Outsourced ISO 27001 internal audit, done to survive Stage 2
An independent, outsourced internal audit that satisfies ISO 27001 Clause 9.2, run by senior auditors with no conflict of interest, so your ISMS is genuinely ready for the certification body.
ISO 27001 Clause 9.2 requires an internal audit. It does not require you to do it yourself.
ISO 27001:2022 Clause 9.2 requires you to audit your information security management system at planned intervals to confirm it conforms to the standard and is effectively implemented. The catch is independence: an auditor cannot assess functions they own, operate, or monitor. In a 30 to 250 person company, the people who run security are usually the same people who would have to audit it, which is exactly the conflict the clause is designed to prevent.
Outsourcing the internal audit to an independent firm is a fully compliant and common way to meet Clause 9.2, provided the external auditor is competent and independent. That is what we do.
What is included
- A full annual internal audit program covering ISO 27001 Clauses 4 to 10, your Statement of Applicability, and every applicable Annex A control.
- Multiple audit cycles across the year, weighted toward higher-risk areas.
- Findings classified consistently, with a nonconformity register and a corrective action plan tracked to closure.
- Management review support under Clause 9.3.
- Stage 1, Stage 2, and surveillance preparation.
- An annual readiness statement to your leadership.
Independent by design
We provide readiness and internal-audit work only. We are not your certification body and we never issue the ISO 27001 certificate. That separation is what gives our internal audit credibility with the certification body that does. Our auditors do not audit work they designed or operate, and every finding is based on evidence we reviewed and verified, never on a platform's status alone.
An internal audit exists to find the problems before the certification body does. If it is run by the team that built the ISMS, it cannot do that job.
Multi-framework, one program
We scale the same program across ISO 27001 and its extensions, ISO 27017 for cloud, ISO 27018 for personal data in the cloud, and ISO 27701 for privacy information management, so a single internal audit function covers your whole certification footprint.
For US-facing sellers
If you sell into the United States as well, your buyers will often ask for SOC 2. We run SOC 2 readiness and ISO 27001 internal audit as one coordinated program, so you are not paying twice to evidence the same controls.
ISO 27001 internal audit, answered
Can you outsource an ISO 27001 internal audit?
Yes. ISO 27001 Clause 9.2 requires the internal audit to be objective and impartial, but it does not require it to be done in-house. Engaging an independent, competent external firm is a compliant and common way to meet the requirement, especially for smaller teams where internal independence is hard to achieve.
Is an internal audit the same as the certification audit?
No. The internal audit is your own check, required by Clause 9.2. The certification audit (Stage 1 and Stage 2) is performed separately by an accredited certification body. We do the internal audit and readiness; we never act as the certification body.
How much does an outsourced ISO 27001 internal audit cost?
Our Assurance Program, which includes the annual internal audit program and continuous assurance, starts at $60,000 per year. A single internal audit cycle can be scoped on its own. See pricing.
Which ISO frameworks do you cover?
ISO 27001, plus the extensions ISO 27017, ISO 27018, and ISO 27701, in one coordinated internal audit program.
Do you serve the UK, EU, Australia, and UAE?
Yes. ISO 27001 is the dominant framework in the UK, EU, Australia, and UAE, and we run internal audits across all of them, with awareness of local drivers such as NIS2, DORA, GDPR, the Essential Eight, and NESA or DESC.
Book a discovery call
Tell us where you are with ISO 27001, first certification, surveillance, or a stalled internal audit. We will tell you what it takes to be ready.