ISO 27001 audit (internal and pre-certification)
An ISO 27001 audit shows whether your information security management system meets ISO/IEC 27001:2022 and works in day-to-day operations. We run gap analyses, internal audits, pre-certification audits and supplier audits, both for organizations with a working ISMS and for those still planning one. You get a report that ties each nonconformity to a clause and to evidence, plus a plan to close them before the certification body's audit.
- Nonconformities found before the certification body sees them
- An internal audit report that meets clause 9.2 of the standard
- Controls verified by testing, not just on paper
Your contact:Bartosz MachnikUpdated:
What is an ISO 27001 audit
An ISO 27001 audit checks whether your information security management system (ISMS) meets the requirements of ISO/IEC 27001:2022 and whether people actually follow it. The audit criteria are clear: the requirements in clauses 4-10 of the standard and the 93 controls in Annex A.
The internal audit is a requirement of the standard itself (clause 9.2). You run it at planned intervals, on your own or with an outside firm, and the results feed into the management review. A certification audit is a different thing: an accredited certification body carries it out and decides whether to issue the certificate. PWNONE does not issue certificates. We prepare you for the certification body's audit and help you close the nonconformities it finds.
An audit is not an implementation project. We assess the system you have or are planning and show you what is missing; building an ISMS from scratch is a separate service. We are also a penetration testing firm (OSCP, OSWE), so we test selected controls that your Statement of Applicability lists as implemented instead of taking the documents at their word.
When to order an ISO 27001 audit
- You are planning an ISMS, or have one mostly on paper, and want to know how far you are from the standard (an ISO 27001 gap analysis)
- Your ISMS is running and you need the internal audit required by clause 9.2, but nobody on your team is independent of the processes being audited
- Your certification audit is coming up and you want to find nonconformities before the certification body does (a pre-certification audit)
- You are already certified and want to check the system before the annual surveillance audit or after a major change, such as moving to a new cloud provider
- You entrust information to a supplier and want to check whether its security matches what it claims in questionnaires or contracts (a second-party audit)
We don't issue ISO 27001 certificates; an accredited certification body does that after its own audit. If you still need to build your ISMS, go straight to ISMS implementation, which starts with a gap analysis. If your main concern is keeping the whole organization running through a disruption, an ISO 22301 audit is the better fit, because ISO 27001 covers continuity only from the information security side.
What an ISMS audit checks
We check the requirements in clauses 4-10 and the Annex A controls your Statement of Applicability (SoA) marks as applicable. The scope depends on the audit type: a gap analysis covers every requirement and all 93 controls, while an internal audit can cover selected processes if your audit programme spreads the rest over later dates.
Context and ISMS scope (clause 4)
We check whether the ISMS boundaries cover the processes, sites and suppliers your information depends on, and whether every exclusion is justified. Since Amendment 1:2024, the standard also requires you to determine whether climate change is a relevant issue.
Leadership and roles (clause 5)
We look at whether the information security policy is approved and known to staff, and whether roles are assigned to named people. We also talk to top management about how they oversee the system.
Risk and the SoA (clauses 6 and 8)
We compare the risk register, the risk treatment plan and the Statement of Applicability, because the three have to be consistent. Every excluded control needs a justification.
Annex A controls
93 controls in 4 groups: organizational (37), people (8), physical (14) and technological (34). We check the ones marked as implemented against evidence and test selected ones technically, such as MFA, backups and event logging.
Operational records (clauses 7 and 8)
We look for evidence that the ISMS runs day to day: training attendance lists, the incident register, change records and document control. A policy says what you do. Records show that you do it.
Evaluation and improvement (clauses 9-10)
We assess your metrics, internal audit programme and management review. We also check whether nonconformities from earlier audits have closed corrective actions.
How the audit works
Audit type and scope
We agree which audit you need, which processes, sites and controls it will cover and against which criteria. You receive an audit plan listing the interviews and documents we will ask for.
Document review
We read your security policy, Statement of Applicability, risk assessment and the results of previous audits. They tell us what to ask about in the next step.
Interviews, records and tests
We talk to top management, process owners and administrators. We ask for records from the period the system has been running and test selected controls technically.
Report and closing meeting
Each finding comes with the relevant clause and evidence. We go through the results with management at a closing meeting, then deliver the final report.
Corrective actions
We help you plan the fixes and agree what evidence will confirm that each nonconformity is closed. A gap counts as closed when the fix works, not when someone approves a document.
What the audit is based on
- ISO/IEC 27001:2022 requirements: clauses 4-10 of the standard and the 93 Annex A controls
- The ISO 19011 and ISO/IEC 27007 auditing guidelines, which describe how to plan an audit and base findings on evidence
- Objectivity and impartiality, as clause 9.2 requires: auditors don't assess controls they designed or implemented themselves
- Evidence over statements: every finding rests on a document, a record or a test, and a claim without evidence is rated as not demonstrated
- For organizations covered by Poland's KSC Act, its ISMS requirements (Article 8) as well, because the certification scope and the statutory scope can differ
What you get after the audit
- An audit report listing every finding with its clause, evidence and severity
- A rating of the audited controls on three levels: whether the control exists, whether it is implemented across the full scope and whether it works over time
- A gap register with an owner, a deadline and a closure criterion for every item
- A closing meeting with management and input for the management review (clause 9.3)
- After an internal audit, a report that serves as evidence of clause 9.2 for the certification body's auditor
Frequently asked questions
What is the difference between an ISO 27001 internal audit and a certification audit?
An ISO 27001 internal audit is a requirement of the standard (clause 9.2): the organization plans it and can run it in-house or hire an outside firm. A certification audit is carried out in two stages by an accredited certification body, which then decides whether to issue the certificate. PWNONE runs internal and pre-certification audits but does not issue certificates.
Which ISO 27001 audit do I need: gap analysis, internal or pre-certification?
It depends on where your ISMS stands. A gap analysis makes sense before implementation, or when the system exists mostly in documents. An internal audit is for a working ISMS that has to meet clause 9.2, and a pre-certification audit should be scheduled early enough to close nonconformities before the certification body arrives. A supplier audit is a separate case: you assess the system of a company you entrust your information to.
Can an external company perform an ISO 27001 internal audit?
Yes. The standard requires internal audits, but not that your own employees perform them. It does require auditors to be objective and impartial, and in a small team it is hard to find someone who would not be auditing their own work. Outsourcing the internal audit solves that, while the organization stays responsible for the audit programme and corrective actions.
How often should an ISO 27001 internal audit be carried out?
The standard doesn't set a specific frequency. It requires audits at planned intervals and an audit programme that takes into account the importance of the processes and the results of previous audits. Before initial certification, the certification body checks that an internal audit and a management review have taken place, and after that it returns every year for a surveillance audit. Plan the internal audit so that corrective actions are closed before that visit.
Can an ISO 27001 audit also cover the KSC Act's ISMS requirements?
Yes, as far as the ISMS goes. For organizations covered by the KSC Act (Poland's NIS2 law), we add its ISMS requirements under Article 8 to the audit criteria, because the ISO 27001 certification scope and the ISMS scope the Act requires can differ. The report then shows where they diverge. However, an ISO 27001 audit doesn't replace the Article 15 audit, which essential entities must complete at least every 3 years. Nor does it cover obligations the standard has no equivalent for, such as entry in the register of essential and important entities or incident reporting deadlines.
How much does an ISO 27001 audit cost?
The cost of an ISO 27001 audit depends on the audit type, the ISMS scope, the number of sites and processes and whether we add technical testing of controls. We don't publish a price list, because two audits rarely look the same. We quote after a call where we agree the scope. If you then go for certification, the certification body's audit is a separate cost, paid directly to that body.
Talk to Bartosz Machnik about your ISO 27001 audit
Bartosz Machnik, CBDO at PWNONE, is an ISO/IEC 27001 Lead Auditor certified by TÜV NORD Polska and specializes in ISO 27001, NIS2 and DORA compliance audits. Tell him where your ISMS stands. He'll suggest the type and scope of the audit, and if you need less than you expect, he'll tell you so.
Book a call about an ISO 27001 audit