Title: ISO 27001 Case Studies

> Aegentra UK case studies: real ISO 27001 internal audit and Stage 2 readiness engagements, with scope, method, findings and outcomes. No client is named.

Source: https://aegentra.co.uk/case-studies  
Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT.  
Updated: 2026-11-06  
Licence: public web content; cite the source URL.

Case studies

# What the work — actually looked like.

Engagement records from Aegentra’s governance and assurance practice: the scope, the method, what was found and how it was closed out. Each record says which organisation it concerns in general terms only; no client is named without written approval on file.

Case study / United Kingdom · Published 6 November 2026

## ISO 27001 Stage 1 Passed, Stage 2 Postponed: Why an Internal Audit Could Not Be Skipped

A UK professional services group passed Stage 1 without an internal audit. Here is how the gap was closed and Stage 2 readiness achieved. Written by Harry Sidhu from the engagement Aegentra’s consultants delivered.

[Read the case study](https://aegentra.co.uk/case-studies/iso-27001-stage-1-passed-stage-2-postponed)
[ISO 27001 internal audit service](https://aegentra.co.uk/services/govern/iso-27001-internal-audit)

Engagement record / Australian client, UK edition · Published 26 October 2026

## ISO 27001 internal audit case study: a Clause 9.2 audit met with evidence

A small technology company certified to ISO/IEC 27001:2022 needed an independent Clause 9.2 audit before its first surveillance audit: 73 lines of enquiry, 47 Annex A controls sampled, no nonconformities, reported within four business days.

[Read the case study](https://aegentra.co.uk/case-studies/iso-27001-internal-audit)
[ISO 27001 internal audit service](https://aegentra.co.uk/services/govern/iso-27001-internal-audit)

How these are written

## One engagement, not a promise.

Every record describes one engagement as it ran: what was audited or built, what was found and how it was reported. A result reflects that organisation on those days. Certification is the certification body’s decision, and no consultancy can promise it in advance. Figures come from the engagement record; nothing is added.

[Internal audit services](https://aegentra.co.uk/services/internal-audit)

[ISO 27001 implementation](https://aegentra.co.uk/services/govern/iso-27001)

[Knowledge hub](https://aegentra.co.uk/knowledge)