ISO/IEC 27001 internal audit methodology
Risk-based and evidence-led approach: clear criteria, traceable evidence, and an output you can execute (not just archive).
Principles
We combine clause-based (system) auditing with testing of key Annex A controls based on risk.
Focus on critical processes, assets, and control points that materially affect risk.
Findings are grounded in verifiable evidence and clear audit criteria.
Practical recommendations and CAPA guidance that can be implemented and tracked.
Process
The steps below cover the full cycle: from scope and sampling to reporting and follow-up.
Objectives, ISMS boundaries, criteria, and expected outcomes.
Audit program, tests, and risk-based sampling selection.
Interviews, document/record review, and control testing.
Nonconformity grading and improvement opportunities.
Report, CAPA guidance, and verification of corrective actions.
- Audit program/plan + scope-based checklist
- Evidence traceability (audit trail)
- Report: findings, grading, evidence, and recommendations
- CAPA guidance and follow-up approach to closure
Share your ISMS scope, locations/processes, and goal (certification or annual program) and we’ll come back with a plan and quote.