Internal audit · ISO 27001 · ISO 27701 · ISO 42001
An independent internal audit, run in Checkpoint
Every ISO management system needs an internal audit before certification, and every year after. The auditor must not audit their own work, and in a small team that is usually the hard part.
We act as your internal auditor. The programme, workpack, evidence and findings all live in Checkpoint, in your own Microsoft 365 tenant, linked to the registers they test.
- Clause 9.2 audit programme
- Independent of your team
- About 2.5 days, not 5
- Findings tracked to closure
- Data never leaves your tenant
Why teams bring in an internal auditor
It is required
Clause 9.2 asks for internal audits at planned intervals against a programme. Your certification body will look for a completed one before Stage 2.
It must be impartial
The person who wrote the policies and runs the controls cannot credibly audit them. An outside auditor settles that question.
It finds problems early
A good internal audit finds the nonconformities your certification auditor would have found, while you still have time to fix them.
How an engagement runs
Five steps, all recorded in Checkpoint so the next audit starts from where this one finished.
Plan the programme
A 12-month internal audit programme, riskiest areas first, so findings surface while there is still time to fix them before the certification body arrives.
Prepare the workpack
Each audit gets a workpack in Checkpoint, pre-filled from your registers: the clauses and controls in scope, the evidence already held, and the questions to test.
Run the audit
We interview owners, sample evidence and test that controls operate as described. Independent of the people who built and run them.
Raise and track findings
Nonconformities and observations go straight into your Actions register with an owner and a due date, linked back to the audit that raised them.
Report and close
An audit report your auditor can read, and findings verified closed rather than just marked done. Ready for management review.
What it costs
An internal audit usually takes about 5 days. Run in Checkpoint it takes about 2.5, because the workpack arrives pre-filled from your registers, the evidence is already linked, and findings go straight into Actions instead of a spreadsheet.
The usual way
About 5 days
Gathering documents, building the checklist, chasing evidence and writing up findings by hand.
In Checkpoint
About 2.5 days
Around $5,000 at $2,000 a day (AUD, ex GST). We confirm the days with you before anything is booked, based on the frameworks and sites in scope.
Need an internal audit before your Stage 2?
A 30-minute call. Tell us your certification date and what is in scope, and we will tell you how long the audit needs and when it should run.
Book a 30-min callKeep reading — ISO 27001
