Internal audit and assurance
Know whether your controls work before a regulator, customer or certification body tests them. Led by an ISO 27001 lead auditor.
Assurance your leadership can rely on
ISO/IEC 27001 requires organisations to audit their management system at planned intervals. Done well, that requirement becomes the most useful check you run all year.
Independent view
An objective opinion on whether controls are designed well and operating, separate from the people who run them.
Evidence that stands up
Records and samples tested the way an auditor or regulator would test them.
Problems found early
Findings surface while they are cheap to fix, not during a certification audit or an inspection.
A clear board picture
Graded findings and trends leadership can use in management review and risk decisions.
What we audit
ISMS internal audit
A full-scope or sampled audit of your ISO/IEC 27001:2022 management system, clauses and Annex A controls.
Pre-certification readiness audit
A rehearsal that tests your ISMS the way a certification body is likely to, so gaps close before the real audit.
Regulatory compliance audit
Conformity with the Data Protection Act, Bank of Ghana ICT directives and other rules that govern your sector.
Data protection and privacy audit
How personal data is collected, used, shared and protected, including notices, registration and breach handling.
Third-party and supplier audit
Whether critical vendors meet the security and data protection terms they signed up to.
Continuity and incident readiness review
Whether plans exist, have been tested and would work under pressure.
How an audit runs
Every engagement follows the same disciplined cycle, from the audit programme to verified closure of findings.
Scope and plan
A risk-based audit programme, criteria and schedule agreed with leadership.
Examine
Interviews, records, sampling and observation of controls in operation.
Report
Evidence-based findings, graded by severity, in language the board can act on.
Correct
Corrective actions agreed with named owners and dates.
Verify
Follow-up to confirm findings are closed and the fix works.
What you receive
- An audit programme and plan agreed in advance
- A findings report built on evidence, not opinion
- Findings graded as major or minor nonconformities, observations and improvement opportunities
- A corrective action register with owners and dates
- Follow-up verification once actions are complete
- A summary for management review
How we keep audits objective
We follow the principles of ISO 19011, the international guideline for auditing management systems. Where we have designed or implemented controls for a client, we do not mark our own work: someone who was not involved in building those controls audits or reviews them. That keeps the opinion you receive one you can show to a board, a regulator or a customer.
- Integrity
- Fair presentation
- Due professional care
- Confidentiality
- Independence
- Evidence-based approach
- Risk-based approach
Ways to engage
Single audit
One scoped audit, such as a readiness audit before certification or a review of a critical vendor.
Annual audit programme
Outsourced internal audit: we plan and run your yearly programme and report to leadership.
Audit alongside a retainer
Audit coverage combined with ongoing GRC support through a Virtual GRC Officer arrangement.
Common questions
Is this a certification audit?
No. Certification is carried out by an accredited certification body. Our audits meet the internal audit requirement and prepare you for the certification audit.
Do we need internal audits if we are not seeking certification?
If you operate to ISO/IEC 27001, yes, internal audit is part of the standard. Even without it, regulators, boards and customers increasingly expect independent evidence that controls work.
Can you audit controls you helped implement?
Where we have helped design or implement controls, we do not mark our own work. The audit of those controls is carried out or reviewed by someone who was not involved in building them, and we will tell you plainly where an independence issue would arise.
What do we need to provide?
Access to your policies, records and the people who run the controls, plus a named contact to coordinate. We agree the scope and evidence list before fieldwork starts.
Ready to scope an audit?
Tell us your standard, sector and timeline. We will propose a scope and approach.