The internal audit identifies any gaps to pass your external audit on the first try or follow up on your continuous improvement process. Our seasoned experts use a distinct maturity rating and detailed reporting, providing you a clear picture of your security status and respective action items.
The ISO 27001 internal audit is a crucial process that involves a comprehensive review of an organisation’s Information Security Management System (ISMS). Its primary goal is to identify any gaps or shortcomings that could potentially impede the effectiveness of your ISMS and its objectives. ISO 27001 explicitly requires this internal audit function (as stated in clause 9.2).
Internal audits can be conducted by an independent third party, such as a consultancy. This is where we come in.
Our diligent internal audits provide the perfect foundation for your external certification audit, adhering fully to ISO 27001’s requirement for an “independent internal audit”. All too often, unqualified or biassed staff members conduct internal audits, putting your ISO 27001 certification and company at risk. But with us, you’re in safe hands!
At PCG, we’re committed to meeting your internal audit requirements. Our team of seasoned lead auditors is prepared and equipped to conduct robust internal audits for ISO 27001. With PCG, audit with confidence, secure your ISMS, and get certified successfully!
Fabian Weber, Head of Compliance
Meet our Head of Compliance, Fabian Weber (B.Sc.). He is an internationally recognized ISO 27001 expert and ISO 27001 Lead Auditor. Over 30,000 IT-Security-Experts follow and trust Fabian Weber on LinkedIn. He has a decade of experience in cloud & information security. Fabian built up security strategies for companies of every size from startups to international enterprises. Compliance as a Service is the result to provide businesses a transparent and efficient state-of-the-art solution for their security frameworks.
Take a look at our straightforward, easy-to-understand audit process. It is defined by clarity and simplicity, making a task often perceived as complex, truly accessible.See how we make auditing uncomplicated and transparent for you:
Our internal audits encompass a mix of document reviews, video checks of your premise, and remote discussions with your staff. We examine relevant documents to determine if your established processes and procedures are adhered to effectively.
Our exhaustive audit plan covers:
Our comprehensive audit report encompasses:
The Audit Framework details notes, recommendations, additional examples, and findings. Information is arranged per chapter, with average values derived for each. It shows the maturity status of your ISMS according to ISO 29190 and underlines areas where your team excelled and where it faced challenges.
These audit plans and reports act as essential documents for your organisation, demonstrating to external certification bodies that you’re fulfilling the internal audit requirements as per the ISO standard. The internal audits consist of a combination of document reviews and remote discussions with relevant management and staff members. Through the review of relevant documented information, we assess whether the established processes and procedures are being followed effectively.
These screenshots give you a quick idea of what to expect from the output of your audit.
The pricing of our audit service depends on the scope of your ISMS and the size of your organisation. The following example efforts are calculated for a company with the following parameters:
Preparation phase: 0.5 days
Planning of the audit and initial review of the provided documentation.
Remote audit: 2 days
Conduction of the audit (interviews, systems checks, virtual walk through).
Reporting phase: 1 day
Report creation and closing meeting with the management.
Based on the calculation above, we estimate 3.5 days total audit effort.
Full report covering all ISO 27001 controls
Knowledge in auditing, IT operations & tools
Detailed and easy to understand report
State-of-the-art knowledge with focus on modern technology and hands-on infosec
Experience the future of auditing and see firsthand how we are transforming the industry standard for the better. Should you wish to discuss your unique journey towards ISO 27001 certification, don’t hesitate to schedule your introductory call with us.
Press release announcing PCG's achievement of the new AWS Advertising & Marketing Tech Competency in DCX, transforming digital customer experiences.
A Practical Example from the Financial Industry: Establishment, Migration & Operation of an SAP Landscape in the AWS Cloud.
United for the Future: How FC Augsburg Strengthens Community Management Sustainably with Cloud Technology
It confirms the health of your management system and assesses its operational efficiency, including identifying any inefficiencies in processes that may result in wasted time, effort, or resources.
It ensures compliance with statutory, regulatory, and management system requirements in your company’s operations, processes, and procedures.
It provides senior management with visibility into the effectiveness or weaknesses of the management system, fulfilling the management review requirements.
Internal audits are a prerequisite for the certification audit. Certification auditors verify that internal audits are conducted according to the audit schedule, and they examine the relevant audit evidence (reports and any nonconformities). Certification bodies also assess whether audit outputs are reviewed in management review meetings to identify weaknesses and areas for improvement.
The duration of an internal audit depends on the audit scope, the presence of multiple sites or business functions within that scope, and the time required for evidence gathering and report writing, including any identified audit findings and nonconformities.
The cost of internal audits depends on various factors, including the audit scope, organisation size, and number of sites. To receive an offer tailored to your organisation, it is recommended to submit an inquiry.
The standard mandates that organisations establish an audit plan for a specified timeframe. Typically, organisations create an annual audit schedule, indicating which functions or areas of the standard will be audited at specific times. Internal audits should align with this audit schedule.
Representatives involved in the audited activities, along with any additional representatives as necessary.