ISMS Internal Audit Service | ISO27001

If your organisation is planning on certifying its ISMS to ISO 27001, you must be able to present evidence that your organisation has implemented an internal audit programme and that a qualified auditor has completed an internal audit of your management system.

Suppose you don't have an internal audit function within your organisation or need more resources to train an ISMS auditor. In that case, outsourcing your internal audit to a third party is the most effective option to fulfil this ISO 27001 requirement.

The MOD1 ISMS audit service is a first-party, or internal audit, executed by MOD1 on behalf of your organisation. Our ISMS audit service employs systematic, comprehensive tools and techniques for obtaining and evaluating objective evidence to determine and report on the extent to which your ISMS fulfils the ISO 27001 requirements.

Leveraging our expertise and experience speeds up your ISMS implementation process and can significantly increase your chances of passing the third-party certification audit.

If you're ready to learn more, schedule a FREE 30-minute consultation with a MOD1 ISMS audit expert today.

Tailored Approach

No two organisations are the same, which is why we tailor each audit to the size, complexity, risk appetite and budget of each and every client.

Certified Expertise

Our consultants are professionally certified (ISO 27001 Lead Auditor).

Measurable Results

Our structured audit strategy and well-established methodology ensure consistent, repeatable, measurable results.

ISMS Audit Service FAQ

Do you have a question about our ISMS audit service? We're here to help. If you can't find an answer on this page, get in touch via our "Contact" page.

What is an information security management system (ISMS) internal audit?

An ISMS internal audit is a first-party audit carried out by MOD1 on behalf of your organisation. An ISMS internal audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which your ISMS fulfils a set of predefined audit criteria.

Against which criteria do you conduct your ISMS audits?

We adapt our audit criteria to meet the requirements of each organisation. Criteria may include the following:

Requirements defined in the standard (ISO/IEC 27001:2013, ISO/IEC 27001:2022)
Guidance published in the control set (ISO/IEC 27002:2022)
Requirements specified by interested parties that are relevant to the ISMS
Legal and regulatory requirements (EU-GDPR, HIPAA, EU-MDR, FDA)
The ISMS processes and controls defined by the organisation
Information security objectives and risk treatment plans

What is the difference between first, second and third-party audits?

First-party audit

A first-party audit, also known as an internal audit, is where an organisation or consultant hired by the organisation executes an audit on a process or set of operations in the information security management system. First-party audits are an ISO 27001 requirement and can help prepare for certification audits.

Second-party audit

A second party audit, also known as a supplier audit, is where an organisation audits an external supplier, service provider, or interested parties, such as a potential collaborator or research partner.

Third-party audit

A third-party audit, also known as a certification audit, is carried out by independent auditing organisations, such as accredited certification bodies or regulatory authorities, to certify an organisation’s ISMS to ISO 27001 or verify a set of data protection requirements.

Do MOD1 provide third-party audit services to certify ISO standards e.g. 27001, 13485?

No. MOD1 offers a suite of services to support organisations in preparing for ISO certifications such as ISO 27001, ISO 27701 and ISO 13485. Organisations are typically prohibited from providing both consulting services and certification services as it is (quite rightly) perceived as a conflict of interest.