Internal audit
Independent internal audits for ISO management systems
ISO management system standards require internal audits at planned intervals by auditors who are objective and impartial. Aegentra audits ISO/IEC 27001, ISO/IEC 42001, ISO/IEC 27701, ISO 9001 and ISO 45001 management systems against agreed criteria, samples operating evidence and reports findings your team can act on, with consultants based in Europe working remotely and on site in Germany.
Clause 9.2
What an independent internal audit covers
What the standards require
Each of these standards requires the organisation to conduct internal audits at planned intervals to establish whether the management system conforms to its own requirements and to the standard, and whether it is effectively implemented and maintained. That means an audit programme, defined criteria and scope for each audit, auditors selected so that objectivity and impartiality are protected, results reported to relevant management and retained evidence.
What we test
Clauses 4 to 10, the applicable controls or operational requirements, your own policies and commitments, and whether previous findings were corrected. Samples are selected by risk, process importance, change and previous results, and the report states what was examined.
Internal audit is not certification
The internal audit is your organisation’s own assurance activity. Stage 1, Stage 2 and surveillance audits are performed by an independent certification body, which alone decides certification. Aegentra is not a certification body.
Standards
Five standards, one audit discipline
Every audit follows the scope and risks of your system. The focus differs by standard.
ISO/IEC 27001
Information security management systems. The audit covers the ISMS scope, risk assessment and treatment, the Statement of Applicability and a risk-based sample of the applicable Annex A controls, such as access management, supplier security, logging and incident response.
ISO/IEC 42001
AI management systems. The audit covers the AI system inventory, AI risk and impact assessments, the Statement of Applicability, human oversight and life-cycle controls, and how third-party AI is governed.
ISO/IEC 27701
Privacy information management systems. The audit covers controller and processor role decisions, processing records, privacy risk treatment, rights handling, transfers, retention and disposal.
ISO 9001
Quality management systems. The audit covers context and interested parties, process control, customer requirements, control of externally provided processes, handling of nonconformities and how quality objectives are monitored.
ISO 45001
Occupational health and safety management systems. The audit covers hazard identification and risk assessment, legal and other requirements, consultation and participation of workers, operational controls, emergency preparedness and incident investigation.
Deliverables
What you receive
- Audit plan
- Scope, criteria, methods, schedule, interviewees and the evidence request, agreed before fieldwork.
- Audit report with graded findings
- Findings graded as major nonconformity, minor nonconformity or opportunity for improvement, each linked to the criterion tested and the evidence examined.
- Corrective-action input
- A findings register your team can use to record correction, cause and corrective action, and an input to management review.
- Close-out review
- Where included in the scope, a review of follow-up evidence that records which actions are verified as closed and which remain open.
How it runs
From audit plan to close-out
Scope and plan
We review the management system scope, audit programme, previous findings and your certification dates, check independence, and agree criteria, schedule and a fixed fee.
Test evidence
We interview process owners and test documents, records, configurations and observed practice against the agreed criteria.
Report
A closing meeting presents the conclusions; the report and findings register show the evidence behind each finding.
Review corrective action
Where agreed, we review correction, cause and effectiveness evidence before an action is marked closed.
Independence
Nobody audits their own work
An auditor must not audit their own work. Before accepting an audit we document the auditor’s competence, any prior involvement with the system, conflicts of interest and reporting arrangements.
Where Aegentra implemented the management system, a different competent consultant who had no part in that work performs the audit, subject to those documented checks. Assigning a different person is not enough on its own: if objectivity and impartiality cannot be protected, a separate provider is required.
We also audit systems built in-house or by other providers, subject to the same checks.
Internal audit due before your certification audit?
Tell us the standard, the scope and your certification dates.