ISO/IEC 27001 internal audit
Independent assessment of your ISMS and control effectiveness, with evidence-led findings and a practical improvement plan.
What’s included
Scope, criteria, key processes, and controls selected based on risk.
Risk-based sampling and test procedures aligned to control criticality.
Nonconformities and improvements backed by clear evidence and rationale.
Recommendations, prioritization, corrective action guidance and follow-up verification.
To run a fast and accurate audit, we typically request the following inputs:
- ISMS scope: boundaries, locations, processes, key systems
- Risk assessment / risk treatment (current versions)
- Statement of Applicability (SoA) + control status
- Key suppliers list and critical dependencies
- Policies/procedures and representative evidence samples
The duration depends on scope and number of locations/processes. A typical cycle looks like:
- 01Kick-off (0.5–1h)Objectives, scope, criteria, schedule, points of contact.
- 02Planning & sampling (1–2 days)Test selection and sampling based on risk/criticality.
- 03Fieldwork (2–5 days)Interviews, evidence review, control testing, traceability.
- 04Report (1–2 days)Findings, evidence, grading, recommendations and next steps.
- 05Follow-up (as agreed)CAPA guidance and corrective action verification.
A significant failure / missing effective control or a systemic issue that can compromise ISMS objectives.
A limited deviation that does not appear systemic but still requires corrective action.
No formal nonconformity, but a clearly justified improvement opportunity.
- Audit program/plan + scope-based checklist
- Evidence traceability (audit trail)
- Report: findings, grading, evidence, recommendations
- CAPA guidance + follow-up approach to closure
Yes—fieldwork is often remote if we can access records/systems and interview stakeholders.
Typically 2–6 interviews of 30–60 minutes plus access to representative evidence samples.
Yes—we combine clause-based auditing with risk-based testing of key Annex A controls.
A report with grading, evidence, recommendations and CAPA guidance (plus follow-up if needed).
Share your ISMS scope, locations/processes, and goal (certification or annual program).