ISO 27001 · ISO 42001 · SOC 2 · BSI C5
Internal Audit
Your security posture is only as strong as the scrutiny you put it under. We run independent internal audits that surface every finding on your timeline — before your external auditor finds it on theirs
Book a free consultationOne audit. Every framework that needs it
Whether required under ISO 27001 and ISO 42001, or increasingly expected across SOC 2 and BSI C5 ReadySecGo runs internal audits for one framework or several in a single engagement
An internal audit isn't a formality
Internal audit isn't about the framework telling you to do it. It's about knowing — before your external auditor does — whether your controls actually work. Required for some frameworks, encouraged in the rest, and useful regardless of which one you're on
The cost of inaction
Skipping the internal audit doesn't make the problems go away. It just means your external auditor, a regulator, or a customer doing diligence finds them first. For ISO 27001 and ISO 42001, skipping the internal audit isn't a risk — it's a blocker. No internal audit, no Stage 2
Doing it as a formality
Run by the team that built the controls — or the consultants who implemented them — most internal audits produce predictable blind spots, friendly findings, and template checklists. Then your external auditor applies real rigour, and every finding you didn't catch becomes theirs to write up
Findings without a path forward
Most audits end at the findings report. What you do with those findings is your problem. Nothing gets closed, nothing carries forward, and next year's audit surfaces the same issues alongside new ones
Less audit theatre. More audit value
No surprises on audit day
You see every finding your external auditor would see, weeks or months ahead of them. Independent, auditor-led testing calibrated to the rigour your certification body will apply — not the comfort of your own team
Findings you can act on immediately
Every finding comes with a severity rating. Leadership knows what to prioritise and teams know where to start
An audit that compounds
Evidence, findings, and artefacts carry forward into the next cycle. Each audit starts from where the last one ended, so the work you do once keeps paying off
Run an internal audit. Run one that works.
Book a free consultationLess audit theatre. More audit value
No surprises on audit day
You see every finding your external auditor would see, weeks or months ahead of them. Independent, auditor-led testing calibrated to the rigour your certification body will apply — not the comfort of your own team
Findings you can act on immediately
Every finding comes with a severity rating. Leadership knows what to prioritise and teams know where to start
An audit that compounds
Evidence, findings, and artefacts carry forward into the next cycle. Each audit starts from where the last one ended, so the work you do once keeps paying off
Run an internal audit. Run one that works.
Book a free consultationFindings you can act on immediately
Is internal audit for you?
Most internal audits we run start with one of these triggers
- Preparing for certification
- Returning for surveillance
- Rebuilding after a miss
- Responding to a request
- Running multiple frameworks
Recognise yourself?
Here's how we work
Scoping & Planning
We define audit scope, criteria, objectives, and schedule — aligned to your ISMS and chosen framework
Interviews & Field Work
We conduct structured interviews and evidence reviews with control owners across your organisation
Closing Meeting
We walk you through preliminary findings, clarify context, and align on next steps before the report
Audit Report
You get a severity-rated findings report — every nonconformity traced to evidence and structured to do its job whether it's read by your certification body, your regulator, or your own team
Tangible Deliverables
Severity-Rated Findings Report
Every finding classified as Major, Minor, or Observation with root-cause analysis and remediation guidance
Executive Summary
One-page board-ready overview of audit results and risk posture
Corrective Action Tracker
Structured tracker with ownership, deadlines, and status for every remediation item
Auditor Debrief Session
Closing meeting walkthrough of findings with your team to align on next steps
Auditor Competency Evidence
Credentials and accreditations of the lead auditor, ready to present to your certification body or regulator on request
Audit Plan
A documented plan covering scope, criteria, objectives, schedule, and methodology
Why ReadySecGo
We don't audit ISMSs we helped build. If we've done prior work with you on implementation or gap assessment, a different team runs your audit — or we tell you we're the wrong fit
The fine print
Is internal audit actually required?
For ISO 27001 and ISO 42001, yes — formally required, no exceptions. Without one, you can't proceed at Stage 2. For SOC 2 and BSI C5, it's not mandated — but mature programmes run one anyway, because auditors and customers increasingly expect evidence of independent internal testing.
What is included in Internal Audit?
Scoping, structured interviews and evidence reviews, a closing meeting, and a severity-rated findings report within five business days. Remediation guidance through closure is included.
What's the difference between an internal audit and an external audit?
Internal audit is your own test of whether the ISMS works — on your timeline, findings yours to fix. External audit is a certification body or regulator deciding whether you meet the standard — on their timeline, findings in the report that decides your certificate.
Can we do internal audit internally?
Yes, if the auditor is independent of the function being audited. Across frameworks that require it, auditors must be objective and impartial — they can't have designed, implemented, or operated the controls they're testing. Larger organisations with separate compliance or audit functions can do this in-house. Smaller ones rarely can — and when the same team builds and audits the programme, the result is friendly findings, familiar blind spots, and confirmation bias.
Can I use a compliance platform to run the internal audit?
No. Platforms like Vanta, Drata, or Scytale are great at collecting evidence and monitoring controls, but an audit is an independent test by a qualified auditor — not a dashboard check.
Do we need a specific tool or platform for an internal audit?
No tool is strictly required. Internal audits can be run with anything from a compliance platform to a spreadsheet and a document repository. What matters is that evidence is organised, traceable, and reviewable by an independent auditor — not the software behind it.
Is it possible to do internal audit of multiple frameworks in one engagement?
Yes, and it's often the efficient choice. Common controls — access management, incident response, change control, vendor management — overlap significantly across ISO 27001, SOC 2, BSI C5, and ISO 42001.
What happens if an internal audit finds serious nonconformities?
Findings are classified by severity: observations (improvement points), minor nonconformities (a control partly meeting the standard), and major nonconformities (a control missing, broken, or systemically failing). Minor findings typically close within 30–90 days. Majors need to be resolved before an external audit or regulatory review — but "serious" doesn't mean "terminal." Handled properly, even majors become evidence the programme is working.
Will the external auditor see our internal audit findings?
It depends on the framework. For ISO 27001 and ISO 42001, yes — the audit is part of what the external auditor reviews. For SOC 2 and BSI C5 external auditors only see it if you reference it in your programme or share it. Either way: findings aren't red flags. What auditors don't want to see is a programme that never finds anything, or finds things and doesn't close them.
What do we walk away with?
A severity-rated findings report, an executive summary written for leadership, and a closing meeting that aligns the team on next steps. Every finding is sourced to evidence. For ISO 27001 and ISO 42001, the report and your closure record become the evidence your certification body or regulator will review. For SOC 2 and BSI C5, they're internal artefacts that drive your improvement cycle — and increasingly, evidence customers and auditors want to see anyway.
When do we need to do internal audits?
Most organisations time them 6–10 weeks before the external audit or regulatory review, with ad-hoc audits triggered by significant changes or incidents.
How often do we need to do internal audits?
Depends on the framework. ISO 27001 and ISO 42001 require internal audits at planned intervals — typically annually, with full coverage across a three-year certification cycle. SOC 2 and BSI C5 don't mandate a frequency, but mature programmes run one annually.
How does ReadySecGo differ from general consultancies?
A few ways. We're auditor-led — our team actively audits for UKAS and DAkkS accredited certification bodies. We're built for tech teams — tool-agnostic and fluent in the technology underneath your controls. And we're structured differently — fixed scope, fixed price, no separate engagement for remediation.