ISO/IEC 27001 internal audit
- Purpose
- Reach objective conclusions against agreed criteria.
- Independence
- Independent assurance required.
- Assessment depth
- Risk-based evidence review, interviews and sampling.
- Main output
- Audit report, workpapers and findings register.
- Typical stage
- Operating management system.
- Pricing method
- Bottom-up fixed-fee, daily or hourly estimate.