ISO 27001 internal auditOutsourced Clause 9.2 audits, UK-wide.

Only with an appropriate, documented competence and impartiality assessment. Assign a different auditor from the person who performed the implementation work and assess any remaining conflict. A separate name alone does not resolve every impartiality risk.

No. A gap assessment helps plan improvements; an internal audit evaluates the management system against agreed criteria; a certification body makes its own certification decision. The objectives and outputs should be explicit.

The audit plan and evidence requests follow the agreed scope, risks and criteria. A generic checklist can prompt questions but cannot decide the sample, evaluate evidence or replace auditor judgement.

Not unless that is specifically agreed and feasible. Audits use sampling. The report should explain what was examined and the limitations, rather than imply exhaustive assurance.

Management owns correction and corrective action. Implementation help, if requested, is scoped separately and must not compromise the auditor’s impartiality in subsequent work.

ISO 27001 internal audit starts from £1,500 + VAT for a smaller organisation with a clear ISMS scope and accessible evidence. This is an indicative GBP starting fee. The final fixed fee depends on scope, complexity, sampling, access and follow-up. The written proposal confirms any applicable taxes and the total payable. Request a like-for-like scope instead of relying on a generic daily rate.

Commission this service when your organisation needs a scoped examination and findings. Choose a Lead Auditor course when an individual needs to develop audit knowledge and prepare for the PECB exam. Training does not fulfil an organisation’s audit programme by itself.

We check competence, conflicts and impartiality before assigning the work. Where Aegentra has supported implementation, the internal audit needs a different auditor and appropriate safeguards; if impartiality cannot be established, the assignment should not proceed on that basis. Separate names alone do not resolve every conflict.

Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately.

Clause 9.2 addresses whether the ISMS meets the organisation’s own requirements and ISO 27001 requirements, and whether it is implemented and maintained effectively. An audit programme needs planned intervals, defined responsibilities and methods, appropriate criteria and scope, objective and impartial auditing, reporting to relevant management, and retained programme and results evidence.

Set and document the frequency in your audit programme. Consider process importance, risk, changes and previous audit results. ISO 27001 does not prescribe one universal annual schedule for every organisation. An annual cycle may form part of your programme, with additional attention where risk or findings justify it.

Prepare the agreed scope, risk assessment and treatment records, Statement of Applicability, policies, audit programme, previous findings and management-review records. Identify owners and sample populations for operational evidence such as access changes, releases, incidents and supplier reviews. Agree secure access and interviews; do not email passwords or upload confidential records into an enquiry form.

The objectives, scope and criteria; methods and sampling; findings linked to evidence and requirements; and conclusions with their limitations. Each corrective-action item needs an accountable owner and agreed follow-up arrangements. The report should distinguish a missing record from evidence that a control did not operate, rather than turn every observation into the same finding.

Remote interviews and controlled evidence review may suit some scopes. We assess whether those methods can produce sufficient appropriate evidence and whether onsite observation is needed. Delivery method, access controls, information handling and limitations are agreed before work starts; remote delivery does not mean reduced audit criteria.

With scoping. An organisation of around ten people or fewer usually completes a short questionnaire, unless it already has a scope and Statement of Applicability to share. A larger organisation signs an NDA first, then shares the scope, the Statement of Applicability and the number of sites to be visited. The ten-person line is a working understanding agreed with each client, not a rule.

The proposed consultant’s profile with certificate numbers, qualifications and industry experience, a draft audit plan and the scope of work. The quote follows once you are satisfied with the consultant, and you can ask for a different consultant at any point before signing.

Some of our consultants audit for certification bodies. We ask which body certifies you and state in writing whether the proposed consultant has worked with your organisation or with that body. If there is a conflict, a different consultant is proposed, so the internal audit cannot compromise your certification audit.

When you sign the contract. It carries the agreed scope of work and the payment terms you accepted. Work starts after signature, not before.

An Engagement Quality Lead, a Principal Consultant who owns the scope, confirms the consultant’s independence and issues the report. The proposal names the lead and the consultant assigned to fieldwork, with their qualification evidence, before you confirm. Fieldwork is delivered by Aegentra’s consulting team; credentials held across the team include PECB ISO 27001 Lead Auditor, ISO 42001 Lead Auditor, CISA and CISM.