Security governance · Cybersecurity
ISO/IEC 27001:2022 internal audit
We audit your Information Security Management System with the same rigour the certification body will apply, so nothing surprises you on the real audit day.
- Standard
- ISO/IEC 27001:2022 · clause 9.2
- Duration
- 3 to 6 weeks
- Model
- Internal or supplier audit
- Output
- Report with nonconformities and plan
The problem
The standard requires internal audits at planned intervals, and it is not paperwork: it is the mechanism that catches deviations before a third party does. It also works as a dress rehearsal if you are not certified yet, and as a control over critical suppliers who claim compliance that nobody has verified.
What it includes
Audit programme
Planning of the annual cycle: which processes are audited, when, against which criteria and with what independence from whoever operates them.
Documentation review
Comparison of the documentation set —policy, procedures, Statement of Applicability and records— against what the standard requires in each clause.
Field audit
Interviews, observation and sampling of real evidence: it is not enough for the procedure to exist, it must be verified that it is carried out as written.
Verification of Annex A controls
Technical review of the controls declared applicable, including access, cryptography, backups, logging, secure development and supplier management.
Classified findings
Major and minor nonconformities and observations, each with the clause breached, the evidence supporting it and its impact.
Corrective action plan
Root cause analysis and actions with an owner and a deadline, drafted to close the finding and not merely to answer it.
Closure follow-up
Subsequent verification that the actions were implemented and effective, with a closure record per finding.
Supplier audit
The same methodology applied to critical third parties that process your information and claim to comply with the standard.
How we work
- 01PlanningScope, criteria, audit team and calendar agreed with management.
- 02Documentation reviewPrior analysis of the ISMS and preparation of the checklist.
- 03ExecutionInterviews, evidence sampling and closing meeting with the preliminary findings.
- 04ReportClassified findings, evidence and corrective action plan.
- 05Follow-upVerification of the effective closure of every nonconformity.
Deliverables
| Document | Length |
|---|---|
| Audit programme Documented annual cycle. | included |
| Checklist Clause by clause and control by control. | included |
| Audit report Findings with evidence and classification. | 20-45 pp |
| Corrective action plan With root cause, owner and deadline. | included |
| Closure record Verification of effectiveness per finding. | included |
We audit, we do not certify. Certification is issued by an accredited independent body, and that independence is exactly what gives it value. Our role is internal: to find what fails while it can still be fixed without ending up in an official report.