ISO 27001 internal audit
ISO 27001 internal audit by certified lead auditors
An independent internal audit according to clause 9.2, carried out as the certifying body will do in the future. You know exactly where you stand and what needs to be done before the external auditor arrives.
- Fixed price upfront, no surprises afterwards
- To be scheduled within two weeks, on-site or online
- Report within five working days, with concrete advice per finding
Trusted by 500+ companiesProcedure according to ISO 19011Also NEN 7510, BIO and ISO 27701
Nestor Security has carried out the internal audits of both ISO 27001 and ISO 27701 for us. They really hit the mark for us with a good combination of quality and practicality.
Wouter BuzingCISO, Effectory
Plan your internal audit
Briefly tell us about your ISMS and the date of your external audit. Within one working day you will receive a proposal with a schedule and a fixed price.
How can we help you?
Response from a lead auditor within one business day. Free of charge.
Find out why 500+ Companies trust Nestor Security for IT security and compliance
Who performs your internal audit?
You are free to organize the internal audit yourself, as long as it is objective and impartial. This is how the options relate to each other.
| Nestor Security | Colleague as an internal auditor | Other audit firms | |
|---|---|---|---|
| Independence | A lead auditor who was not involved in your implementation | Difficult: A colleague often checks their own work | Usually secured |
| Experience | Certified lead auditors who audit ISO 27001 on a daily basis | Often just an internal auditor course | Varies per auditor |
| Method of operation | Interviews and samples according to ISO 19011 | Often a checklist without samples | Often a fixed checklist |
| Report | Findings with classification and advice per point | Often concise or informal | Often just findings, without advice |
| Planning | To be scheduled within two weeks | Depending on the traffic | Often weeks of waiting |
| Follow-up | Help in solving findings, if you wish | It lies with you | Usually not included |
| Costs | Fixed price upfront, no surprises afterwards | Hidden costs in the hours of your own people | Often a daily fee plus travel costs and reporting costs |
An audit report that you can immediately start working on
Not a thick report full of standard language, but an overview that shows what is working well, what needs to be improved, and how to solve that.
- Findings per clause and per measure from Annex A
- Each finding is classified as a major deviation, minor deviation, or improvement point
- Concrete advice and a proposal for the priority per finding
- Follow-up discussion with your team and input for the management review
This is how your internal audit works
From intake to follow-up in an average of three weeks. We agree in advance who we need at what time, so that interviews remain short and focused.
Intake and audit plan
- Interview with the owner of the ISMS
- Defining scope, locations, and processes
- Audit plan with an interview schedule, so you know who we’ll be speaking to at what time
Document evaluation
- Policies, risk analysis, Declaration of Applicability and procedures
- Control of all mandatory documents from the standard
- First points of attention shared already for the audit day
Audit day on-site or online
- Interviews with management, ISMS owner and process owners
- Samples of evidence, such as the external auditor takes
- Review of clauses 4 to 10 and the measures from Annex A
Report and follow-up discussion
- Audit report within five working days
- Follow-up with concrete actions and priorities
- Input for your management evaluation
- On request, assistance with resolving the findings
Ready for the external audit
Plan the internal audit preferably four to eight weeks before the external audit. That gives time to resolve findings and complete the management review, and that is what the certifying body wants to see in advance.
We will test what the certifying institution will also test in the future.
An internal audit is only valuable if it is just as critical as the real thing. That is why we audit the entire management system and take samples from the measures, just as an external auditor would do.
Context and scope
Is the scope logical, and are the stakeholders and their requirements known?
Leadership
Does the management demonstrate the ISMS, with policies, roles and resources?
Risk analysis and objectives
Is the risk analysis repeatable and does the Declaration of Applicability comply with it?
Support
Are his competencies, awareness, and document management in order?
Implementation
Are risk assessment and risk management actually being implemented?
Evaluation
Are there measurements, internal audits and a management review?
Improvement
Are deviations recorded, analyzed, and resolved?
93 measures
Sample of the organizational, personnel, physical and technological measures.
Success story of Effectory
Feedback analytics developers with a team of more than 250 people
Months before a project with ISO 27001 and ISO 27701
New security measures implemented
Success during the external audit
The challenge
Effectory processes sensitive employee data for over 1,200 organizations. The challenge was to continuously strengthen the information security system and have it grow with the high demands of customers, without disrupting daily services.
The approach
In close collaboration, we have refined the management system for both ISO 27001 and ISO 27701. With a dedicated point of contact, responsibilities have been clearly defined, processes secured, and the organization prepared for the external audit to achieve certification.
The outcome
Within 6 months, Effectory achieved ISO 27001 certification without any bottlenecks. Security is now demonstrably in order for customers, security questionnaires are answered more quickly, and a solid, future-proof foundation is in place.
Nestor Security conducted the internal audits for both ISO 27001 and ISO 27701 for us. They really strike the right chord for us with a great combination of quality and feasibility. They are pragmatic, think along well with our needs, and the audits are well-organized.
Wouter BuzingCISO, Effectory
Have a colleague audited, or have a lead auditor
The standard requires that the internal audit is objective and impartial. A colleague who helped set up the ISMS is essentially testing his own work, and the external auditor sees that as well.
Internal audit by a colleague
Quickly arranged, but rarely independent
Internal audit by Nestor Security
Independent, thorough and without surprises
Not yet an ISMS in place, or is the implementation stuck?
We also guide the complete ISO 27001 implementation, from zero assessment to certification. On average, in 4 to 5 months, with a success rate of 100%.
Don't just take it from us
You are in good company with Nestor.
The communication lines with Nestor Security were short. The organization has a pragmatic mindset and is a down-to-earth party to do business with. As a result, the process went smoothly and fairly quickly.
We prefer to work together as much as possible regionally and like to hold meetings face-to-face. When you look at partners in the North, there are still a few left, and Nestor Security stands out above the rest.
Your questions answered
FAQs
How long does an internal audit take?
That depends on the size of your organization, the scope of the ISMS, and the number of locations. For a small to medium-sized organization, the audit itself is often completed in one or two days, followed by the reporting.
During the intake, we provide you with a concrete schedule in advance, so you know how much time you need to free up from your employees.
What happens to the findings?
Within five working days, you will receive the report, with the classification, the supporting evidence and our advice for each finding. In the follow-up meeting, we will jointly outline the actions to be taken.
If you want help in solving the problem, that is possible, but you are never obliged to do so.
What determines the price of an internal audit?
The number of employees in scope, the number of locations, and the number of measures we test. After the intake, you will receive a fixed price, so you won’t be surprised later on.
When is the best time to schedule the internal audit?
Preferably four to eight weeks before the external audit. Then you have time to address the findings and complete the management review.
If you are already in the certification cycle, plan the internal audit well in advance of the annual surveillance audit.
Is an internal audit required for ISO 27001?
Yes. Clause 9.2 of the standard requires you to conduct internal audits at scheduled intervals. For the first certification, the certifying body wants to see that a full internal audit and a management review have been completed.
In practice, this means an internal audit every year, so that the entire ISMS is covered within the three-year certification cycle.
What is the difference between an internal and an external audit?
You organize the internal audit yourself, or have it performed by an independent party such as Nestor Security. The goal is to discover where the ISMS does not yet comply and to improve that before anyone else sees it. The external audit is conducted by a certification body and determines whether you obtain or retain the certificate.
We are allowed to perform your internal audit as an external party, but not your certification audit. Those two roles always remain separate, and that is exactly what makes the internal audit so valuable. You get the perspective of an auditor without anything being at stake.
Can Nestor Security perform the internal audit if you have also implemented our ISMS?
Yes, as long as the auditor themselves was not involved in the implementation. Therefore, we always assign a lead auditor who did not help you set up your ISMS. This ensures the audit remains objective and impartial, as required by the standard.
Know where you stand before the external auditor tells you
Plan your internal audit with a certified lead auditor. Within one working day you will receive a proposal with a schedule and a fixed price.
Plan your internal auditView a sample report
Fixed price in advanceReport within five working daysCertified lead auditors