Internal Audit
An internal audit gives you an independent view of where your management system stands. I carry out audits as an IRCA-certified ISO 27001 and ISO 9001 Lead Auditor, following ISO 19011: planned, evidence-based and reported against clear criteria.
Led by Levent Şakar, IRCA-certified ISO 27001 and ISO 9001 Lead Auditor.
Annual internal audit
ISO 27001 requires internal audits at planned intervals, carried out by someone competent and objective. Many organisations find this difficult to do well with their own staff. I carry out internal audits as an external auditor, either once a year or spread across the year as a programme.
| Standards | ISO/IEC 27001:2022, ISO 9001, ISO/IEC 20000-1, ISO/IEC 27701 |
|---|---|
| Typical timescale | Three to five days of work, including planning and reporting, usually completed within two to three weeks. |
| Fee | Fixed per audit, by organisation size. |
Who it's for
- Certified organisations needing their annual internal audit
- Organisations whose internal audit has become a formality and want a more useful one
What it covers
- An audit programme that covers the full management system over your certification cycle
- Management system clauses and selected Annex A controls
- Evidence sampling, interviews and review of records
- Opening and closing meetings
What you receive
- An audit report with findings graded as nonconformities, observations or opportunities for improvement
- Clear references to the requirement behind each finding
- Verification of corrective actions, where agreed
Pre-certification audit
A full audit carried out shortly before your certification audit, run the way a certification body would run it. The aim is simple: find the nonconformities before the certification body does, while there is still time to fix them.
| Typical timescale | Three to five days of work, four to eight weeks before the certification audit. |
|---|---|
| Fee | Fixed, by organisation size. |
How it differs from a gap analysis
- A gap analysis comes at the start and tells you what to build
- A pre-certification audit comes at the end and tests whether what you built will pass
What it covers
- A documentation review equivalent to a Stage 1 audit
- An implementation audit equivalent to Stage 2, with interviews and evidence sampling
- A closing meeting with likely findings and their grading
What you receive
- A report listing likely nonconformities and observations, with references to the requirements
- A short list of what to fix before the certification audit, in priority order
Supplier audits
ISO 27001, your customers and your contracts increasingly expect you to oversee the security of the suppliers you depend on. Questionnaires only go so far. I carry out audits of your key suppliers on your behalf.
| Typical timescale | About a day and a half per supplier for a remote audit. |
|---|---|
| Fee | Fixed per supplier audit. |
What it covers
- Agreeing audit criteria with you: contract terms, your security requirements or relevant ISO 27001 controls
- Remote or on-site audits of the supplier
- Review of the supplier’s evidence, not just their answers
What you receive
- A report per supplier, with findings and a view on the level of risk
- Recommendations for follow-up, contract changes or monitoring
Not sure which audit you need?
A short call is usually enough to work out whether you need an internal audit, a pre-certification audit or something else.