An audit plan agreed up front
Scope, criteria and method agreed with you, so the audit measures what matters to you and to your auditor.
Internal audit
Cybersecurity internal audit for SMBs: an independent check before the auditor looks.
Find the gaps before your certification body or your biggest customer does. An independent audit, a clear report and a list of fixes your team can act on.
Is this for you?
When an internal audit is due.
- Your certification audit is comingISO 27001 requires an internal audit before the certification body can certify you.
- A customer or your insurer asks for evidenceThey want proof that your security works, not just a policy document.
- You have had an incident or a near missAnd you want to know which measures held and which did not.
- Nobody has checked in the last 12 monthsOr the company has changed: growth, an acquisition, a move to remote work.
What is at stake
Your documents say one thing. Daily practice may say another.
An internal audit checks that your security works the way your documents say it does. Without one, the first person to find the gaps is your certification auditor, a customer's reviewer or an attacker.
ISO 27001 requires an internal audit before certification, and NIS2 asks covered companies to check that their measures work. An independent audit gives you that evidence, and a plan to close the gaps.
What you get
An honest picture, and what to do about it.
An independent auditor
The audit is run by a Lead Auditor who did not design the measures being audited. Objectivity is the point.
Findings backed by evidence
Every finding linked to evidence and to the requirement it sits against.
A summary management can read
Scope, findings and the decisions needed, in plain language.
A corrective action plan
Findings ranked, with suggested owners, timelines and effort, so the report turns into action.
A file your certification body accepts
For ISO 27001: an audit file structured for your certification body’s Stage 1 and Stage 2 review.
Who does what
We audit. Your team fixes, with a clear plan.
What we lead
- Agree the scope, criteria and audit plan with you
- Review your documents and interview your staff
- Check that the measures work in practice
- Write the report and the corrective action plan
- Present the findings to management
What stays with your IT provider
- Give access to documents, systems and people
- Carry out the corrective actions
- Keep the evidence for the next audit
If we also helped set up your measures, a different practitioner runs the audit, and the separation is documented.
How it works
Four steps, three to five weeks.
- 01
Scope and audit plan
Week 1
We agree the objectives, the rules or standards, the scope and the method. You get an audit plan your certification body or regulator will recognise.
- 02
Document review
Weeks 1–2
We review your policies, procedures and evidence against the requirements, and prepare the checklists for the audit.
- 03
The audit itself
Weeks 2–4
Interviews, observation and evidence checks, to confirm that daily practice matches the documents. On-site or remote.
- 04
Report and action plan
Weeks 4–5
The full report, the findings with their evidence and a ranked corrective action plan, presented to management.
How it starts
A fixed fee, agreed before we start.
Half on signature, half when the report is delivered. The first call is free. Quarterly check-ups or annual audit cycles are available as an option.
- Price
- Fixed fee
- Duration
- 3–5 weeks
- Your time
- A few interviews, planned with you
Fixed quote after the free call.
book a free 25-minute consultationFor your IT manager, DPO or CFO
Seven laws and standards, plus your own requirements.
CERTIFICATION
ISO 27001
Internal audit against the 93 Annex A controls and the management clauses. Required before Stage 2 certification.
Read more
CERTIFICATION
ISO 42001
Internal audit of an AI management system, led by a PECB ISO/IEC 42001 Lead Auditor. Required before Stage 2 certification, and covers AI Act Article 26 deployer evidence in the same engagement.
Read more
CERTIFICATION
ISO 27701
Privacy management audited against the standard’s privacy controls and their GDPR mappings. Since the 2025 edition it stands on its own.
Read more
EU LAW
NIS2
Risk management, governance, incident response, supply chain and business continuity against NIS2 Article 21.
Read more
EU LAW
EU GDPR
Lawful basis, records of processing, impact assessments, data subject rights, breach response, processor contracts, retention.
Read more
EU LAW · FINANCE
DORA
ICT risk management, incident classification and reporting, resilience testing, third-party oversight.
Read more
PAYMENTS
PCI DSS
Cardholder data scope, network segmentation, access control, encryption and security testing, against PCI DSS v4.0.1.
Read more
Two ways to do an internal audit. Different cost, different result.
| Factor | Cyber-Management (independent) | Internal auditor (employee) |
|---|---|---|
| Cost | Fixed fee, scoped to framework and organisation size; no ongoing employment cost | Salary, training, tooling and management time; hard to justify at SMB scale |
| Time to start | 1–2 weeks from the scoping call | Months: recruitment, training, certification |
| Objectivity | No stake in the result: findings are findings | Same employer as the team being audited; bias risk built in |
| Certification | PECB ISO/IEC 27001 and ISO/IEC 42001 Lead Auditor, held by the auditor on every engagement | Depends on the hire; often not certified |
| Breadth | ISO 27001, NIS2, GDPR, DORA, PCI DSS: one auditor across all of them | Usually deep in one framework, thin in the others |
| Acceptance by certification bodies | Audit file structured to certification-body evidence requirements | Variable: independence sometimes challenged at Stage 2 |
FAQ
What IT managers and quality leads ask us about audits.
How is an internal audit different from a penetration test?
A penetration test asks 'can someone break in?': it is a technical attack exercise. An internal audit asks 'are we managing security properly?': it checks governance and compliance against a framework. ISO 27001 requires internal audits and NIS2 asks you to assess your measures; neither requires a penetration test. Mature programmes do both.
Is there an acceptable number of non-conformities?
There is no set limit, and zero findings usually means the audit was not thorough enough. What matters is that findings are evidenced, causes are analysed and corrective actions have owners and deadlines.
Can you provide both the implementation and the audit?
Yes, with formal objectivity management. ISO 27001 Clause 9.2 and NIS2 both expect the auditor to be independent of the work audited. We assign a different practitioner to the audit than the one who supported the implementation, and document the separation in the audit programme. Certification bodies accept this when it is properly evidenced.
What's the difference between an internal and an external audit?
An internal (first-party) audit is your organisation checking itself. An external (third-party) audit is run by an accredited certification body. Certification bodies require evidence of an internal audit before the Stage 2 audit, and internal audits continue every year after certification.
How long does an internal audit take for an SMB?
Three to five weeks from the scoping call to the action plan. Auditor time within that window depends on scope: two to three days for a narrow audit, five to ten days for a typical SMB engagement. Both figures are in the proposal.
What qualifications should an internal auditor have?
ISO 27001 does not name one; Clause 9.2.2 requires auditors who ensure objectivity and impartiality. In practice certification bodies look for a recognised lead-auditor certification such as PECB ISO/IEC 27001 Lead Auditor. The consultant who runs your audit holds both PECB Lead Auditor certifications (27001 and 42001) and the EU GDPR Data Protection Officer certification.
How is the engagement priced?
A fixed fee for the audit: half on signature, half when the report is delivered. The scoping call is free. Quarterly check-ups or annual audit cycles are an option. The figures are in the proposal after the call. No hourly billing.