ISO 27001 requires internal audits at planned intervals, carried out objectively and impartially. In a small organisation that is hard to do with your own staff.
We plan and carry out your internal audits for ISO 27001 and integrated management systems, such as ISO 9001, ISO 14001 and ISO 27701, and report findings you can act on before the certification body finds them.
What this service includes
Audit programme
A multi-year programme that covers every clause, the Annex A controls and the processes in scope.
Audit execution
Interviews, document review and sampling of evidence, on site or remote.
Integrated audits
One audit covering ISO 27001 together with ISO 9001, ISO 14001 or ISO 27701, so your teams are audited once.
Clear reporting
Nonconformities, observations and opportunities for improvement, each rated and explained.
Follow-up
Help with root-cause analysis and corrective actions, and a check that they work.
How it works
- 1
Plan
We agree scope, criteria and schedule, and review your documentation up front.
- 2
Audit
Interviews and sampling of evidence, on site or remote.
- 3
Report
A clear report and a closing meeting with management.
- 4
Follow up
Support with corrective actions and a check that findings are closed.
Common questions
Is an internal audit the same as the certification audit?
No. The internal audit is your own check, required by the standard. The certification audit is carried out by an accredited certification body. A good internal audit means fewer surprises there.
Can you audit an ISMS you helped build?
Auditors must be objective and impartial, so they should not audit their own work. If we helped implement your ISMS, we agree up front which parts we can audit independently.
How often do we need an internal audit?
ISO 27001 asks for audits at planned intervals. Most organisations audit at least once a year and cover the full scope within the three-year certification cycle.
