GRC · Specialist service
Internal ISMS audit and certification preparation
An implemented ISMS needs an independent assessment of how it works in practice. We check whether adopted requirements are met and help organise corrective actions.
Service scope
Internal ISMS audit
The internal audit covers selected information security management processes against agreed criteria. We combine document review, interviews and record sampling, separating implementation and audit responsibilities within the assessed scope. Findings include evidence and requirement references. Certification preparation helps organise materials and team readiness; it is neither a certification audit nor a promise of certification.
Audit programme and impartiality
We agree criteria, areas and samples based on risk and previous findings, checking separation between implementers and auditors.
Process verification
We examine procedure execution, objective achievement and control oversight using available records and interviews with owners.
Nonconformities and corrections
We describe the requirement, evidence and discrepancy. We support root-cause analysis and corrective-action planning, leaving approval with the owners.
Certification readiness
We organise evidence and help teams demonstrate ISMS operation, verifying agreed actions before assessment by an independent body.
Project deliverables
What will your team receive?
- An audit plan with criteria and sampling scope.
- A findings and nonconformity report with evidence.
- A corrective-action register and closure criteria.
- A readiness summary and list of missing materials.
Delivery conditions
What do we agree before starting?
- A defined ISMS scope and audit criteria.
- Access to documents, process owners and operational records.
- The ability to ensure impartiality and separate responsibilities.
How we work
From understanding the need to verifying the result.
We plan the assessment
We agree scope, interviews, criteria and samples, checking audit-team impartiality.
We gather evidence
We examine selected processes, discuss findings and confirm facts, documenting verification limitations.
We verify improvement
We deliver the report, support corrective planning and examine agreed evidence of completed actions.
Clear responsibilities
What is already included, and what do we extend?
An organisational internal audit is a separate GRC service. Basic Enterprise audit support provides service-delivery evidence and does not replace an ISMS audit programme.
Reference points: ISO — certification. Requirements and their applicability are established for the individual organisation.
Before making a decision
Questions about internal ISMS audits
Who issues the ISO/IEC 27001 certificate?
A separate, independent certification body. Our internal audit and preparation support provide information but do not replace its assessment or decision.
Can an implementer audit their own work?
We separate implementation and audit responsibilities within the assessed scope. Personnel selection must enable impartial assessment and credible findings.
Does closing a nonconformity mean revising a document?
Sometimes a document correction is necessary, but we also assess the cause and action effectiveness. New wording alone does not demonstrate changed practice.
Related expertise
Connect activities that complement each other.
The next step
Let us define a scope that makes sense for your organisation.
Let us discuss your environment, priorities and team responsibilities. We will use this to define the work, required access and service conditions.