Get in touch

Get in touch

  • This field is for validation purposes and should be left unchanged.

Privacy Notice


When you submit an enquiry via our website, we use the personal data you supply to respond to your query, including providing you with any requested information about our products and services. We may also email you several times after your enquiry in order to follow up on your interest and ensure that we have answered your it to your satisfaction. We will do this based on our legitimate interest in providing accurate information prior to a sale. Your enquiry is stored and processed as an email which is hosted by Microsoft within the European Economic Area (EEA). We keep enquiry emails for two years, after which they are securely archived and kept for seven years, when we delete them.

Reveal Menu

ISO27001 Internal Audit Services

In order to meet the requirements of clause 9.2 of the ISO27001 standard certification audit, you need to have evidence of a completed internal audit of your management system by an ISO27001 auditor.  If you haven’t got an internal auditor within your organization or the time and resource to train one, then outsourcing your internal audit is the best option.

If this is your first certification audit or you’re recertifying, you’ll need to complete an internal audit of your full ISMS. If it’s your annual surveillance audit you may only require an internal audit of certain management system requirements or specific controls of Annex A, such as A.6, A.8 etc, in accordance with a defined audit schedule.

Whatever your internal audit requirements, CertiKit can help. Our qualified ISO27001 lead auditors are based in the UK and can provide an internal audit service remotely via MS Teams to clients +/- five hours of the UK time zone.

Find out more information below about the different ways we can help your organization meet the internal audit requirement of the standard.

ISO27001 Internal Audit Services

ISO27001 Internal Audit

Whether you’re looking for a one-off internal audit or for a managed service to fulfil your regular internal audit schedule over one or more years, our experienced lead auditors can take the stress out of the process and ensure you remain compliant to the ISO27001 standard.

The audits will consist of a combination of document review and remote discussions with appropriate management and staff. Relevant documented information will be reviewed as evidence that the defined processes and procedures are being followed. After the audit we provide a professionally compiled report that details:

  • The agenda and all areas audited within the ISMS and Statement of Applicability in line with your requested scope.
  • Evidence examined and audit trail for all areas of the standard included.
  • Positive findings – the things your organization is doing well.
  • Nonconformities – areas found to be non-compliant against the requirements of the ISO27001 standard which you can then use to drive continual improvement.
  • The report can be used by your organization to demonstrate to your external certification body that you are meeting the internal audit requirements of the standard.
Internal Audit Quote

ISO27001 Pre-certification audit

If you’re preparing for your first certification or think your management system is need of a full review, our ISO27001 pre-certification audit is the right option. Delivered remotely by qualified auditors, our 3-day pre-certification audit is an internal review of ALL areas of the ISO27001 standard, including your applicable Annex A controls. The deliverable is a professionally-produced internal audit report that your certification auditor will want to see.

What will the pre-certification audit include?

  • An agreed audit plan for the three days.
  • Opening meeting to understand your organization and your ISMS.
  • An internal audit of ALL areas of the ISO27001 standard, including the applicable Annex A controls.
  • Closing meeting to present and discuss the audit results.
  • A professionally produced audit report detailing the findings and all areas audited within the ISMS and Statement of Applicability in line with your requested scope.
  • Answers to any outstanding questions in your run up to a certification audit.

Available at a discounted rate for three days and an easy booking process, click below to find out more.

ISO27001 Pre-certification Audit

Work with our experienced team

ISO Certification Ready

Meet the requirements of the standard easily with our ISO27001 internal audit service.

Qualified experts

All our ISO 27001 services are delivered by certified lead auditors with years of experience.

Bespoke delivery

Remote delivery and can accommodate +/- five hours of the UK time zone.

What our clients say


Very knowledgeable of the content, and provided great information for us as this entire process is new to us. We look forward to working with Jerry again in the future.

Media Cluster GmBH, Germany

Thanks Jerry and CertiKit for a very satisfying audit experience. Invaluable input on several points regarding our certification efforts we were still struggling with.

Receive your bespoke quote today!

Let us help you meet your ISO27001 internal auditing requirements in three simple steps.

  1. Submit an enquiry using the contact form.
  2. You’ll be sent a booking form to detail your requirements and send back to us.
  3. Our ISO27001 lead auditor will assess your requirements and outline the most suitable audit solution for your organization.

Please note, CertiKit’s audits are performed remotely via MS Teams by our consultants in the UK and are most suitable for organizations +/- 5 hours of UK time zone. CertiKit are not a Registered Certification Body and cannot provide you with a formal management system certification.

  • Privacy Policy


    When you submit an auditing enquiry, we use your name, company name (which is optional), email address, phone number and country to contact you about this service. We take your country data to assess your suitability for our services. We may also email or call you after your enquiry in order to follow up on your interest in our services. We will do this based on our legitimate interest in marketing to prospects for our products and services. Your details are stored on our website which is hosted with Digital Ocean. Your personal data is stored for one year after your enquiry submission, after which it is deleted.

ISO27001 Internal Auditing FAQs

How can an internal audit help prepare for the certification audit?

Internal audits are a requirement of the ISO27001 standard, clause 9.2 to be specific.  A certification auditor will verify that you are carrying out internal audits to your audit schedule, and are providing the relevant audit evidence (reports and any nonconformities) and that the audit programme is being managed.  Certification bodies will also check that the outputs of audits are being reviewed in your management review meetings to identify areas of weakness or areas for improvement.

How often does the management system need to be internally audited?

If this is your first certification audit you will need to have completed an internal audit of the full management system and have evidence of this in the form of the report before the stage 2 audit. After this, most certification auditors allow the management system to be internally audited over the three year recertification period of which will be managed with an internal audit program decided by your organization.

How long will an internal audit take?

This depends on the scope of the audit and if there are multiple sites, or business functions that fall under that audit scope.  Time also needs to be factored in for evidence gathering, writing the audit report along with any audit findings and nonconformities that may be identified.

What are the additional benefits of an internal audit?

  • Confirms the health of your management system, the way it is operating and the efficiency of the business processes i.e. Is it wasting time, effort, and cash on inefficient processes?
  • Ensures that your company operations, processes and procedures comply with statutory, regulatory and management system requirements.
  • Gives senior management visibility into the effectiveness or weaknesses of the management system as part of the management review requirements.

Does the internal audit need to be outsourced? 

No this isn’t a requirement, however it is a requirement that the internal auditor must be independent of the management system. This means if you’ve worked on implementing all or part of the management system you’re not able to audit your own work. This is why many organizations find it easier to outsource this to ensure compliance.

Does the internal auditor need to have qualifications? 

Again this isn’t a requirement, however the more experience and knowledge your internal auditor has the better the internal audit will be. From knowing what to look for, what questions to ask departments and ensuring a comprehensive audit that will match the certification auditors so there are no nasty surprises at the stage two certification audit.

Who is required at the internal audit?   

Representatives within the scope of activities being audited will need to interviewed, plus any other representatives as needed. Your internal auditor, whether this is in-house or outsourced will provide you with a schedule of interviewees based on their involvement with a certain business function or within the management system.

How frequently does an organization need an internal audit?

It is a requirement of the standard that an organization defines an audit plan covering a period of time, typically organizations prepare an annual audit schedule showing which functions or areas of the standard are to be audited at a particular time.  Internal audits should be carried out in accordance with the audit schedule.

How much do internal audits cost?  

This is dependent on multiple factors from audit scope to size of the organization and number of sites. Submitting an enquiry and completing our audit booking form is the best way to get a quote specific to your organization.