ISO 27001 Internal Audit Services Australia

An ISO 27001 internal audit is an objective, evidence-based evaluation of whether an information security management system conforms to the organisation’s requirements and ISO/IEC 27001, and whether it is effectively implemented and maintained. The audit uses defined criteria, scope and methods, samples objective evidence, reports results to relevant management and retains records of the programme and findings. It is not the external certification audit.

Yes. Clause 9.2 requires an organisation operating an ISO/IEC 27001 ISMS to conduct internal audits at planned intervals. The organisation needs an audit programme, defined criteria and scope, appropriate methods, auditors selected so objectivity and impartiality are protected, results reported to relevant management and retained evidence of the programme and results. A gap assessment may help preparation, but it does not automatically satisfy the internal-audit requirement.

Plan to complete the internal audit and management review before Stage 2, with enough time to address material findings. The certification body will normally examine the audit programme, results, management-review records and corrective actions as evidence that the organisation has evaluated and improved its own ISMS before the certification decision.

ISO/IEC 27001 requires internal audits at planned intervals; it does not prescribe one universal full audit every calendar year. The audit programme should determine frequency, methods and coverage using process importance, information-security risk, significant changes and previous audit results. Many organisations use an annual cycle because it aligns with management and certification calendars, while others distribute coverage across a documented multi-year programme.

No. ISO/IEC 27001:2022 contains 93 Annex A reference controls, but it does not require every control to be audited every year. The audit criteria normally include Clauses 4–10, the organisation’s own ISMS requirements and applicable controls identified through risk treatment and the Statement of Applicability. Sampling follows risk, process importance, material change, previous findings and the documented audit programme.

A competent internal employee or an external auditor can perform the audit where the organisation protects objectivity and impartiality. The auditor should have competence relevant to the scope and should not audit work they designed, implemented or operate. When a small team cannot avoid self-review, a separately appointed external auditor usually provides the clearest separation.

No—the auditor must not audit their own work. Aegentra can provide implementation and a separately scoped Clause 9.2 internal audit through different competent consultants. The auditor must not have designed, implemented or operated the work they audit. Before accepting the audit, we document competence, prior involvement, conflicts of interest, reporting arrangements and safeguards for objectivity and impartiality. Assigning a different consultant is not enough on its own. If these safeguards cannot protect objectivity and impartiality, a separate provider is required. An independent accredited certification body conducts the certification audits and makes the certification decision. The service is also available for systems implemented in-house or by another provider, subject to the same checks.

Aegentra’s ISO 27001 internal-audit service starts from A$2,300 + GST for a smaller organisation with a clear, single ISMS scope and straightforward evidence access. The final fixed fee is confirmed after reviewing locations, processes, applicable controls, previous findings, evidence volume, interview requirements, sampling needs and any onsite work. The written scope records the inclusions, assumptions and dates before work begins.

Duration depends on the agreed scope rather than headcount alone. Locations, business processes, applicable controls, prior findings, evidence quality, interview availability and onsite requirements all affect fieldwork and reporting. Aegentra confirms dates only after reviewing the audit programme, ISMS scope and evidence access. The audit plan then identifies the fieldwork, closing meeting, report issue and any close-out review dates.

The auditor reviews evidence relevant to the agreed criteria and sample. This normally begins with the ISMS scope, audit programme, risk assessment, treatment plan, Statement of Applicability, policies, objectives, previous findings and management-review records. Operating samples may include access reviews, approvals, tickets, logs, incident records, supplier reviews, backup tests, training records and corrective actions.

Yes. Document review, interviews and cloud-control testing can normally be completed remotely. Onsite attendance may be appropriate where physical security, restricted evidence, site-specific operations or the agreed audit objective cannot be evaluated adequately through remote methods. The delivery mode, access arrangements and travel assumptions are agreed before fieldwork.

The organisation records each nonconformity, addresses the immediate issue, evaluates the cause and plans corrective action proportionate to the gap. Owners and due dates are assigned, and follow-up evidence is reviewed to establish whether the action was completed and effective. A nonconformity is an input to improvement; it is not automatically a certification failure.

No. A competent auditor cannot promise an audit outcome before reviewing the evidence. The purpose is to reach an objective conclusion against the agreed criteria, not to produce a predetermined result. A published nil-nonconformity case study describes one completed engagement and is not a guarantee for another organisation.

The internal audit is the organisation’s Clause 9.2 assurance activity. Stage 1 and Stage 2 are separate external assessments conducted by an accredited certification body. The internal audit evaluates conformity and effective implementation, reports findings to relevant management and supports corrective action. Only the certification body makes the decision to issue, maintain, suspend or withdraw certification.

No. Aegentra is not a certification body and does not issue ISO 27001 certificates. Aegentra can provide readiness support and, where its independence policy permits, the Clause 9.2 internal audit. Stage 1, Stage 2, surveillance and recertification assessments are performed by an independent accredited certification body.

Have the current ISMS scope, Statement of Applicability, risk register, internal-audit programme, previous findings, target certification or surveillance date, site list and expected evidence-access constraints available. These inputs allow the audit criteria, sampling, interview requirements, delivery method, fixed fee and reporting dates to be scoped accurately.

A useful finding connects the audit criterion, the evidence examined and the gap demonstrated. Record the relevant requirement, sample identifiers and dates, what was expected and what actually happened, with enough context for management to act. Keep a nonconformity distinct from an improvement suggestion. The follow-up record should distinguish immediate correction, cause analysis, corrective action and evidence of effectiveness; closing a ticket alone does not prove the cause was addressed.

No. Sampling supports a conclusion within the audit’s scope and limitations; it is not proof about every transaction or every period. The report should make the population, selection approach, evidence gaps and exclusions understandable. An absence of findings in a sample is not a security guarantee. Significant changes, incidents or previous findings may justify different sampling or further work in the audit programme.

Consider it where it changes risks or controls inside the agreed ISMS boundary. A connector that can read customer records or write back to a production system can affect access approval, supplier assessment, logging and change control. The auditor can trace those decisions and operating records within scope. That does not turn an ISO 27001 audit into a model-safety evaluation or an ISO 42001 audit; those require their own criteria and scope.

With scoping. An organisation of around ten people or fewer usually completes a short questionnaire, unless it already has a scope and Statement of Applicability to share. A larger organisation signs an NDA first, then shares the scope, the Statement of Applicability and the number of sites to be visited. The ten-person line is a working understanding agreed with each client, not a rule.

The proposed consultant’s profile with certificate numbers, qualifications and industry experience, a draft audit plan and the scope of work. The quote follows once you are satisfied with the consultant, and you can ask for a different consultant at any point before signing.

Some of our consultants audit for certification bodies. We ask which body certifies you and state in writing whether the proposed consultant has worked with your organisation or with that body. If there is a conflict, a different consultant is proposed, so the internal audit cannot compromise your certification audit.

When you sign the contract. It carries the agreed scope of work and the payment terms you accepted. Work starts after signature, not before.

An Engagement Quality Lead, a Principal Consultant who owns the scope, confirms the consultant’s independence and issues the report. The proposal names the lead and the consultant assigned to fieldwork, with their qualification evidence, before you confirm. Fieldwork is delivered by Aegentra’s consulting team.