During the initial implementation, an internal audit comes after you have confidence that ISMS is operating fine and that monitoring and measuring are producing results. If your ISMS operates for a while, an internal audit should be scheduled according to the Internal audit program.

After performing the internal audit, the next step is to perform the management review.