BEP EPS 2026, gives a protective program a documented set of requirements to be audited against for the first time. I served on the Technical Committee of the Board of Executive Protection Professionals that authored it. A standard is only a shelf document until someone audits against it.

The method transfers without modification. Plan the audit against two references: the standard the program claims, and the program's own documents. Re-read the scope first, and look for the site, the principal, or the travel pattern that was added after the documents were written. Sample the evidence trail, not the activity: the training record, the advance report, the after-action note, the exception log. Classify each finding by severity. Present at a closing meeting with the corrective inputs attached, and get a decision on every major finding before the meeting ends.

Then leave. The auditor who stays to fix the findings has joined the second line and will not be able to audit the fix. The audit is a protective control because it is the one control in the program that is designed to find the program's own failures before an adversary or a regulator does. Review feeds Learn. The findings are the most reliable threat intelligence a program will ever receive about itself.