Services / Internal Audit
Independent internal audit services for ISO 27001, SOC 2, GDPR and custom frameworks. Identify control gaps, satisfy certification requirements and provide board-level assurance.
Audit scope
ISO 27001-aligned audit of your Information Security Management System, covering all Annex A controls and management system requirements.
Assessment of controls against the Trust Services Criteria to identify gaps before your SOC 2 Type I or Type II examination.
Review of data protection controls, processing activities, consent mechanisms and documentation against UK GDPR and GDPR requirements.
Internal audit against any framework or bespoke control set, including Cyber Essentials, NIST CSF, PCI DSS and sector-specific requirements.
Use cases
Internal audits are a mandatory requirement for most certification frameworks, and a valuable tool for continuous improvement beyond compliance.
Identify control gaps before your external certification audit to avoid surprises and reduce the risk of non-conformities.
Prepare for ISO 27001, SOC 2 or other annual surveillance audits by validating that controls remain effective and evidence is audit-ready.
Provide independent assurance to your board or audit committee that information security controls are operating effectively.
Following a security incident or near-miss, an internal audit validates that root causes have been addressed and controls strengthened.
Demonstrate to regulators, customers or partners that your controls meet the requirements of applicable frameworks and regulations.
Embed regular internal audits as part of your ISMS or compliance programme to drive ongoing improvement and maintain certification.
Process
A structured, evidence-based audit methodology that delivers findings your team can act on and your auditors will accept.
We agree the audit scope, objectives, methodology and timeline. You receive a formal audit plan for sign-off before fieldwork begins.
We request and review policies, procedures, system configurations, logs and other evidence to assess control design and implementation.
We test the operating effectiveness of controls through interviews, walkthroughs, sample testing and technical inspection.
We identify control gaps and weaknesses, rate each finding by risk severity and map them to your framework obligations.
We issue a draft report for management review. You provide responses and agree remediation actions before the final report is issued.
We issue the final audit report and schedule a follow-up review to track progress against the management action plan.
Deliverables
Everything you need to satisfy certification requirements, brief your board and drive remediation, delivered in a format your team can act on.
A comprehensive report covering all findings from the audit, including control gaps, risk ratings and prioritised remediation recommendations.
A structured assessment of each control in scope, rated by design effectiveness and operating effectiveness, with evidence references.
An updated or newly created risk register reflecting findings from the audit, aligned to your chosen framework or risk methodology.
A documented management action plan (MAP) capturing agreed remediation actions, owners and target completion dates.
A concise executive summary suitable for presentation to your board, audit committee or senior leadership team.
A follow-up review session to assess progress against the management action plan and close out remediated findings.
Tell us which framework you need audited and we will scope an internal audit that satisfies your certification body and your board.
Discuss your audit