ISO 27001 & ISO 42001 Internal Audit

A clause-by-clause audit of your management system against ISO/IEC 27001:2022 (ISMS) or ISO/IEC 42001:2023 (AIMS). We review your scope, risk assessment and treatment, Statement of Applicability, policies, control implementation evidence, and your internal audit and management review records – and we interview the people who actually operate the controls.

A gap analysis is a readiness exercise you run before or during implementation. An internal audit is a formal requirement of the standard itself (clause 9.2) – a systematic, evidence-based audit of your operating management system that produces the nonconformities and observations your certification body expects to see addressed. Compare with our cybersecurity gap analysis service.

Most engagements complete within two to four weeks, depending on the size of your organisation and the audit scope. This covers document review, evidence sampling, interviews, reporting, and the findings walkthrough session.

Ideally six to eight weeks before your external certification or surveillance audit. That leaves enough time to work through the prioritised remediation plan and close findings before the external auditor arrives.

Both are possible. Most engagements are delivered remotely; where on-site work would add value, we discuss it during scoping before the engagement starts.

AUD $7,000 + GST covers the full engagement: the internal audit report, the nonconformity and observation log, the prioritised remediation plan, and the findings walkthrough session. No hourly billing and no surprise extras.