Sub-clauses
- 9.1 Monitoring, measurement, analysis and evaluation
- 9.2 Internal audit
- 9.3 Management review
Why it matters
Proof the ISMS checks itself. A management system that's never audited or reviewed by leadership is, to an auditor, indistinguishable from one that doesn't really operate.
What it requires
Some form of ongoing monitoring or metrics, a genuine internal audit (even a simple one), and periodic management review with real inputs and outputs.
How a self-led small team handles it
An annual internal audit and a couple of management reviews a year is proportionate at small scale. Depth matters less than that it's real, honest, and repeated.
Track Clause 9 directly — itsbestpractice has a dedicated Internal audit & Management review section built around exactly this clause.
Start your ISMS