Title: ISO 27001 internal audit > Independent ISO 27001 Clause 9.2 internal audits for UK organisations: fixed fee from £1,500 + VAT, remote or on site, findings tied to evidence, named lead. Source: https://aegentra.co.uk/services/govern/iso-27001-internal-audit Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT. Published: 2026-10-21 Updated: 2026-10-26 Licence: public web content; cite the source URL. Internal audit / United Kingdom # ISO 27001 internal audit — Outsourced Clause 9.2 audits, UK-wide. An ISO 27001 internal audit is the Clause 9.2 check that your ISMS conforms to the standard and to your own requirements, and is operating effectively, carried out by someone independent of the system. Aegentra delivers it for UK organisations as a fixed-fee outsourced audit from £1,500 + VAT, remotely or on site, with every finding tied to a criterion and the evidence sampled. Last reviewed 26 October 2026. Fees in pounds sterling plus VAT. [Discuss your scope](https://aegentra.co.uk/contact?subject=ISO%2027001%20internal%20audit) [See a working example](https://aegentra.co.uk/services/govern/iso-27001-internal-audit#working-example) An independent view. A finding you can act on. Scope and pricing ## Plan the work. Know the fee. Service fees are indicative. The written proposal confirms the agreed scope, applicable taxes and total payable before work begins. ### ISO 27001 internal audit From £1,500 + VAT Starting fee, excluding VAT · fixed fee after scoping A fixed scope and fee before the audit begins. - Audit objectives, criteria, scope and impartiality assessment - Risk-based plan, evidence requests, interviews and sampling - Findings tied to criteria and evidence, with an audit report and follow-up needs - Remote delivery across the UK, with on-site observation where agreed **Scope, inclusions and exclusions** Starting fee for a smaller organisation with one clear ISMS scope and straightforward evidence access. Remediation, additional sampling and follow-up verification are included only where stated in the proposal. [Discuss this scope](https://aegentra.co.uk/contact?subject=ISO%2027001%20internal%20audit) Before the quote ### What shapes the audit fee? - ISMS boundary, sites and complexity - Audit objectives, sample availability and previous findings - Report detail, access arrangements and follow-up scope The final proposal identifies included interviews, sampling, reporting and any follow-up. It does not include an independent certification-body decision or certificate. The £1,500 + VAT starting fee is subject to the agreed scope. Any additional work and its fee require written agreement before it begins. Fixed fee after scoping. Prices exclude VAT. Payment terms, third-party costs and exclusions will be stated in the written proposal. Standalone UK prices in GBP. Fees are agreed in writing for the confirmed scope. [Request a scoped proposal](https://aegentra.co.uk/contact?subject=ISO%2027001%20internal%20audit) Our commitment ## No hidden fees. Agreed in writing. Before work begins, we put the scope, deliverables, responsibilities, fee and delivery plan in writing. We deliver the agreed work against that written scope. - **Know what is included:** Your proposal states the fee, payment schedule, applicable tax treatment, dependencies and exclusions. Certification-body charges, licences and other third-party costs are identified separately where relevant. - **Approve any change first:** If you need additional work, we explain its scope, fee and effect on timing. We obtain your written agreement before starting that additional work. No unexpected add-ons. - **See what has been delivered:** We agree the outputs and completion criteria, then hand over the agreed records and explain any outstanding responsibilities. Certification decisions remain with the independent certification body. The requirement ## What ISO 27001 Clause 9.2 actually requires. Clause 9.2 of ISO/IEC 27001:2022 asks for internal audits at planned intervals that show whether the ISMS meets your own requirements and the standard, and whether it is implemented and maintained effectively. Six things have to be in place. - ### An audit programme Planned intervals, methods, responsibilities, planning requirements and reporting, weighted by the importance of each process and the results of previous audits. - ### Defined criteria and scope Each audit states what it is testing against: the clauses and controls in scope, your own policies and procedures, and the boundary of the ISMS. - ### Objective and impartial auditors Auditors must not audit their own work. Clause 9.2 allows the audit to be outsourced, which is how small teams usually meet this requirement. - ### Audits conducted on evidence Document review, interviews and a justified sample of operating records. The report has to say what was examined and what was not. - ### Results reported to management Findings reach the people who own the risk and the budget, graded and linked to the requirement they relate to. - ### Documented information retained The programme, the plans and the results are kept as evidence. Your certification body will ask to see them. How often ### Planned intervals, not a fixed calendar. ISO 27001 does not set a frequency. Clause 9.2.2 asks you to plan intervals around process importance, change and previous results. Certification bodies commonly expect every clause and applicable control to be covered across the three-year certification cycle, so most UK organisations run an annual audit and add coverage where risk or findings justify it. Who can audit ### Independent of the work, competent in the standard. An employee who did not design or operate the controls can audit them. In a team of ten, that person rarely exists, and a certification auditor will test the independence claim. An outsourced Clause 9.2 audit answers the question cleanly and documents the impartiality assessment. | Compare | Gap assessment | Internal audit (Clause 9.2) | Certification audit | | --- | --- | --- | --- | | Purpose | Find what is missing before you build or change the ISMS. | Evaluate whether the ISMS conforms and operates effectively, on sampled evidence. | Decide whether to issue, continue or withdraw a certificate. | | Who performs it | A consultant or your own team. | An objective, impartial auditor, internal or outsourced. | A certification body, UKAS-accredited in the UK. | | Output | A prioritised action list. | An audit report with graded findings and a corrective-action record. | A certificate, or nonconformities to close first. | | Mandatory | No. | Yes. Clause 9.2 requires it, before certification and throughout the cycle. | Only if you want the certificate. | | Aegentra’s role | [Implementation service](https://aegentra.co.uk/services/govern/iso-27001), scoped separately. | This service. | None. We never certify, and we say so. | Commissioning an ISO 27001 internal audit ## Prepare the evidence. Know what will be reported. An outsourced internal audit should answer a defined question about your ISMS. Agree the criteria, evidence access and reporting expectations before comparing proposals. ### Agree what is being audited Confirm the ISMS boundary, objectives, applicable ISO 27001 requirements, your own requirements and previous findings. Assess auditor competence and impartiality. **The output** An agreed audit plan identifying criteria, scope, methods, participants and information handling. ### Make the sample traceable Identify the population behind the records: for example, leavers in the review period, not only the best-completed tickets. Select a justified sample and record any access limitations. **The output** Evidence references, interview notes and a clear explanation of sample selection. ### Connect the finding to the requirement Compare the agreed criterion with what the sample supports. Explain contradictory or missing evidence and the effect on the conclusion. **The output** A report showing the criterion, evidence, finding and limitations—not an unexplained score. ### Agree action and follow-up Management decides and owns correction and corrective action. Agree who verifies completion and effectiveness, with the follow-up scope stated in writing. **The output** An action record with owner, due date, closure evidence and verification arrangements. ### An audit programme, not a one-off checklist. Plan frequency and coverage around the importance of the processes and previous results, revisiting the programme when circumstances change. A checklist is a preparation aid; it cannot establish impartiality, decide a sufficient sample or replace professional judgement. For example, a leaver account that remains active needs comparison with the agreed access-removal requirement and a review of the relevant sample. One exception does not prove that every account failed; a missing record does not automatically prove the task was never done. [Internal audit checklist and preparation guide](https://aegentra.co.uk/knowledge/iso-27001-internal-audit-checklist) [See a finding linked to evidence](https://aegentra.co.uk/services/govern/iso-27001-internal-audit#working-example) [Need implementation support instead?](https://aegentra.co.uk/services/govern/iso-27001) ### ISO 27001 internal audit plan and checklist template A working CSV you can open in Excel or Google Sheets: clauses 4 to 10 and ten Annex A controls, each with the criterion, the population to sample, the method and a findings column. Starter only; the agreed scope decides the final plan. [Download the template](https://aegentra.co.uk/downloads/aegentra-iso-27001-internal-audit-plan-template-uk.csv) How the audit runs ## Seven steps, one evidence trail. Every step produces a record you keep. The elapsed time depends on scope and evidence access, and it is agreed in the proposal rather than promised here. - ### Scope and plan Confirm objectives, the ISMS boundary, criteria and previous findings. Check auditor competence and impartiality. Agreed audit plan - ### Document review Read the policies, risk assessment, Statement of Applicability and audit programme against the clauses in scope. Evidence request list - ### Interviews Talk to control owners about how the process runs in practice, not how the document says it should. Interview notes - ### Sample and test Select a justified sample from the real population: leavers, changes, incidents, supplier reviews. Record what was examined. Evidence references - ### Grade findings Compare each sample with its criterion. Separate a missing record from a control that did not operate. Findings linked to clauses - ### Report Objectives, scope, methods, findings, limitations and conclusions, written for management and usable by your certification body. Audit report - ### Follow-up Management owns correction and corrective action. Agree who verifies closure and effectiveness, and when. Action record Remote by default: interviews, screen-shared walkthroughs and controlled evidence review. On-site observation is added where the sample needs it, and secure evidence handling is agreed before any access is granted. [Discuss your scope](https://aegentra.co.uk/contact?subject=ISO%2027001%20internal%20audit) The requirement in context ## Audit the operating system—not just the policy folder. An ISO 27001 internal audit evaluates the agreed ISMS criteria and sampled evidence. It is separate from an independent certification-body audit. For a UK customer assurance request, clarify which report or certificate they expect before commissioning the work. Primary references [ISO: information security management systems](https://www.iso.org/standard/27001) [UKAS: check a certification claim](https://www.ukas.com/certcheck/) Inside the work ## Follow one finding from criterion to closure. Fictional, limited sample. This example does not assert a breach across every account or predict the classification of a real audit finding. | Audit record | Example | Why it matters | | --- | --- | --- | | Criterion | The organisation’s approved leaver procedure requires access removal by the recorded departure time. | The criterion is explicit; the auditor does not invent a deadline. | | Sample and evidence | Three leavers are selected; one account remained enabled after the procedure’s deadline. | Record identifiers, dates, limitations and the evidence source without unnecessarily copying personal data. | | Finding | The sampled record does not demonstrate operation in accordance with the procedure. | Link the gap to the criterion and evidence, not an unsupported organisation-wide conclusion. | | Follow-up | Management corrects the account, investigates the cause and supplies evidence for the agreed effectiveness check. | Closing a ticket is not automatically proof that the cause has been addressed. | Fictional example · Not a client result, legal determination or complete audit checklist. [Download this working example (CSV)](https://aegentra.co.uk/downloads/govern-iso-27001-internal-audit-working-example.csv) [Read a completed engagement: 73 lines of enquiry, 0 nonconformities](https://aegentra.co.uk/case-studies/iso-27001-internal-audit) What you take away ## Evidence. Ownership. A practical next step. An independent examination of your ISMS against agreed audit criteria, using sampled evidence, clear findings and a practical follow-up record. - Audit objectives, criteria, scope and impartiality check - Risk-based audit plan and evidence requests - Interviews and sampling of agreed records - Findings linked to criteria and evidence - Audit report, limitations and agreed follow-up ### Separate responsibilities An internal audit is not certification. Where Aegentra also supports implementation, auditor competence and impartiality must be assessed and the audit assignment kept separate from work the auditor performed. Client feedback ## From the people we work with. Medical clinic · ISO 27001 [Read Aegentra’s Google reviews](https://www.google.com/maps?cid=8458460799648468871) How the work moves forward ## Agree. Examine. Follow up. Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced. - ### Agree the audit Confirm objectives, scope, criteria, competence, impartiality and secure evidence access. - ### Examine and report Use risk-based sampling, interviews and records; report findings and limitations. - ### Agree follow-up Assign management actions and define what evidence will support closure. How an engagement works ## Four stages before fieldwork. Nothing starts unsigned. Every engagement starts with an Engagement Quality Lead, a Principal Consultant accountable for the scope, the consultant’s independence and the issued report, and is delivered by Aegentra’s consulting team. You see the proposed consultant’s profile, certificate numbers, qualifications and industry experience before you confirm, and you can ask for a different consultant. - Stage 1 ### Scope first Organisations of around ten people or fewer usually complete a short questionnaire, unless they already have a scope and Statement of Applicability to share. Larger organisations sign an NDA first, then share the scope, the Statement of Applicability and the number of sites to be visited. The ten-person line is a working understanding agreed with you, not a rule. - Stage 2 ### Profile, plan and scope before any quote Before a quote you receive the proposed consultant’s profile with certificate numbers, qualifications and industry experience, a draft audit plan and the scope of work. If the fit is wrong, ask for a different consultant. - Stage 3 ### Independence, stated in writing Some of our consultants also audit for certification bodies. We ask which body certifies you and state plainly whether the proposed consultant has worked with your organisation or with that body, so the internal audit cannot compromise your certification audit. - Stage 4 ### Contract, then work The signed contract carries the agreed scope of work and the payment terms. The engagement is final when you sign, and work starts then. Who audits ### A named role. A consultant independent of your system. Fieldwork is assigned to an Aegentra consultant who had no part in designing or operating the system under audit. The proposal names that consultant and the Engagement Quality Lead, with their qualification evidence, before you confirm; you can ask for a different consultant. Credentials held across the team include PECB ISO 27001 Lead Auditor, ISO 42001 Lead Auditor, CISA and CISM. [Read a completed ISO 27001 internal audit engagement](https://aegentra.co.uk/case-studies/iso-27001-internal-audit) Aegentra is Australian-headquartered. UK engagements are delivered remotely to organisations in England, Scotland, Wales and Northern Ireland, with on-site observation where agreed, and quoted in pounds sterling plus VAT. Engagement Quality Lead Principal Consultant, Aegentra - **Starts the engagement:** Scoping conversation or questionnaire, NDA where needed, the proposed consultant’s profile and the draft audit plan before any quote. - **Accountable for:** The agreed scope, the consultant’s independence from your system and from your certification body, and the issued report. - **Named in:** Your proposal and the signed contract, alongside the consultant assigned to fieldwork and their qualification evidence. - **Delivery team:** Aegentra consultants; credentials held across the team include PECB ISO 27001 Lead Auditor, ISO 42001 Lead Auditor, CISA and CISM. [About the practice](https://aegentra.co.uk/about) [Start a scoping conversation](https://aegentra.co.uk/contact?subject=Internal%20audit%20scoping) Your delivery team ## Team qualifications and credentials. Qualifications, professional credentials and formal training held across Aegentra’s delivery team. Credentials are held across the delivery team and matched to assigned roles. The proposal identifies the consultants, responsibilities and relevant qualification evidence before work begins. ### Management systems and audit - ISO/IEC 27001 Lead Implementer - ISO/IEC 27701 Lead Implementer - PECB ISO/IEC 27001 Lead Auditor - ISO/IEC 42001 Lead Auditor - CISA — Certified Information Systems Auditor - ISM Auditor ### Cybersecurity and cloud - CISSP — Certified Information Systems Security Professional - CISM — Certified Information Security Manager - Certificate of Cloud Security Knowledge (CCSK) - OSCP+ — OffSec Certified Professional Plus ### Service delivery and specialist training - ITIL Expert - PRINCE2 - Mastering Generative AI for Cybersecurity Certificate - Essential Eight Assessment Course certificate — TAFEcyber ### Further training and audit qualifications Further training and audit qualifications across the team include ISO/IEC 42001 Lead Implementer training, ASD ISM General and Technical audit codes, ISO/IEC 27017 and ISO/IEC 27018 audit codes, and ISO 9001 and ISO 19011 audit qualifications. ### Relevant competence. Clear responsibilities. For internal audit, competence, objectivity, impartiality and prior involvement are checked before the work is accepted. Implementation, internal audit and independent certification have separate roles. These are individual qualifications held across the wider team, not a claim that every consultant holds every credential or that Aegentra is an accredited certification body. [Read about our team’s capability](https://aegentra.co.uk/about#team) Where we work ## ISO 27001 internal audits across the United Kingdom. Available to organisations in England, Scotland, Wales and Northern Ireland. Most engagements run remotely, which keeps the fee down and the evidence trail clean. On-site observation is agreed in the proposal where the sample needs it. Fees are quoted in pounds sterling plus VAT, with the scope, deliverables and fee fixed in writing before work begins. Where a customer, tender or certification body has asked for something specific, we check that requirement first. - London - Manchester - Birmingham - Leeds - Bristol - Edinburgh - Glasgow - Cardiff - Belfast - ### England London, Manchester, Birmingham, Leeds, Bristol and the regions between. - ### Scotland Edinburgh, Glasgow, Aberdeen and remote delivery nationwide. - ### Wales Cardiff, Swansea and remote delivery nationwide. - ### Northern Ireland Belfast and remote delivery nationwide. - ### Remote-first delivery Interviews and evidence review over secure screen share, with information handling agreed before access. On-site days only where the sample needs them. A practical starting point ## What makes an audit finding useful? A useful finding identifies the criterion, what was sampled, the condition observed and the gap supported by that evidence. Follow-up distinguishes correction of the immediate issue from action on its cause. Fictional working exampleA fictional audit samples three leaver records against the organisation’s access-removal procedure. One account remained enabled beyond the stated deadline. The report records the sample and criterion; management investigates the cause and provides evidence of corrective action. The sample does not establish the condition of every account. Before you commission the work ## Your questions. Clear answers. **Can Aegentra audit an ISMS it helped implement?** Only with an appropriate, documented competence and impartiality assessment. Assign a different auditor from the person who performed the implementation work and assess any remaining conflict. A separate name alone does not resolve every impartiality risk. **Is an internal audit a gap assessment or certification audit?** No. A gap assessment helps plan improvements; an internal audit evaluates the management system against agreed criteria; a certification body makes its own certification decision. The objectives and outputs should be explicit. **Do you provide an ISO 27001 internal audit checklist?** The audit plan and evidence requests follow the agreed scope, risks and criteria. A generic checklist can prompt questions but cannot decide the sample, evaluate evidence or replace auditor judgement. **Will you examine every account and every transaction?** Not unless that is specifically agreed and feasible. Audits use sampling. The report should explain what was examined and the limitations, rather than imply exhaustive assurance. **Do you fix the findings for us?** Management owns correction and corrective action. Implementation help, if requested, is scoped separately and must not compromise the auditor’s impartiality in subsequent work. **How much does an internal audit cost?** ISO 27001 internal audit starts from £1,500 + VAT for a smaller organisation with a clear ISMS scope and accessible evidence. This is an indicative GBP starting fee. The final fixed fee depends on scope, complexity, sampling, access and follow-up. The written proposal confirms any applicable taxes and the total payable. Request a like-for-like scope instead of relying on a generic daily rate. **Do we need an internal audit service or a Lead Auditor course?** Commission this service when your organisation needs a scoped examination and findings. Choose a Lead Auditor course when an individual needs to develop audit knowledge and prepare for the PECB exam. Training does not fulfil an organisation’s audit programme by itself. **Can the internal auditor audit their own implementation?** We check competence, conflicts and impartiality before assigning the work. Where Aegentra has supported implementation, the internal audit needs a different auditor and appropriate safeguards; if impartiality cannot be established, the assignment should not proceed on that basis. Separate names alone do not resolve every conflict. **What should we prepare for a scoping conversation?** Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately. **What are the ISO 27001 internal audit requirements?** Clause 9.2 addresses whether the ISMS meets the organisation’s own requirements and ISO 27001 requirements, and whether it is implemented and maintained effectively. An audit programme needs planned intervals, defined responsibilities and methods, appropriate criteria and scope, objective and impartial auditing, reporting to relevant management, and retained programme and results evidence. **How often should we conduct an ISO 27001 internal audit?** Set and document the frequency in your audit programme. Consider process importance, risk, changes and previous audit results. ISO 27001 does not prescribe one universal annual schedule for every organisation. An annual cycle may form part of your programme, with additional attention where risk or findings justify it. **How do we prepare for an ISO 27001 internal audit?** Prepare the agreed scope, risk assessment and treatment records, Statement of Applicability, policies, audit programme, previous findings and management-review records. Identify owners and sample populations for operational evidence such as access changes, releases, incidents and supplier reviews. Agree secure access and interviews; do not email passwords or upload confidential records into an enquiry form. **What should an ISO 27001 internal audit report contain?** The objectives, scope and criteria; methods and sampling; findings linked to evidence and requirements; and conclusions with their limitations. Each corrective-action item needs an accountable owner and agreed follow-up arrangements. The report should distinguish a missing record from evidence that a control did not operate, rather than turn every observation into the same finding. **Can the internal audit be delivered remotely?** Remote interviews and controlled evidence review may suit some scopes. We assess whether those methods can produce sufficient appropriate evidence and whether onsite observation is needed. Delivery method, access controls, information handling and limitations are agreed before work starts; remote delivery does not mean reduced audit criteria. **How does an internal audit engagement start?** With scoping. An organisation of around ten people or fewer usually completes a short questionnaire, unless it already has a scope and Statement of Applicability to share. A larger organisation signs an NDA first, then shares the scope, the Statement of Applicability and the number of sites to be visited. The ten-person line is a working understanding agreed with each client, not a rule. **What do we receive before the quote?** The proposed consultant’s profile with certificate numbers, qualifications and industry experience, a draft audit plan and the scope of work. The quote follows once you are satisfied with the consultant, and you can ask for a different consultant at any point before signing. **Can the consultant also work for our certification body?** Some of our consultants audit for certification bodies. We ask which body certifies you and state in writing whether the proposed consultant has worked with your organisation or with that body. If there is a conflict, a different consultant is proposed, so the internal audit cannot compromise your certification audit. **When is the engagement confirmed?** When you sign the contract. It carries the agreed scope of work and the payment terms you accepted. Work starts after signature, not before. **Who is accountable for the quality of the audit?** An Engagement Quality Lead, a Principal Consultant who owns the scope, confirms the consultant’s independence and issues the report. The proposal names the lead and the consultant assigned to fieldwork, with their qualification evidence, before you confirm. Fieldwork is delivered by Aegentra’s consulting team; credentials held across the team include PECB ISO 27001 Lead Auditor, ISO 42001 Lead Auditor, CISA and CISM. ## Resources for this decision. [ISO 27001 certification in the UK: scope, costs and responsibilities](https://aegentra.co.uk/knowledge/iso-27001-certification-uk) [ISO 27001 Clause 9.2: internal audit requirements explained](https://aegentra.co.uk/knowledge/iso-27001-clause-9-2-internal-audit-requirements) [How to conduct an ISO 27001 internal audit: seven steps and templates](https://aegentra.co.uk/knowledge/how-to-conduct-an-iso-27001-internal-audit) [ISO 27001 internal audit checklist: Clauses 4 to 10 and Annex A](https://aegentra.co.uk/knowledge/iso-27001-internal-audit-checklist) [What an ISO 27001 internal audit costs in the UK](https://aegentra.co.uk/knowledge/iso-27001-internal-audit-cost-uk) [ISO 27001 internal audit case study](https://aegentra.co.uk/case-studies/iso-27001-internal-audit) [ISO 27001 and Cyber Essentials: which one the requirement actually asks for](https://aegentra.co.uk/knowledge/iso-27001-and-cyber-essentials) [Internal audit plan and checklist template (CSV)](https://aegentra.co.uk/downloads/aegentra-iso-27001-internal-audit-plan-template-uk.csv) Choose the right route ## Connected work. Distinct responsibilities. Commission organisational support, build your own knowledge or clarify what a customer has requested. ### Related services [All internal audit services](https://aegentra.co.uk/services/internal-audit) [ISO 27001 implementation](https://aegentra.co.uk/services/govern/iso-27001) [ISO 42001 internal audit](https://aegentra.co.uk/services/govern/iso-42001-internal-audit) ### Develop your knowledge [ISO 27001 lead auditor course & exam](https://aegentra.co.uk/academy/iso-27001-lead-auditor) [Read the decision guide](https://aegentra.co.uk/knowledge/checking-certification) ## Let’s define the work you actually need. Tell us what you need to achieve, what is in scope and where you are starting. [Talk about your project](https://aegentra.co.uk/contact)