Risk-based audit plan
The audit plan focuses effort on scope, risk, previous findings, change and the parts of the ISMS where independent testing matters most.
ISO 27001 · Defined starting point
Test the ISMS before certification. ISO 27001 Internal Audit.
An independent internal audit that tests whether the management system is implemented, maintained and effective. Findings are written so management can act before certification or surveillance.
What you get
Independent evidence before the external auditor arrives.
The audit tests conformity and effectiveness, records findings with rationale and gives management a usable basis for corrective action.
Interviews and evidence sampling
Interviews, records and control evidence are sampled to test whether documented arrangements are operating in practice.
Conformity and effectiveness testing
Requirements are tested for both conformity and effectiveness so findings go beyond document presence.
Findings with clear rationale
Each finding is linked to the relevant requirement, observed evidence and the reason it matters.
Audit report and management debrief
Management receives the audit report, a clear debrief and a practical basis for corrective action before external assurance.
How it works
From audit plan to defensible findings.
The audit stays independent, evidence-led and proportionate to the scope and risk profile.
Plan
Set audit scope, criteria, functions, interviews and sampling.
Audit
Test implementation and evidence rather than reading policies in isolation.
Report
Document findings, strengths and improvement opportunities clearly.
Close
Debrief management and clarify what should happen before external audit.
Fit check
Use this when the ISMS exists and needs independent testing.
A good fit when the ISMS is operational and you need independent assurance before certification, surveillance or management review.
Discuss your situationBack to ISO 27001 →Defined scopeThe work is bounded before it starts.
Senior-ledOne senior line through assessment and decision.
No forced follow-onThe output remains useful without a mandatory next engagement.
BEFORE YOU DECIDE
Audit evidence, independence and useful reporting
An internal audit is a structured and impartial examination against defined criteria. The value is not just the number of findings, but the quality of evidence and the organisation’s ability to take corrective action.
Agree audit criteria before the visit
Determine scope, processes, relevant ISO 27001 requirements, internal rules, locations and the necessary sampling. Clarify what falls outside this particular audit.
Test operating evidence
Review selected records, interview owners and test whether claimed activities actually occur. Distinguish a missing record from a control that is not implemented, and record objective evidence for every conclusion.
Report for action
Deliver clear findings, supporting evidence, management-level priorities and a basis for root-cause analysis and corrective action. The organisation remains responsible for remediation and follow-up.
Questions to settle before commissioning
Is an internal audit the same as a certification audit?
No. An internal audit supports management-system improvement and readiness; it does not issue ISO 27001 certification.
What if the auditor helped implement the controls?
Impartiality must be safeguarded. We agree audit responsibilities so a consultant does not simply audit their own work.
A practical first step
Test the ISMS before the certification body does.
Tell us your scope, certification timing and current ISMS status. We can determine the audit depth and whether the timing is right.
Discuss your ISO 27001 Internal Audit