Who it is for
A proportionate engagement with clear boundaries.
Organisations that need an objective first-party audit covering clauses 4–10 and the applicable Annex A controls in their Statement of Applicability.
Independent assurance
ISO/IEC 27001 internal audit
A risk-based, evidence-led assessment of your ISMS before certification or as part of your audit programme.
How we assess your ISMSCheck what happens. Explain the result.
AgreeConfirm the scope and requirements to check
ReviewUnderstand your processes and supporting records
SelectChoose records and activities based on risk
TestCheck whether controls work in practice
ReportExplain what works and where requirements are not met
What is included
- Scope and criteria confirmation
- Audit plan and evidence request
- Document review and interviews
- Risk-based sampling and control testing
- Finding validation and closing meeting
- Independent quality review and final report
Typical outputs
- Approved audit plan
- Traceable workpapers
- Findings register
- Detailed internal-audit report
What we need from you
- ISMS scope and Statement of Applicability
- Risk assessment and treatment plan
- Policies, procedures and operating evidence
- Stakeholder availability
Timing
Typically 3–8 audit days, depending on scope, evidence volume, locations and complexity.
Pricing basis
Quoted from a bottom-up effort estimate after scoping. Hourly, daily or fixed-fee structures may be used.
Important exclusions
- Certification or certification decisions
- Implementing corrective actions
- Auditing work that would compromise independence
- Legal or regulatory opinions
Sample engagement outline
From confirmed scope to controlled release.
This sequence is tailored to the audit objectives, risk and available evidence; it does not imply identical testing across every applicable control.
- Scope and planConfirm criteria, boundaries, objectives, stakeholders, dates and independence.
- Review documentsAssess core ISMS documentation, prior results and the evidence index.
- Interview and testWalk through processes and select risk-based samples for testing.
- Develop findingsConnect each potential gap to the relevant criterion and objective evidence.
- Validate factsResolve factual inaccuracies without transferring audit judgement.
- Release outputsComplete quality review, closing briefing, findings register and final report.
Internal-audit answers
What a certification-readiness buyer needs to know.
What receives coverage?
For a full-scope engagement, clauses 4–10 and all applicable Annex A controls are considered. Audit depth varies by risk, scope and available evidence; this does not mean every control receives identical testing.
How are samples selected?
Samples are selected using documented, risk-based rationale. One process test may support conclusions across related controls where the evidence genuinely does so.
How are findings classified?
The agreed methodology normally distinguishes minor nonconformities and opportunities for improvement. Any optional major classification is confirmed before fieldwork.
Who owns corrective action?
The audited organisation owns root-cause analysis, correction, corrective action and implementation. Verification is separately scoped and never designed by the closure auditor.
How is evidence handled?
Access is limited to authorised client-owned or agreed restricted channels. Retention, deletion and access expectations are confirmed for the engagement; passwords and confidential evidence are not accepted through the website.
Does the report guarantee certification?
No. Review arrangements, report timing and factual-review rounds are confirmed in the proposal, and the certification body makes its own decision.
Frequently asked questions
Does this service result in certification?
No. Mang Morgan does not issue ISO/IEC 27001 or ISO/IEC 27701 certificates or guarantee a certification outcome. A certification decision remains outside this engagement.
How is the scope confirmed?
We confirm the intended outcome, management-system boundary, criteria, locations, processing context, evidence, stakeholders, dates and limitations before issuing the final proposal.
Can the work use a client platform?
We can work in authorised client-owned GRC or privacy-management platforms where appropriate. Platform status helps organise evidence but does not replace testing or professional judgement, and platform experience does not imply partnership.
What happens if the scope changes?
Additional sites, products, processing activities, jurisdictions, frameworks, interviews, revisions, travel, remediation or accelerated dates are assessed through agreed change control.
Start with a defined scope
A clear plan. An agreed fee.
Tell us your objectives and timing. Your proposal will set out the work, deliverables and responsibilities.