ISO 27001 – Internal Audit

Identify any gaps and pass your external audit on the first try

The internal audit identifies any gaps to pass your external audit on the first try or follow up on your continuous improvement process. Our seasoned experts use a distinct maturity rating and detailed reporting, providing you a clear picture of your security status and respective action items.

Why is the ISO 27001 internal audit a crucial process?

The ISO 27001 internal audit is a crucial process that involves a comprehensive review of an organisation’s Information Security Management System (ISMS). Its primary goal is to identify any gaps or shortcomings that could potentially impede the effectiveness of your ISMS and its objectives. ISO 27001 explicitly requires this internal audit function (as stated in clause 9.2).

Internal audits can be conducted by an independent third party, such as a consultancy. This is where we come in.

Our diligent internal audits provide the perfect foundation for your external certification audit, adhering fully to ISO 27001’s requirement for an “independent internal audit”. All too often, unqualified or biassed staff members conduct internal audits, putting your ISO 27001 certification and company at risk. But with us, you’re in safe hands!

At PCG, we’re committed to meeting your internal audit requirements. Our team of seasoned lead auditors is prepared and equipped to conduct robust internal audits for ISO 27001. With PCG, audit with confidence, secure your ISMS, and get certified successfully!

ISO 27001 internal audit highlights:

• Initial GAP analysis or recurring internal audits
• Comprehensive, full-scope audits
• Remote or on-site options as per your convenience
• Practical, implementable recommendations
• Current, cutting-edge knowledge
• Ensuring your successful certification on the first attempt

Fabian Weber, Head of Compliance

Your ISO 27001 Lead Auditor

Meet our Head of Compliance, Fabian Weber (B.Sc.). He is an internationally recognized ISO 27001 expert and ISO 27001 Lead Auditor. Over 30,000 IT-Security-Experts follow and trust Fabian Weber on LinkedIn. He has a decade of experience in cloud & information security. Fabian built up security strategies for companies of every size from startups to international enterprises. Compliance as a Service is the result to provide businesses a transparent and efficient state-of-the-art solution for their security frameworks.

The internal audit process

Take a look at our straightforward, easy-to-understand audit process. It is defined by clarity and simplicity, making a task often perceived as complex, truly accessible.See how we make auditing uncomplicated and transparent for you:

What does the audit consist of?

Our internal audits encompass a mix of document reviews, video checks of your premise, and remote discussions with your staff. We examine relevant documents to determine if your established processes and procedures are adhered to effectively.

Our exhaustive audit plan covers:

• Audit mission statement: Outlining objectives, criteria, and general information.
• Audit plan: Offering a detailed timeline featuring audit times, subjects, methods used, and your designated representatives.

Our comprehensive audit report encompasses:

• Audit specifics: Including duration, resources utilised, employees interviewed, and any interruptions or challenges faced.
• Maturity rating: A five-level assessment (ranging from “incomplete” to “optimised” as per ISO 29190).
• Evidence examination: Displaying the evidence examined and an audit trail for all areas within the ISO standard’s scope.
• Non-conformities: Pinpointing any areas that do not align with the ISO standard, thus supporting your continual improvement efforts.
• Positive findings: Highlighting areas where your organisation shows admirable practices and achievements.
• ISMS and Annex A spider diagram: Showcasing your actual versus target score.
• Management Summary: A straightforward, comprehensive summary outlining the relevant results.
• Detailed Audit Framework: An in-depth framework that corresponds to all ISO requirements and controls.

The Audit Framework details notes, recommendations, additional examples, and findings. Information is arranged per chapter, with average values derived for each. It shows the maturity status of your ISMS according to ISO 29190 and underlines areas where your team excelled and where it faced challenges.

These audit plans and reports act as essential documents for your organisation, demonstrating to external certification bodies that you’re fulfilling the internal audit requirements as per the ISO standard. The internal audits consist of a combination of document reviews and remote discussions with relevant management and staff members. Through the review of relevant documented information, we assess whether the established processes and procedures are being followed effectively.

Audit sneak peek

These screenshots give you a quick idea of what to expect from the output of your audit.

1. Organisational controls
2. Maturity stages
3. ISMS & Infosec controls status matrixes
4. Audit results - Part 1
5. Audit results - Part 2
6. Plan

How do we calculate the effort?

The pricing of our audit service depends on the scope of your ISMS and the size of your organisation. The following example efforts are calculated for a company with the following parameters:

• A remote audit
• SMB with 50 employees
• One location
• Low complexity
• One core product/service

Preparation phase: 0.5 days
Planning of the audit and initial review of the provided documentation.

Remote audit: 2 days
Conduction of the audit (interviews, systems checks, virtual walk through).

Reporting phase: 1 day
Report creation and closing meeting with the management.

Based on the calculation above, we estimate 3.5 days total audit effort.