Cyber & ISO · Auditors with no stake in the answer
ISO 27001 Internal Audit and Readiness Assurance
The mandatory clause 9.2 internal audit, delivered by qualified lead auditors with no stake in the answer: findings ranked exactly as the certification body would rank them, evidence chained, corrective actions guided, and a clear verdict before Stage 1, Stage 2 or your next surveillance visit. From £4,500 + VAT, one to two weeks.
The audit at a glance
Definition
What is an ISO 27001 internal audit?
An ISO 27001 internal audit is the check the standard itself demands: clause 9.2 requires the ISMS to be audited against both ISO/IEC 27001 and your own rules, at planned intervals, by auditors who are objective and impartial. Certification bodies read the internal audit before they read almost anything else, because it tells them whether the system inspects itself honestly.
Intelance delivers outsourced ISO 27001 internal audits through qualified lead auditors from £4,500 + VAT, fixed by scope, in one to two weeks. Full audit programmes and multi-site scopes run from £9,500 + VAT. Findings are ranked major, minor and observation, on the same scale your certification body uses, and every audit ends in a close-out path rather than a list.
Where the audit cycle is one of several things slipping, the Managed ISMS runs the whole rhythm with audits kept independent inside it. The wider practice is described under ISO 27001 consulting.
How this satisfies clause 9.2
The mandatory audit planned, delivered and documented as the standard requires.
Ranked as it will be judged
Major, minor, observation: the same scale your external auditor uses.
Evidence chained
Every finding tied to the clause, the control and the record behind it.
A close-out path
Corrective actions guided to done rather than listed and abandoned.
The decay
Six places ISMSs quietly rot between audits
Certified systems rarely fail loudly. They decay in the same six places, and surveillance audits are designed to find exactly these. Each card shows where the internal audit catches it first.
The evidence trail
Reviews still happen but the minutes stop. Controls still run but nothing proves it. Decay starts in the records first.
Caught hereEvidence tested per control, exactly as Stage 2 and surveillance will test it.The risk-to-SoA thread
New risks appear, treatments change, and the Statement of Applicability quietly stops matching the register.
Caught hereThe thread traced end to end: risk, treatment, control, SoA, evidence.Control operation
The control exists on paper and in the tool, and nobody has run it since the last audit.
Caught hereOperation sampled and tested rather than attested.Management review substance
The meeting happens, the same slides recycle, and the inputs and outputs the standard requires are nowhere.
Caught hereReviews checked against the required agenda, with the gaps named.Corrective actions
Findings from the last audit acknowledged, assigned and never closed. External auditors pull this thread first.
Caught hereThe action log audited to done, with overdue items ranked by risk.Scope drift
New systems, suppliers, sites and home working arrive. The certified scope stays frozen in the original document.
Caught hereThe declared scope tested against the estate as it is today.How it works
One to two weeks sequenced to your audit calendar
The audit runs to a published rhythm and is timed backwards from your external audit date, so findings arrive with time to close them.
The audit plan
Scope, clauses and sampling agreed against your certification calendar, so the audit lands where the risk is.
Fieldwork
Documents reviewed and control owners interviewed, specifically and without theatre.
Control testing
Controls sampled and tested against evidence, exactly as the certification body will test them.
Findings and validation
Every finding validated with its owner and ranked major, minor or observation before anything is written down.
Report and close-out
A ranked report with a clear verdict, corrective actions sequenced, and support to close them before the external audit.
Smaller scopes finish inside a week. Multi-site programmes take longer and are planned across the certificate cycle. Where we also run your ISMS, the audit team is kept separate, and where we built it, we say so and you choose.
Published fees
What the audit usually uncovers next
Every route out of the findings is priced here, before you ask.
ISO 27001 Gap Assessment
Not certified yet? The assessment measures the whole distance and prices the journey, before anything is committed.Best whenYou are starting cold rather than maintaining. FeeFrom £8,500 + VAT1 to 2 weeks 02
Managed ISMS
The whole rhythm run for you month by month, with the internal audit cycle delivered independently inside it.Best whenAudits are not the only thing slipping. FeeFrom £2,500 + VAT / month 03ISMS Foundations & Implementation
When the audit finds more than an audit can fix: the system rebuilt properly by practising lead auditors.Best whenThe findings amount to a rebuild rather than a repair. FeeFrom £25,000 + VAT3 to 6 months 04
ISO/IEC 42001 for AI
The AI management system standard, audited on the same visit and the same evidence base where wanted.Best whenAI systems are creeping into the certified scope. FeeAIMS implementationPriced by scope
The alternatives
The routes compared
Three ways organisations handle clause 9.2. The difference is who finds the problems, and when.
Someone internal audits the system their colleagues run, around the day job
Objectivity is hard to defend when the auditor reports to the ISMS owner
Internal time, plus the risk that clause 9.2 itself becomes a finding
Large teams with trained, genuinely independent internal auditors
Skip the internal audit and let Stage 2 or surveillance find the problems
None, but every finding is now a nonconformity on the record
The certificate, at the worst possible moment
No one deliberately. It is what happens by default
Qualified lead auditors from £4,500 + VAT, with no stake in the answer
Designed in: external auditors with nothing to defend
Fixed by scope, with findings while there is time to fix them
Certified organisations that want a clean external audit, on the record
Scope
What the fee covers and what sits outside it
You get
A clause 9.2 audit planned, delivered and documented as the standard requires.
Findings ranked major, minor and observation, on the same scale your certification body uses.
Every finding chained to the clause, the control and the evidence behind it.
A corrective action path, sequenced and supported through to closure.
A clear readiness verdict before Stage 1, Stage 2 or the next surveillance visit.
This is not
The certification audit. Only a UKAS accredited body certifies. This is the audit that gets you through theirs cleanly.
A box tick. A thin internal audit is itself a finding, because certification bodies read yours first.
A blame hunt. Findings are validated with their owners before they are written, and ranked by risk rather than drama.
A conflict of interest. Where we also run your ISMS the audit team is separate, and where we built it, we say so and you choose.
Where to start
The situations that bring people here
Four situations we are usually called into. If none of them fit, speak to a lead auditor and we will point you at the right first step.
Why Intelance
What you can expect from a licensed body
Independent of the outcome
External lead auditors with nothing to defend and no budget to protect, which is what objectivity looks like in practice.
Ranked the way it will be judged
Major, minor and observation on the certification body scale, so the external audit holds no surprises.
Sequenced to your calendar
The audit is timed backwards from the external date, so findings land while there is time to close them, never the week before Stage 2.
Published fixed fees
From £4,500 + VAT by scope, with full programmes and multi-site scopes from £9,500 + VAT, agreed in writing before day one.
Closure is part of the job
The report ends in a close-out path, and support runs until the corrective actions are genuinely done.
The people behind the work
Every audit is delivered by qualified lead auditors, independent of any team operating your controls. Nothing is offshored and nothing is templated.
ISO 27001 guides
All insights
ISO 27001ISO 27001 cost UK: what certification really costs (2026)
The real components of ISO 27001 cost in the UK: consultancy fees, certification body charges over the three year cycle, internal time, ongoing running costs, and where budgets quietly drift.
10 July 2026 · 6 min read Read the guide
CybersecurityISO 27001 readiness assessment checklist (UK)
8 December 2025 · 11 min read
Cyber EssentialsCyber Essentials vs ISO 27001 vs IASME Cyber Assurance: which do you need?
9 July 2026 · 6 min read
Cyber EssentialsCyber Essentials vs ISO 27001: when you need one, both, and in what order
23 March 2026 · 10 min readReady to talk?
Tell us when the auditors are coming
Thirty minutes with a lead auditor on your certification calendar, the last internal audit and what has slipped since. If Stage 2 or surveillance is inside three months, say so: the plan is sequenced backwards from that date.
FAQs
Internal audit questions answered
What is an ISO 27001 internal audit?
The check clause 9.2 of the standard demands: the ISMS audited against both ISO/IEC 27001 and your own rules, at planned intervals, by objective and impartial auditors, with the results documented and reported to management. It is mandatory, and certification bodies read it before almost anything else.
What does clause 9.2 require?
An audit programme covering the whole ISMS at planned intervals, auditors who are objective and impartial about what they audit, defined criteria and scope for each audit, results reported to relevant management, and documented evidence of all of it. A thin or missing internal audit is one of the most common external audit findings.
How much does an ISO 27001 internal audit cost?
From £4,500 + VAT with Intelance, fixed by scope and agreed in writing, over one to two weeks. Full audit programmes and multi-site scopes run from £9,500 + VAT, planned across the certificate cycle.
How long does it take?
One to two weeks for most single site scopes, from audit plan to ranked report. Smaller scopes finish inside a week. The audit is sequenced backwards from your external audit date, so findings arrive with time to close them.
Can we run internal audits ourselves?
Yes, if you can genuinely satisfy the objectivity requirement: auditors trained for the job who do not report to the ISMS owner and do not audit their own work. Large organisations manage this. Small teams usually cannot, and certification bodies notice when the internal audit reads like a self-assessment.
How often are internal audits required?
At planned intervals that cover the whole ISMS across the certification cycle. Most organisations run at least one full internal audit a year, timed ahead of the surveillance or recertification visit, with larger scopes split into a rolling programme.
What happens with the findings?
Each one is validated with its owner before it is written, ranked major, minor or observation on the certification body scale, and chained to the clause, control and evidence behind it. The report ends in a sequenced close-out path, and we support the corrective actions to completion.
What is certification readiness assurance?
The verdict layered on top of the audit: a clear view of whether you would pass Stage 1, Stage 2 or the next surveillance visit today, and what must close before you would. It exists so the external audit is a confirmation rather than a discovery.
Is there a conflict if Intelance also runs or built our ISMS?
Where we run your ISMS through the Managed ISMS, the audit team is kept separate from the person running your rhythm. Where we built the system, we tell you plainly and you choose whether we audit it or another provider does. Independence is the product here, and we protect it.