Find and fix every issue on your timeline, before it costs you the certificate
No certificate. Clause 9.2 makes the internal audit a requirement, not a recommendation. No internal audit, no certificate.
Friendly findings. An easy internal audit feels good until the certification audit. Your external auditor will find every issue it missed, and those findings can cost you the certificate.
The report problem. Nobody owns the findings, so nothing gets fixed, and your external auditor finds the same issues again.
You see every finding your certification body would see, weeks or months ahead of them.
Every finding is rated Major, Minor or Observation and comes with a remediation plan. Leadership knows what to prioritise and teams know where to start.
Documentation your certification body asks for, ready to hand over: audit programme, audit plan, report, auditor credentials and corrective actions.
Walk into your next ISO 27001 external audit already knowing the findings, with the fixes done and the evidence ready.
We define audit scope, criteria, objectives and schedule against your ISMS (your ISO 27001 security setup).
We interview the owners of your security controls and test the evidence across your organisation: how the controls run, not just how they're written.
We walk you through preliminary findings, clarify context, and align on next steps before the report.
You get a severity-rated findings report and a remediation plan to close every finding, each traced to the ISO 27001 requirement and the evidence behind it. Both are written to be read by your certification body as well as your own team.
ISO 27001 Internal auditHow a YC-backed AI startup kept its ISO 27001 preparation focused on what its product needed.
Madeleine MalmstenCTO & Co-founderThe external auditor was very impressed.
What I particularly liked about ReadySecGo was the speed, the flexibility, and how knowledgeable and engaged the team was. We had a very insightful internal audit. By the 2nd surveillance audit, every potential nonconformity had already been identified and addressed. The external auditor was very impressed.
Boris BudeckISO · XQueueWe were fully prepared for our ISO 27001 external audit!
ReadySecGo ran our internal audit and got us ready for the external one. They worked with us as a team, understood the technical detail, and delivered structured findings in the Internal Audit Report, right on time.
Nikolas StrommengerISO · kobaltblauWe audit for several accredited certification bodies across Europe, so we know what your external auditor looks for and we find it first.
Problems will surface in any ISMS. Clause 10.2 decides whether you learn from them: how to find the root cause and close findings with evidence auditors accept.
ISO 27001 · May 26, 2026
ISO 27001 Clause 8: putting the plan into actionRun ISO 27001 Clause 8 as four workstreams (operational plan, risk treatment, corrective actions and general tasks) so your ISMS holds up at Stage 2.
ISO 27001 · June 30, 2026
ISO 27001 Clauses 4–10: the first steps in setting up your ISMSGoing for ISO 27001 for the first time? See what Clauses 4–10 require you to document and evidence, with a focused plan for your first 90 days.
ISO 27001 · March 3, 2026
See more articles on the Knowledge HubWithin five business days, you get a findings report that rates each issue Major, Minor or Observation. For every finding it explains the root cause and how to fix it, so you know how serious each one is and what to do about it. A corrective action tracker gives every fix an owner and a deadline, and a one-page summary tells your board where you stand. We go through the findings with your team in a debrief. You also get the audit plan and the lead auditor's credentials, which your certification body will ask for as proof the audit was done properly and independently. Full answer
Yes. Clause 9.2 requires internal audits at planned intervals, and your certification body checks for one before the certification audit (Stage 2). No internal audit, no certificate. That applies to your first certification and to every surveillance and recertification audit after it. Full answer
6 to 10 weeks before each external audit: certification, surveillance or recertification. That leaves enough time to close the findings and still have the evidence ready. Extra audits make sense after significant changes or incidents. Full answer
At least once a year. ISO 27001 asks for internal audits “at planned intervals”, and your certification body expects a fresh one before every surveillance audit. Each audit doesn’t need to cover everything, but over the three-year certification cycle, together they must cover every requirement and every security control that applies to you (Annex A). Your audit programme is the plan that shows how. If you don’t have one yet, we write it with you. Full answer
Internal audit is your own test of whether your security setup works, on your timeline, with findings yours to fix. External audit is your certification body deciding whether you meet the standard, on their timeline, with findings in the report that decides your certificate. Full answer
No. The internal audit (Clause 9.2) tests whether your security setup works. The management review (Clause 9.3) is leadership looking at the results, including the audit findings, and deciding what changes. The audit feeds the review, and you need both before every external audit. Full answer
Yes, if the auditor is objective and impartial, which is what Clause 9.2 asks for. They can't have designed, implemented, or operated the security measures they're testing. Larger organisations with a separate compliance or audit function can do this in-house. Smaller ones rarely can, and when the same team builds and audits the security setup, the result is friendly findings, familiar blind spots, and confirmation bias. Full answer
No. Accreditation rules (ISO/IEC 17021-1) stop a certification body from providing internal audits to the companies it certifies. The internal audit has to come from you or from an independent third party. That's where we come in. Full answer
Findings are classified by severity: observations (improvement points), minor nonconformities (a requirement partly met), and major nonconformities (a requirement not met at all, or a security control missing, broken, or systemically failing). Minor findings typically close within 30–90 days. Majors need to be resolved before your next external audit, but "serious" doesn't mean "terminal." Handled properly, even majors become evidence your security setup is working. Full answer
Yes. The internal audit report and the corrective actions are part of what your certification body reviews. Findings aren't red flags. What auditors don't want to see is an audit that never finds anything, or finds things that never get closed.
No. Platforms like Vanta, Drata, or Scytale are great at collecting evidence and monitoring your security setup, but Clause 9.2 asks for an independent audit by a qualified auditor, not a dashboard check.
Yes. ISO 42001 and ISO 9001 have the same internal audit requirement as ISO 27001.
