Description
Independent ISO 27001 Internal Audit, Delivered Remotely
ISO/IEC 27001 Clause 9.2 requires an internal audit of your information security management system (ISMS) before certification and every year after. The auditor must be competent and must not audit their own work. In most small and mid-sized organisations, nobody meets both conditions: the people who know the ISMS well enough to audit it are the people who built it.
Governance Docs performs that audit for you. A Lead Auditor with no role in your ISMS audits it against ISO/IEC 27001:2022 (including Amendment 1:2024) and your own policies, then gives you the full Clause 9.2 evidence trail your certification body expects to see.
Packages
| Package |
Best for |
Effort |
Price (USD) |
| Essentials |
Up to 50 people in scope, one site plus cloud |
About 2 auditor days |
$2,750 |
| Standard |
51 to 250 people in scope, or two sites |
About 3 auditor days |
$4,250 |
| Annual Programme |
Two Essentials audits about 12 months apart, same Lead Auditor: covers your pre-certification and first surveillance-year audits |
2 audit cycles |
$4,950 per year |
Rush delivery (start within 5 business days, report within 2 business days of the closing meeting) adds 20% to the audit fee. Need more than your package covers? Add an additional site ($750) or a corrective-action verification ($650). Larger scopes are quoted on request.
What You Receive
- Audit plan: objectives, scope, criteria, sampling approach and session schedule, agreed before fieldwork.
- Remote audit sessions: four half-day sessions on screen-share, plus opening and closing meetings.
- Internal audit report: findings graded as major nonconformity, minor nonconformity or opportunity for improvement, each with objective evidence. Ready to take to management review.
- Nonconformity & corrective action register: every finding pre-loaded so you can record correction, root cause and corrective action (Clause 10.2).
- Checklist summary: results for every requirement in Clauses 4–10 and for each Annex A control sampled.
- Auditor competence and independence record: a signed record, issued to you privately, that you can show your certification body on request.
- Internal audit programme template: a three-year, risk-based programme, if you do not have one yet.
Download a sample report (PDF). It uses a fictional organisation, so you can see exactly what you will get.
How It Works
- Order and intake. After checkout, complete the intake form (about 10 minutes). We confirm your start date within one business day.
- Scoping call and plan. A 30-minute call to confirm scope. We then send the audit plan and a document request list.
- Desk review. We review your scope, risk assessment, Statement of Applicability, policies and key records.
- Remote sessions. We interview your team and review evidence on screen-share. All requirements of Clauses 4–10 are audited, plus a risk-weighted sample of your applicable Annex A controls.
- Closing meeting. We walk you through every finding before anything is written down.
- Report. The final report, register and independence record arrive within 5 business days of the closing meeting.
Typical elapsed time from intake to report is about three weeks. Sessions are scheduled to suit GCC, European and US time zones.
Is This Right for You?
This service fits best when your ISMS is already operating. Before ordering, check that you have:
- a defined and approved ISMS scope;
- a completed information security risk assessment;
- an approved Statement of Applicability;
- an approved information security policy and core policies.
Still building these? Start with the free ISO 27001 gap assessment and the ISO 27001 Toolkit, then book your internal audit once the ISMS has been running for a few weeks.
Independence, Taken Seriously
An internal audit only counts if it is objective. We therefore do not audit an ISMS that Governance Docs has helped implement through consultancy in the last 24 months, and we do not sell implementation services to fix the findings we raise. Buying one of our documentation toolkits is not consultancy, so toolkit customers are welcome. The purchase is simply disclosed in the independence record.
Our Lead Auditor holds recognised information security and audit credentials and has more than 18 years of experience in information security and GRC in regulated financial services. The record of the auditor’s competence and independence is issued privately to each client.
Limited Monthly Capacity
We take on a maximum of five audits each month, so that every audit gets senior attention. Your start date is confirmed within one business day of receiving your intake form.
Frequently Asked Questions
Is an internal audit mandatory for ISO 27001 certification?
Yes. Clause 9.2 of ISO/IEC 27001 requires internal audits at planned intervals. Certification bodies expect to see at least one completed internal audit, with its programme, report and follow-up, before the Stage 2 certification audit, and an internal audit every year after that.
Can we use an external company for our internal audit?
Yes. The internal audit remains your organisation’s responsibility, but the standard allows you to use any auditor who is competent and objective. Outsourcing is the most common way small and mid-sized organisations meet the independence requirement.
Is this a certification audit?
No. Governance Docs is not a certification body and does not issue certificates. This is the internal audit that Clause 9.2 requires you to perform. It prepares you for the certification audit, but it cannot guarantee its outcome.
Is the whole audit remote?
Yes. Interviews and evidence review take place over video call and screen-share. Physical controls are reviewed by video walk-through where offices are in scope. There are no travel costs.
We bought your ISO 27001 Toolkit. Can you still audit us?
Yes. A documentation toolkit is not consultancy, and your team adapted and implemented it. We disclose the purchase in the independence record. We cannot audit an ISMS that Governance Docs implemented for you through consultancy in the previous 24 months.
Will you fix the nonconformities you find?
No. To protect the independence of the audit, we do not implement corrective actions for findings we raise. Your team decides and implements the actions. If you want independent confirmation that they work, add a corrective-action verification.
Which package do I need?
Essentials covers up to 50 people in the ISMS scope and one physical site plus cloud environments. Standard covers 51 to 250 people, or two sites. Choose the Annual Programme if you want both your pre-certification audit and next year’s audit from the same auditor at a lower combined price. For larger scopes, contact us for a quote.
How do I pay and what if I need to cancel?
You pay at checkout, or by invoice by arrangement. You get a full refund if you cancel before the desk review starts, and 50% if you cancel after the desk review but before the first audit session. The full terms are in the Internal Audit Service Terms.
By ordering you agree to the Internal Audit Service Terms. Prices are in US dollars and exclude any applicable taxes.
Reviews
There are no reviews yet