Internal audit servicesIndependent, evidence-based, kept separate from implementation.

An internal audit required by a management-system standard (for example Clause 9.2 of ISO 27001, ISO 9001, ISO 45001, ISO 42001 or ISO 27701) performed on the organisation’s behalf by an independent provider. The audit remains the organisation’s own internal audit: it covers the organisation’s own requirements and the standard, reports to its management, and feeds its management review and corrective action. Outsourcing is the route the standards explicitly allow when internal impartiality cannot be achieved.

Because each answers a different question and the second two depend on independence. Implementation builds the system. Internal audit evaluates it on evidence for management and must be objective and impartial about what it audits. Certification is an independent decision by an accredited body. An organisation that buys all three from one source, or lets its implementer audit their own work, loses the independence that makes the audit worth having, and a UKAS-accredited certification body will test that independence.

An Engagement Quality Lead, a Principal Consultant who owns the scope, confirms the consultant’s independence and issues the report. The proposal names the lead and the consultant assigned to fieldwork, with their qualification evidence, before you confirm. Fieldwork is delivered by Aegentra’s consulting team; credentials held across the team include PECB ISO 27001 Lead Auditor, ISO 42001 Lead Auditor, CISA and CISM.

With scoping. An organisation of around ten people or fewer usually completes a short questionnaire, unless it already has a scope and Statement of Applicability to share. A larger organisation signs an NDA first, then shares the scope, the Statement of Applicability and the number of sites to be visited. The ten-person line is a working understanding agreed with each client, not a rule.

The proposed consultant’s profile with certificate numbers, qualifications and industry experience, a draft audit plan and the scope of work. The quote follows once you are satisfied with the consultant, and you can ask for a different consultant at any point before signing.

Some of our consultants audit for certification bodies. We ask which body certifies you and state in writing whether the proposed consultant has worked with your organisation or with that body. If there is a conflict, a different consultant is proposed, so the internal audit cannot compromise your certification audit.

As a fixed fee agreed in writing after scoping, quoted in pounds sterling plus VAT. ISO 27001 internal audits start from £1,500 + VAT for a smaller organisation with one clear scope; the other standards are quoted against the processes, activities, sites and sample depth in scope. The proposal states inclusions, exclusions and the total payable before work begins, and any additional work needs your written agreement first.

An integrated programme can share planning, interviews and the common management-system clauses, and we schedule combined audits where it saves time. The criteria, the operational evidence and the conclusions stay distinct for each standard, and the report shows coverage of each separately, because a certification body audits each certificate on its own evidence.

Remote by default for document review, interviews and record sampling, which keeps the fee down and the evidence trail clean. On-site observation is agreed in the proposal where the sample needs it: physical controls for ISO 27001, production or service delivery for ISO 9001, and work activities for ISO 45001, where it is usually the larger part of the audit. Aegentra is Australian-headquartered; UK engagements are delivered to UK organisations in England, Scotland, Wales and Northern Ireland in GBP plus VAT.