ISO 27001 internal audit
The ISO 27001 internal audit prepares the certification audit. We assess your ISMS, identify gaps and prioritize fixes before the certification body arrives.
What we see too often
Many organizations order an “internal audit” that is actually a pre-assessment, or worse, a disguised certification audit. Clause 9.2 requires a planned audit, as independent as possible, with followed-up nonconformities.
- no audit programme, or an audit “we will see before the certification body”
- the same person who wrote the ISMS self-audits with no distance
- vague findings, no evidence, no deadline, no owner
- confusion between internal audit, stage 1, stage 2 and pentest
- nonconformities end in an email, never in a register
What this module is
An ISO 27001 internal audit checks whether the ISMS conforms to the requirements and to what you declared you do. It produces findings, not a certificate. It is not the certification body’s audit (stage 1 and 2).
We plan the programme, audit on evidence, and deliver an actionable report: nonconformities, observations, deadlines. If we wrote too much of the system, we say so: independence matters, and we adjust the setup.
Where this sits in ISO 27001
The module covers clause 9.2. It leans on ISO 19011 for method. It does not replace stage 1 / stage 2, the pre-assessment, or risk analysis.
What this module includes
- Internal audit plan and scope
- Assessment of clauses 4 to 10
- Sample of Annex A controls according to the SoA
- Interviews, evidence review and gap report
- Support for corrective actions
How we work
Programme and audit scope
What to audit this year, criteria, independence. We do not pretend to see everything in one day if the ISMS is wide.
Preparation and expected evidence
Audit plan, interviews, artefacts. You know in advance what we will look for.
Execution
Interviews, samples, findings. We distinguish nonconformity, observation and improvement hint.
Report and follow-up
Report, findings register, deadlines, review with leadership. Without follow-up, internal audit is theatre.
What you receive
- Internal audit plan
- Gap report with severity and evidence
- Prioritized corrective action plan
- Summary for management review
Who it is for
Organizations close to stage 1 or 2, or that must show an independent internal audit in the year.
Who it is not for
This module is not certification, nor a pentest, nor a replacement for the pre-assessment if the ISMS does not exist yet. It is not an audit of your suppliers either.
Typical duration
3 to 10 days of work, depending on scope size.
What you need to provide
You provide the declared scope, ISMS documents, access to people and evidence. A leadership contact is required for closing.
What this module does not cover
Internal audit is not a certification audit. Certi360 does not issue the certificate and does not act as a certification body.
Frequently asked questions
- Can you audit an ISMS you helped build?
- Independence is managed. If we drafted a piece, another Certi360 auditor, or a distinct scope, can perform the internal audit. We say so before we start.
- Must every control be audited every year?
- The audit programme can span more than one year if the ISMS coverage remains defensible. We design it with you.
- How is this different from the pre-assessment?
- The pre-assessment is a fast photograph to start. Internal audit is more formal, with evidence, gaps and actions, often just before certification.
- Can we buy only this module?
- Yes. Each module is sold separately. You do not have to buy the full programme. The pre-assessment remains the most efficient entry point if you do not yet know where to start.
- Do we have to start with the pre-assessment?
- No, it is not mandatory. The pre-assessment speeds up scoping if you do not yet have a full picture. If you already know what is missing, we can start this module directly.