Certifying for the first time
The certification body will expect evidence of at least one full internal audit before Stage 2. We deliver it with the rigour they will recognise.
The requirement
What Clause 9.2 actually requires
Clause 9.2 of every ISO management system standard requires the organisation to conduct internal audits at planned intervals, covering the whole management system over time, performed by auditors who are objective and impartial about what they audit. That last part is where small and medium organisations get stuck: the person who runs the management system cannot impartially audit it, and hiring a full-time internal auditor rarely makes sense.
The standards expressly allow internal audits to be outsourced. That is the service: you get a qualified, independent auditor on a planned programme, and your certification body sees an internal audit function that actually functions.
Deliverables
What an engagement includes
- D1An internal audit programmeA planned schedule covering every clause and control of your management system across the certification cycle, agreed with you and visible to your certification body.
- D2Clause-by-clause audit plansEach audit names what will be examined, who we need to speak to, and the evidence required, requested once, up front.
- D3Fieldwork that tests realityInterviews, evidence sampling and control testing. We test what actually happens, not what the policy says should happen.
- D4Findings register and reportNonconformities and opportunities for improvement, prioritised by risk, each with a plain-English explanation and a practical corrective action with an owner and a date.
- D5Follow-up verificationWhen corrective actions are done, we verify and formally close them, so your surveillance audit starts from an evidenced position.
Who this is for
Three situations we see most
Already certified
An annual programme that keeps the internal audit obligation met between surveillance visits, without a compliance hire.
Running multiple standards
ISO/IEC 27001, ISO/IEC 42001 and ISO 22301 share the same structure. One integrated audit cycle covers all of them, at less cost than three separate ones.
Independence, always: we only audit. We take no consultancy or implementation work, we run a conflict check before every engagement, and we decline any audit where impartiality could reasonably be questioned.
FAQ
Fair questions, straight answers
Can internal audits really be outsourced?
Yes. The standards require the audits to happen and the auditor to be impartial; they do not require the auditor to be an employee. Outsourcing is common and certification bodies see it as a strength when the provider is qualified, because impartiality is built in rather than argued for.
How often do internal audits have to run?
At planned intervals, with the whole management system covered over the certification cycle. In practice most small and medium organisations run one full internal audit annually, timed a few months before the surveillance or recertification visit, sometimes split into shorter themed audits across the year. We plan the cadence around your certification calendar.
What does an internal audit cost?
Most internal audits for small and medium organisations run two to five auditor days depending on scope and the number of standards covered. You get a fixed price at scoping, before you commit. If fieldwork uncovers more than the agreed scope, we pause and agree any extension with you before extra time is worked or billed.