Last updated 13 October 2026

1. About these terms

These terms apply when you buy the ISO/IEC 27001 Internal Audit Service (the “Service”) from Governance Docs LLC, a New Mexico limited liability company (“Governance Docs”, “we”, “us”). “You” means the organisation that buys the Service.

Your order, the audit plan we agree with you and these terms together form the agreement for the Service. Our website Terms and Conditions also apply, except where they conflict with these terms. For the Service, these terms take priority, and they replace the 30-day refund in our Refund and Return Policy (which applies to digital products).

2. The Service

We perform an independent, remote internal audit of your information security management system (ISMS) against ISO/IEC 27001:2022, including Amendment 1:2024, and against your own ISMS requirements. The Service is designed to help you meet the internal audit requirement in Clause 9.2.

Packages

  • Essentials: up to 50 people in the ISMS scope, one site plus cloud environments, approximately two auditor days.
  • Standard: 51 to 250 people in scope, or two sites, approximately three auditor days.
  • Annual Programme: two Essentials-scope audits about 12 months apart, by the same Lead Auditor, paid annually in advance.

Larger or multi-standard scopes are quoted separately. Optional extras are an additional site, a corrective-action verification within 60 days of the report, and rush delivery.

Deliverables: an audit plan; remote audit sessions with opening and closing meetings; a written internal audit report; a populated nonconformity and corrective action register; a summary of the audit checklist; and a signed Auditor Competence and Independence Record.

Timing: we aim to start within 15 business days of receiving your completed intake form, and to issue the final report within 5 business days of the closing meeting. With rush delivery, we aim to start within 5 business days and to issue the final report within 2 business days of the closing meeting.

3. What the Service is not

  • It is not a certification audit. Governance Docs is not a certification body and does not issue certificates.
  • It does not guarantee that you will achieve or keep certification, or that a certification body will not raise findings.
  • An audit examines samples of the evidence available. It cannot detect every nonconformity, and its results reflect what we saw at the time.
  • It does not include penetration testing or other technical security testing, legal advice, or implementing corrective actions.

4. Independence

An internal audit must be objective, so the following rules apply:

  • We will not audit an ISMS that Governance Docs has helped to design or implement through consultancy in the previous 24 months. If this applies to you, please tell us before ordering. If we find it after you order, we will cancel and refund in full.
  • Buying our off-the-shelf documentation toolkits is not consultancy. We will disclose it in the independence record.
  • We will not provide services to implement corrective actions for findings we raise in your audit.
  • Any referral relationship between us and your certification body will be disclosed in the independence record.

5. Your responsibilities

  • Make sure the ISMS is ready to audit: a defined scope, a risk assessment, a Statement of Applicability and approved core policies should be in place.
  • Complete the intake form, and provide the documents in our request list, within 10 business days of our request.
  • Make suitable people available for the agreed sessions, and provide complete and accurate information.
  • Nominate an audit coordinator.
  • You remain responsible for your internal audit programme, for deciding and implementing corrective actions, and for your ISMS.

6. Scheduling and capacity

  • We take on a limited number of audits each month. After we receive your intake form, we confirm your start date within one business day.
  • Sessions are held at times we agree, and we accommodate GCC, European and US time zones.
  • You may reschedule once free of charge with at least three business days’ notice. Further changes depend on availability.
  • Audits must be scheduled within 90 days of ordering. Under the Annual Programme, the second audit must take place within 10 to 14 months of the first.
  • If you do not respond to us for 30 days, we may treat the order as cancelled under section 8.

7. Fees and payment

  • Fees are as shown on our website at the time of order, in US dollars, and are payable in full when you order, by card at checkout or by invoice where we agree.
  • Fees exclude any applicable taxes, which are added where required.
  • The Service is delivered remotely, so there are no travel costs. On-site work, if requested, is quoted separately with expenses.

8. Cancellation and refunds

  • Before we start the desk review: full refund.
  • After the desk review starts, and before the first audit session: 50% refund.
  • After the first audit session: no refund.
  • Annual Programme: if you cancel after the first audit is complete, we refund the Annual Programme fee minus the Essentials price at the time you ordered.
  • Rush delivery: if we miss the rush timing for reasons within our control, we refund the rush surcharge.
  • If we cancel for independence reasons, or because we cannot deliver, we refund in full.

To request a refund, email info@governancedocs.com with your order number.

9. Confidentiality and information handling

  • We keep confidential all information you share with us for the Service, and use it only to deliver the Service.
  • Where possible we review records on screen-share instead of receiving copies. We do not record sessions without your written consent.
  • Documents you send are stored in access-controlled, encrypted storage and are deleted within 90 days of the final report, unless they are needed for a corrective-action verification you have bought.
  • We keep our working papers, the report and the independence record for three years, so we can answer questions from you or your certification body, and then delete them.
  • We may use secure productivity tools, including AI-assisted drafting tools configured not to train on customer data, to prepare working papers and reports. The Lead Auditor reviews all content and is responsible for it.
  • Personal data is handled as described in our Privacy Policy.

10. Use of the report

  • You may use the report internally and share it in full with your certification body, external auditors, regulators and insurers, and, under confidentiality, with customers.
  • You must not present the report as a certification, or share extracts in a way that misrepresents its findings.
  • We keep the intellectual property in our methods, checklists and templates.
  • We may use anonymised, aggregated statistics that cannot identify you.

11. Liability

  • Our total liability arising from the Service is limited to the fees you paid for it.
  • We are not liable for indirect or consequential loss, loss of profit or business, or the outcome of any certification or regulatory decision.
  • If the Service is not performed with reasonable skill and care, your remedy is for us to re-perform the affected part at no charge or, if we cannot, to refund the fees for that part.
  • Nothing in these terms limits liability that cannot be limited by law.

12. Complaints

Please email info@governancedocs.com. We acknowledge complaints within two business days and aim to respond in full within five business days.

13. General

  • These terms are governed by the laws of the State of New Mexico, United States, consistent with our website Terms and Conditions.
  • We act as an independent contractor.
  • We may update these terms. Changes apply only to orders placed after the update.
  • Neither party is liable for delay caused by events beyond its reasonable control.
  • Contact: Governance Docs LLC, 1209 Mountain Road Pl NE, Suite R, Albuquerque, NM 87110, USA. info@governancedocs.com · +1 505 289 2455.