ISO 27001 · Internal audit · Lead Auditor
ISO 27001 internal audit (mock audit)
ISO 27001 requires an internal audit before certification, then every year. As a certified ISO 27001 Lead Auditor and former PwC auditor, I run it with the method and rigour of a certification body, so that gaps show up before the audit rather than during it.
Who it is for
- Companies preparing for their ISO 27001 certification audit
- Certified organisations preparing a surveillance or recertification audit
- Teams that built their management system on their own, or with a GRC tool, and want an outside review before the auditor arrives
Typical situation
The certification audit is coming up. The management system is in place, but nobody has yet checked, through an auditor’s eyes, that the evidence holds and that the teams will handle the interviews.
The standard (clause 9.2) requires an internal audit programme run by someone objective and impartial. In a small company, that is hard to assign to anyone on the team.
What I do
An audit run along the ISO 19011 guidelines, on the scope of your certification.
Preparation
Document review (scope, statement of applicability, risk assessment, policies), audit plan and sampling of Annex A controls.
Interviews and evidence testing
Video-call interviews with management and process owners, and sample-based evidence testing, as the certification auditor will do.
Grading the findings
Major and minor nonconformities, observations and opportunities for improvement, each tied to the relevant requirement of the standard.
Read-out
Closing meeting, audit report and help drafting the corrective action plan before the certification audit.
Deliverables
- An audit plan and an internal audit programme meeting clause 9.2
- An audit report: nonconformities, observations and strengths
- An assessment of the risk of a major nonconformity at the certification audit
- Help drafting the corrective action plan
- Teams prepared for the auditor interviews
- A read-out to management, reusable for the management review
Format and duration
- Format
- Fixed-fee engagement, fully remote: document review, video-call interviews and closing meeting
- Indicative duration
- Depends on scope, usually 2 to 3 weeks
- Fees
- Fixed fee, quoted on requestEstimate the budget for this service
- Independence
- I do not perform certification audits: the certification body must stay independent of whoever helped you prepare. The internal audit, on the other hand, can be carried out by an outside party.
Frequently asked questions
Can you also perform the certification audit?
No. Certification is granted by an accredited body, independent of those who helped you prepare for it. I run the internal audit; the certification body of your choice performs the certification audit.
Is the internal audit mandatory?
Yes. Clause 9.2 of ISO 27001 requires an internal audit programme, and the certification auditor will check that it was carried out and acted upon.
What if you already act as our vCISO?
The vCISO engagement already includes a mock audit. This service is for companies I do not support day to day: that is what keeps the review objective.
First call
In 30 minutes we can go through the scope, the date of your certification or surveillance audit, and the timing of the internal audit.