Information security management system review
ISO 27001 internal audit
Understand how your ISMS works in practice and what needs correcting or improving before an external audit.
- ISO/IEC 27001:2022
- Evidence and risk
- Preparation, not certification
Review the system, not just the paperwork
An internal audit assesses whether the information security management system meets applicable requirements and is effectively implemented and maintained. It examines processes and evidence within an agreed scope: it is not a penetration test or a technical guarantee for every asset.
It can support preparation for a first certification audit, an established ISMS audit programme or a review following significant changes to processes, suppliers or technology. The programme should reflect risks, changes and earlier findings rather than a universal timetable.
We use ISO/IEC 27001:2022 and its Amd 1:2024 amendment as references. The review considers applicable system requirements and available evidence; it does not replace assessment by an independent certification body.
Scope of work
What does the ISMS audit cover?
Criteria and sampling are agreed around your organisation’s scope and context.
Scope and responsibilities
Review context, interested parties, roles and whether the declared scope reflects actual processes.
Risk assessment and treatment
Compare risk assessments, treatment decisions and the Statement of Applicability with evidence of their management.
Control implementation
Review a sample of applicable controls and records with responsible teams, rather than claiming exhaustive testing of every asset.
Monitoring and improvement
Examine objectives, indicators, management review, incidents and corrective actions.
Gaps and findings
Document findings against agreed criteria, distinguishing nonconformities from opportunities for improvement.
Useful decisions and outcomes
- An evidence-based picture
- Understand system strengths and gaps within the audited scope.
- Actionable priorities
- Use findings to assign owners and plan corrections before the external audit.
- A practical report
- Scope, criteria and findings recorded clearly; specific deliverables are agreed in the proposal.
Methodology
From your starting point to practical action
We agree the scope, people involved and expected outputs before work begins.
- 01
Planning
Agree scope, criteria, samples and timetable, and ensure impartiality towards the activities audited.
- 02
Document review
Review system documentation and prepare interviews and evidence checks.
- 03
System audit
Interview responsible staff and examine records and implementation of agreed processes.
- 04
Report and conclusions
Explain findings and their supporting evidence so the organisation can act.
- 05
Action follow-up
Where included in the engagement, support the definition and verification of corrective actions.
Frequently asked questions
Does an internal audit award ISO 27001 certification?
No. CONSULTORS D’EMAS S.L. provides consultancy and internal audit services. ISO certification is carried out by an independent certification body. This service guarantees neither certification nor an absence of nonconformities.
Can you audit an ISMS that is not certified yet?
Yes, once it has sufficient processes and evidence to review. An initial gap assessment and an internal audit serve different purposes; we agree which fits your starting point.
How often should the ISMS be audited?
At planned intervals based on the audit programme, the importance of processes and earlier results. There is no single frequency suited to every organisation.
What do you need to prepare a proposal?
The ISMS scope, activities and locations, implementation status and audit objective. These allow us to agree the work and deliverables.
Related services and resources
Let’s discuss your project.
Tell us about your organisation and what you need to prepare. We will propose a scope of work suited to your context.