We’ve reached the internal-audit requirement and I don’t really know what “audit ourselves” means in practice, or what evidence the external auditor wants to see that we did it.
Clause 9.2 asks you to check your own management system before the external auditor does. And, crucially, to have evidence that you did and that you acted on what you found.
In practice: plan which parts you’ll audit and when, run the audit (this can be you checking your own controls against what they’re meant to do, or a colleague checking yours), and (this is the part people miss) capture every finding and track it to closure. The external auditor isn’t only looking for a clean internal audit; they’re looking for proof that when your internal audit found something, you did something about it and confirmed it worked.
So the evidence trail is: an audit plan, the findings, and each finding linked to a corrective action that’s been closed and re-checked. A finding you found and fixed is a good sign to an auditor, not a bad one.