Both ISO 27001 (clause 9.2) and ISO 42001 require you to conduct internal audits at planned intervals — typically annually — to check that your management system still conforms to the standard and is effectively implemented. Certification bodies expect to see evidence of this at every surveillance audit.
Auditors must be independent of the area being audited — you generally can't audit your own work.
A fixed, predictable cycle — so you know what happens, and when.
Readiness check and audit plan. We review your documentation and evidence and flag gaps with comments — you can close them before the interview.
Opening meeting and staff interviews, then a second review round to verify your fixes. Gaps you corrected stay on record as found-and-fixed, which is what certification bodies expect to see.
Draft report for your factual review, then a signed final report with nonconformities (major/minor), opportunities for improvement, and a Stage 1 / Stage 2 readiness verdict.
Typical timeline: 10 business days from kickoff to signed report, when your evidence is ready.
Planned, executed, and documented to the standard your certification body expects.
A risk-based audit plan and schedule covering all required clauses and Annex A / Annex controls over your audit cycle.
Interviews, evidence sampling, and walkthroughs to verify controls are implemented and operating as documented.
Findings classified by severity, with root cause context so corrective action actually resolves the issue.
We track remediation to closure so open findings don't surface for the first time in front of your certification auditor.
A formal report suitable for your certification body and management review — the exact artifact auditors ask for.
Findings packaged into the inputs your leadership team needs for the required management review meeting.
Covers your ISMS against the clause requirements and the Annex A controls in your Statement of Applicability.
Covers your AI Management System — governance, risk treatment, and controls over how AI systems are developed, deployed, and monitored.
Already certified to, or extending into, cloud and privacy standards? We audit them together with your ISO 27001 program — one engagement, one plan, one report.
An independent, third-party risk analysis that satisfies the HIPAA Security Rule — a gap assessment, not a certification or a Type I/II audit.
Establishes your current HIPAA security posture as a documented starting point for remediation.
Satisfies the risk analysis requirement under the HIPAA Security Rule — the document regulators and cyber insurers ask for first.
Built on the HHS/OCR Security Risk Assessment methodology, or an equivalent recognized framework.
Every gap identified and ranked so remediation effort goes where it reduces risk first.
We can stay engaged after the assessment to help close the gaps we find, using the results as a starting point.
This engagement doesn't include SOC 2 readiness, a Type I/II audit, or penetration testing — those are scoped separately.
Book a free 30-minute consultation. We'll scope your audit cycle and give you a fixed-price quote — no obligation.