Like many other standards, ISO 27001 does not specify how frequently an organization must conduct internal audits. Experts recommend that an ISO 27001 internal audit be performed at least once a year. In cases where this isn't possible, an audit must be conducted every three years at the very least.