Pass your certification audit the first time.
ISO 27001 requires an independent internal audit before a certification body ever opens your ISMS. We run it the way your external auditor will, find the nonconformities while they still cost you days instead of a quarter, and hand over the signed report your certification body expects.
A failed Stage 2 costs you a quarter.
ISO 27001 is pass or fail. One major nonconformity means corrective action, a re-visit, and a certificate that slips past the customer deadline that started the project. Your internal audit exists to catch those findings while they still cost days.
You cannot audit the controls you built
On a small team the person who built the ISMS is the only person who understands it, and that is exactly who the standard disqualifies from auditing it. An outside auditor is not a nice-to-have. It is how you meet the requirement.
A green dashboard will not get you certified
Your platform tracks whether a control exists. An auditor asks whether it operated, who approved it, when it was reviewed, and where the record is. We test you against the second standard, because that is the one waiting at Stage 2.
A list of gaps does not tell you what to do Monday
Most audit reports tell you what is wrong and stop there. Every finding you get from us carries the requirement it maps to, the root cause, a corrective action with an owner and a date, and a verification step that confirms it closed.
Assess, remediate, re-test, report.
Two to three weeks from kickoff to signed report. Throughout, you are in a shared Slack Connect channel with our team doing the work, so your questions get answered the same day instead of on the next call.
Nothing gets tested before you agree what is in scope
You get an audit plan built around your ISMS scope, your risk context, and your certification date. Systems, locations, and applicable controls are confirmed up front.
You see the findings while you can still fix them
The gap assessment is an early read, not a verdict. Findings come back as a working list, so you know exactly what has to move before the formal audit begins.
You get the fix, not just the finding
Every gap comes with root cause, the specific change that closes it, and an effort estimate. Your team applies the change, which is what keeps the audit independent.
We test you the way your certification body will
Evidence-based testing across the full management system and every applicable control. Policies, procedures, records, system configurations, and whether they actually operated.
You walk into Stage 1 with the signed report in hand
The internal audit report your certification body asks for, plus a final review against auditor expectations so nothing in your ISMS surprises you or them.
Ninety percent ready is the right time to reach out.
Waiting for a perfect dashboard means waiting past your certification date, and several of the items teams stall on can be closed during the audit window rather than before it.
You can start a couple of days after the statement of work is signed.
Six deliverables. One flat fee.
Scoped to your size and systems — not billed by the hour, and not re-quoted when remediation takes another round.
Audit planning and scope definition
A tailored audit plan aligned with your ISMS scope, risk context, and certification goals.
Independent, objective assessment
Evaluation of ISMS controls against ISO 27001:2022 by qualified auditors with no stake in the outcome.
Evidence-based control testing
Policies, procedures, records, system configurations, and operational effectiveness — not just documentation.
Findings and gap analysis report
A clear breakdown of conformities, nonconformities, and improvement opportunities.
Corrective action guidance
Actionable remediation steps, prioritized by what actually blocks certification.
Readiness check for certification
A final review against auditor expectations, so the certification body finds nothing you have not already seen.
Scope: ISMS, production environment
Lead auditor: Securest, independent
Signed, dated, and structured the way a certification body expects to receive it.
We already know what your certification body accepts.
Internal audit is one of the services we offer inside a full compliance practice, and we partner with the certification bodies and audit firms our clients use. So your findings are written by people who know how each one reads evidence — not by someone guessing at it from a checklist.
The auditors on your kickoff call write your report
100% in-house and US-based. No offshore delivery team, no subcontracted assessors, no handoff to someone you have never met after you sign.
Keep the platform you already pay for
Secureframe, Vanta, Drata, ControlMap, Scrut, Sprinto, or a folder of spreadsheets. We work inside whatever you use, so nothing has to be migrated before we start.
Three rounds of remediation cost the same as one
One flat fee, scoped up front to your headcount, systems, and locations. If closing a finding takes another pass, the price does not move and neither does the invoice.
Next year’s audit is already handled
Certification is not the end — surveillance audits need an internal audit every year. The engagement renews with the same team and the same working papers, so year two is faster than year one.
Our audit partnerships open the door for you
We work alongside accredited certification bodies and audit firms year round. If you have not selected one, you get warm introductions that fit your timeline and budget instead of a cold search.
Cover SOC 2 while we are already in your environment
SOC 2 does not require an internal audit, but roughly seventy percent of the controls overlap with ISO 27001. If you are pursuing both, we review the remainder on the same engagement.
You get corrective guidance on every finding.
Root cause, the specific change that closes the gap, an effort estimate, and a re-test to verify it worked. You are never handed a finding without a path to closing it.
Your team makes the change, and that is what keeps the audit independent — the same separation your certification body expects to see. Advisory on one side, implementation on yours, and a clean line between them.
Know what you need before you move forward.
What is an internal audit for ISO 27001?+
A structured, evidence-based review of your ISMS against ISO 27001:2022, conducted by someone independent of the controls being tested. The standard requires it at planned intervals, and your certification body will ask to see the report and the audit programme behind it.
When do I need one?+
Before your Stage 1 audit, and every year after that to support surveillance. Practically: once you are around ninety percent complete in your GRC platform and have a certification date in mind. Waiting for a hundred percent usually costs you the date.
How is it different from the certification audit?+
The certification audit is performed by an accredited body and decides whether you are certified. The internal audit is yours — it finds the problems first so the external one does not. Same rigor, no consequences beyond a corrective action you have time to complete.
What evidence do I need to provide?+
Your ISMS documentation and Statement of Applicability, published policies and procedures, risk assessment and treatment plan, management review and training records, access and vendor reviews, and read access to the systems in scope. We send a structured request list at kickoff — most of it already lives in your GRC platform.
How long does it take?+
Typically two to three weeks from kickoff to signed report, plus whatever time your team needs for remediation between the gap assessment and the final audit. You can start a couple of days after the statement of work is signed.
Do you help us fix the findings?+
Yes. Every finding comes with corrective action guidance — root cause, the specific change that closes it, effort, and sequence — and we verify the fix on re-test. Your team applies the change, which is what keeps the audit independent and the report credible to your certification body. If you want hands-on implementation, our compliance practice covers that as a separate engagement.
What happens after the internal audit?+
You get the signed report and a readiness statement, and you go to your certification body. If you have not picked one, we will introduce you. A year later we run it again for your surveillance cycle.
Can you cover SOC 2 at the same time?+
Yes. SOC 2 does not require an internal audit, but around seventy percent of the controls overlap with ISO 27001. Adding an independent review of the remaining SOC 2 controls is an option on the same engagement.
Who actually does the work?+
Our own auditors, all in-house and US-based. Nothing is subcontracted or sent offshore, and the people on your kickoff call are the people who write your report.
Get a quote for your internal audit.
Send us your headcount, systems, platform, and target certification date. You get a fixed-fee statement of work within one business day.