No. Clause 9.2 requires audits that are objective and impartial, and a consultant who wrote your policies and set up your controls would be checking their own work.
Certification auditors look for this. They compare the names on the internal audit report with the names on the ISMS documents and in the project history. If the same people appear in both, the impartiality requirement is not met and they record a nonconformity. It returns every year until the arrangement changes.
There are two clean ways to handle it:
- Use a different firm for the internal audit from the one that built the ISMS.
- If one firm does both, keep the people separate: the consultants who built the ISMS do not audit it. Many certification bodies accept this when the separation is documented, for example in the audit plan and in a short impartiality statement from the auditor.
The same logic applies area by area. A consultant who only advised on supplier management can audit the other areas, and someone else audits supplier management.