ISO Internal Audit. By Practitioners, Not Paper Reviewers.

What We Do

We review your ISMS, AIMS, or PIMS scope, risk treatment plan, Statement of Applicability, and prior audit findings. We build an audit plan weighted by risk and certification focus areas, and schedule interviews with control owners.

What You Get

Audit Plan:
A formal audit plan scoped to your management system, weighted by risk areas and aligned with certification body expectations.

Audit Schedule:
A detailed timeline with dates, interview slots, and document request lists so your team can prepare without disruption.

Interview Roster:
A list of control owners and process stakeholders to be interviewed, with topics and evidence expectations for each session.

What We Do

We review policies, procedures, risk assessments, management review minutes, and previous audit reports for completeness and currency. We verify that documentation reflects the current state of operations, not a snapshot from initial certification.

What You Get

Document Review Findings:
A detailed assessment of every reviewed document, noting gaps in coverage, outdated references, missing approvals, and areas where documentation doesn't match practice.

Gap Identification:
A prioritized list of documentation gaps and deficiencies that require attention before the certification audit.

What We Do

We test the design and operating effectiveness of every applicable control. ISO 27001: 93 Annex A controls. ISO 42001: AI-specific controls. ISO 27701: privacy extension controls. We sample evidence, verify configurations, and confirm that controls produce the expected outcomes.

What You Get

Control Testing Workpapers:
Detailed testing documentation for every applicable control, including the test performed, evidence reviewed, and conclusion reached.

What We Do

We interview control owners to confirm they understand their responsibilities and can demonstrate them. We test whether documented processes reflect actual practice, and identify areas where institutional knowledge hasn't been captured in procedures.

What You Get

Interview Notes:
Structured notes from every interview, documenting what was asked, what was demonstrated, and any discrepancies between documentation and practice.

Process Verification Results:
A summary of where actual operations align with documented procedures and where gaps exist that a certification auditor would flag.

What We Do

We produce a formal internal audit report with nonconformities (major and minor), observations, evidence gaps, and remediation recommendations prioritized by certification risk. The report satisfies ISO Clause 9.2 requirements for documented audit results.

What You Get

Formal Internal Audit Report:
A complete audit report that satisfies Clause 9.2 requirements, with every finding classified, referenced to specific clauses, and supported by evidence.

Nonconformity Register:
A structured register of all major and minor nonconformities with clause references, evidence citations, and recommended corrective actions.

What We Do

We walk through every finding with your team, help prioritize fixes by certification risk, and provide management review input (Clause 9.3). We offer optional follow-up to verify corrective actions have been implemented and are effective.

What You Get

Remediation Roadmap:
A prioritized plan for addressing every finding, ordered by certification risk and effort, with clear ownership and target dates.

Management Review Input:
Audit results formatted for Clause 9.3 management review, including trends, risk implications, and recommended actions for leadership.

Corrective Action Verification:
Optional follow-up assessment confirming that corrective actions have been implemented, are effective, and will withstand certification body scrutiny.