Skip to main content

Cyber Resilience & Supplier Assurance

ISO/IEC 27001 Internal Audit

Objective, risk-based internal audits of your information security management system, with documented findings your management can act on before surveillance or certification activity.

IG-Smart provides ISO/IEC 27001 internal audits where independence allows. Certification and surveillance audits are carried out only by an independent accredited certification body.

View relevant evidence — View Relevant Evidence

When this service fits

For organisations operating, or preparing to certify, an ISMS that need an internal audit programme delivered with appropriate objectivity.

  • No internal audit has been completed since the ISMS was introduced

  • A Stage 1 or Stage 2 certification audit is approaching

  • A surveillance or recertification audit is due

  • The internal audit is currently performed by someone who runs the ISMS

  • Previous findings have not been followed up

  • The scope, sites or systems in the ISMS have changed

The service

An internal audit your management can rely on

Clause 9.2 of ISO/IEC 27001:2022 requires planned internal audits of the ISMS. Many organisations lack someone both competent and independent of the work being audited.

IG-Smart plans a risk-based audit programme, audits against the clauses and your applicable Annex A controls by sampling evidence, and reports conformity, nonconformities and observations clearly.

Independent by design. We do not audit an ISMS we helped implement in the same cycle, and we check conflicts and auditor competence before accepting each engagement.

What changes for your organisation

Outcomes the service is built to deliver

  • Audit programme

    A risk-based programme setting frequency, criteria and scope across clauses and Annex A themes.

  • Clause 4–10 audits

    ISMS requirements including risk assessment and treatment, Statement of Applicability, objectives and performance evaluation.

  • Annex A sampling

    Proportionate sampling of applicable controls, testing operation as well as documentation.

  • Findings and nonconformities

    Documented conformity, nonconformities and observations, each linked to evidence.

  • Management review input

    Audit results presented in a form suitable for clause 9.3 management review.

  • Follow-up

    Verification of corrective actions your organisation has implemented, where agreed.

How we deliver

Assess → Build → Manage → Assure → Improve

  1. Assess

    Agree criteria, scope and risk focus; check conflicts and competence.

  2. Build

    Prepare the audit programme and plan.

  3. Manage

    Conduct interviews, observation and evidence sampling.

  4. Assure

    Report findings and nonconformities for management review.

  5. Improve

    Verify corrective actions where agreed and plan the next cycle.

Improve feeds the next Assess cycle, so evidence stays current. Explore how we work

What you receive

The working records this service produces

Illustrative examples of the registers, records and executive reporting that may support the engagement.

ISO 27001 Readiness Dashboard · Pre-certificationIllustrative data — not client data
Overall positionAmber — on track
Annex A controls implemented
71 / 93
▲ 9 this period
Open nonconformities
5
▼ 3 vs last review
Risks treated
18 / 24
▲ 4 this period
Internal audit findings
7
▲ 4 closed

Gaps by priority

  • High2
  • Medium3
  • Low2

Statement of Applicability complete

78%

Policies awaiting approval
3
Overdue actions
4
Management review items
2

Illustrative output

ISO 27001 Readiness Dashboard

Readiness at a glance

A single view of ISMS readiness, so management can see what remains before the certification audit. Internal audit findings appear only where an independent internal audit has been separately conducted or supplied by the client.

What it helps you see

  • Control implementation progress
  • Nonconformities and audit findings
  • Risk treatment status
  • Actions before the certification audit

Likely format

Dashboard / reporting view · Supporting registers and evidence records · Executive PDF summary where agreed

Illustrative structure — not a client document. Exact outputs and formats depend on the agreed scope.

Scope boundaries

What is included, and what is scoped separately

Included in the core service

  • Risk-based internal audit programme
  • Audit plan and criteria for each audit
  • Evidence sampling against clauses and applicable Annex A controls
  • Internal audit report with findings and nonconformities
  • Summary for management review
  • Follow-up verification where agreed

Separately scoped where required

  • Certification, surveillance and recertification audits (accredited certification body only)
  • Internal audit of an ISMS IG-Smart implemented in the same cycle
  • Deciding or implementing corrective action (your management)
  • Penetration testing (scoped separately)
  • Guaranteeing certification readiness or outcome

Scope, deliverables and assumptions are agreed in writing before work begins.

Relevant evidence

Related security assurance experience

This case shows related security assessment and audit-readiness capability. It is not presented as an ISO/IEC 27001 internal audit engagement.

  • Anonymised engagement · Technology / SaaS / RegTech

    A FTSE 100 organisation

    Three-stage governance and audit-readiness plan

    Audit-ready UK policies ahead of a third-party maturity assessment

    View the evidence: A FTSE 100 organisation

Explore all case studies →Request Cyber Assurance Evidence →

Your IG-Smart team

Specialist expertise, coordinated around your requirement

Subject-matter expertise is paired with a clear client and programme contact from initial scoping through delivery.

  • Subject-matter expert

    Michael Abtar

    LLB (Hons), PG.Dip.Law, Cert. DPO

    View profile

  • Subject-matter expert

    Dr Bright Mawudor

    PhD

    View profile

  • Client & programme contact

    Julia Andrade

    BA

    Coordinates scope, practitioners, delivery and stakeholder communication.

    View profile

Buyer decisions

Questions before you engage

Is an internal audit required by ISO/IEC 27001?

Yes. Clause 9.2 requires the organisation to conduct internal audits at planned intervals to check that the ISMS conforms to its own requirements and the standard, and is effectively implemented and maintained.

How is an internal audit different from a gap analysis?

A gap analysis evaluates current arrangements and identifies improvements needed. An internal audit is an objective, systematic evaluation of an operating ISMS against defined audit criteria, with documented findings.

Is your internal audit the same as the certification audit?

No. The Stage 1 and Stage 2 certification audits and surveillance audits are carried out only by an independent accredited certification body that you appoint. IG-Smart does not certify.

Can you audit an ISMS you helped implement?

Not in the same cycle. IG-Smart does not provide an independent internal audit of an ISMS it helped implement in that cycle, and checks conflicts and auditor competence before accepting each engagement.

Who carries out the audit?

IG-Smart delivers ISO/IEC 27001 audit and assurance engagements through appropriately competent professionals selected according to the scope and requirements of each assignment. Auditor competence, relevant experience, objectivity and independence are assessed before appointment. Practitioner responsibilities and reporting arrangements are confirmed as part of the engagement.

Does a successful internal audit guarantee certification?

No. An internal audit gives management an objective view of conformity and effectiveness; the certification decision rests with the certification body.

Who decides and implements corrective action?

Your organisation. IG-Smart reports findings and nonconformities; management decides on corrections and corrective action under clause 10.2 and considers audit results in management review under clause 9.3.

How much does an ISO 27001 internal audit cost?

Fees are set by scope: organisational complexity, sites and systems in scope, audit criteria, estimated audit effort and reporting requirements. A written proposal is agreed before work begins.

Investment

Discuss Your ISO 27001 Internal Audit Requirement

Request an Internal Audit Proposal. Scope, audit criteria, deliverables and fees are agreed in writing before work begins.

The fee depends on

  • Organisational complexity
  • Sites and systems in scope
  • Audit criteria
  • Estimated audit effort
  • Reporting requirements

Procurement or supplier-assurance review?

Visit our Trust Centre

Ready to move forward?

Need an objective internal audit of your ISMS?

Not sure which service applies? Find the Right Service

  • Still defining your requirement?

    Discuss Your ISO 27001 Internal Audit Requirement

    Discuss the requirement, risk, scope and the right engagement model with an experienced practitioner.

    Discuss Your ISO 27001 Internal Audit Requirement

  • Have a defined scope, tender or RFP?

    Request an Internal Audit Proposal

    Share a defined requirement, RFP, tender, statement of work or existing scope for senior review.

    Request an Internal Audit Proposal

  • Procurement or supplier assurance

    Prepare for Procurement Review

    Access company, security and assurance information for supplier review, with controlled evidence available on request.

    Open Trust Centre