🛡️ Pentest from €539 · Compliance from €89. See All Services →
Optimum Web
ISO 27001CR-ISO-07

Internal Audit Preparation Pack

Everything your internal auditor needs to run the Clause 9.2 audit: audit programme, audit plan, clause-by-clause checklist, organised evidence, and the report templates they will fill in. We prepare the audit. Your auditor runs it.

Quick Answer

Internal Audit Preparation Pack by Optimum Web is a fixed-price compliance service that produces the documentation an organisation needs before its ISO 27001 Clause 9.2 internal audit. It costs €449 with 7–10 business days delivery by senior security engineers. Optimum Web does not perform the internal audit itself. 14-day warranty included.

€449
Fixed price, VAT excluded
7–10 business daysSenior only
Audit programme (Clause 9.2.2) — frequency, methods, responsibilities, planning and reporting requirements
Audit plan — ISMS scope and boundaries, audit criteria, schedule, methods, auditee list
Clause-by-clause checklist — Clauses 4–10 plus every Annex A control applicable under your SoA, with the evidence to look for at each point
Evidence map — requirement → document → owner → location, so nothing is hunted for during the audit
Gap list — where evidence is missing or thin, ranked by how likely each is to become a nonconformity
Report templates — nonconformity form, observation log, internal audit report, management review input (Clause 9.3)
🛡️
14-Day Warranty
If the delivered pack does not match your ISMS scope and Statement of Applicability, we rework it at no cost, or refund in full within 14 days of delivery.

Secured by PayPal · 256-bit SSL encryption

or order without payment
+373 22 843569
PayPal · SSL
👨‍💻 Senior only
14-day warranty
🆔 CR-ISO-07

This Service Covers

ISO 27001Clause 9.2 — preparation for the internal audit

What You Get

A complete, ready-to-use documentation set for your ISO 27001 Clause 9.2 internal audit. We map your Statement of Applicability to a clause-by-clause and control-by-control checklist, collect and organise your existing evidence against each requirement, identify where evidence is missing, and hand you the forms your auditor will use to record findings. The Clause 9.2 internal audit must be carried out by a person independent of the area being audited — that person is someone in your organisation, or an auditor you appoint. Optimum Web prepares the materials — we do not conduct the audit and we do not sign the report. Everything is delivered in editable format so your auditor can work in it directly and so the same pack can be reused for next year's audit cycle.

Optimum Web provides audit preparation, documentation and technical verification. We are not a certification body, we do not employ auditors, and we do not perform internal or certification audits. The Clause 9.2 internal audit is conducted by a person independent of the area audited within your organisation, or by an auditor you appoint; the certification audit is conducted by an accredited certification body. Our role is to make sure you are ready for both.

Who Needs This

  • Companies approaching their first ISO 27001 certification who have an ISMS but no audit documentation
  • Certified companies whose annual internal audit is due and who want the groundwork done before their auditor starts
  • Organisations whose designated internal auditor has never run an ISO 27001 audit and needs a structure to follow
  • Teams who want to know, before the audit, which evidence is missing

How It Works

  1. 1
    SoA Mapping

    Map your Statement of Applicability to a clause-by-clause, control-by-control checklist

  2. 2
    Evidence Collection

    Collect and organise existing evidence against each requirement into the evidence map

  3. 3
    Gap Identification

    Flag missing or thin evidence and rank each gap by nonconformity risk

  4. 4
    Handover

    Deliver the editable audit programme, plan, checklist, evidence map, and report templates to your auditor

NEXT STEP

Want to Know if Your Evidence Holds Up?

The Internal Audit Dry Run (€539) tests your prepared materials against the same checklist an auditor would use, four to six weeks before the audit. Non-certifying — the Clause 9.2 audit stays yours.

Internal Audit Dry Run — €539

Ready to Start?

€449 · 7–10 business days · 14-day warranty

+373 22 843569

Secured by PayPal · 256-bit SSL encryption

or order without payment

Next step: Internal Audit Dry Run — €539

Learn more
Read verified client reviews on Clutch →

Frequently Asked Questions

Do you perform the internal audit?+
No. We produce the materials for it. ISO 27001 Clause 9.2 requires the audit to be conducted by someone independent of the area audited — that is a person in your organisation or an auditor you appoint. We are not auditors and we do not take that role.
Who in our company can be the internal auditor?+
Anyone independent of the area being audited. In a small company this is often a founder, a finance or operations lead, or a developer who was not involved in building the ISMS. Competence matters more than job title, which is why the pack includes a structured checklist rather than a blank template.
Will the certification body accept documentation we prepared with an external provider?+
Certification bodies assess whether the audit was performed correctly and whether it was performed by someone independent — not who typed the checklist. Using external help to prepare is normal and widespread. The audit itself must be yours.
What if we do not have the evidence the checklist asks for?+
That is the point of the gap list. You will know before the audit rather than during it. Closing those gaps can be done by your team or ordered from us as separate services.
Can you also check whether our answers hold up?+
Yes — that is a separate service, Internal Audit Dry Run (CR-ISO-10, €539). It tests your prepared materials against the same checklist an auditor would use.
What do you need from us?+
Your ISMS scope statement, Statement of Applicability, risk assessment and treatment plan, current policies, and a contact who can point us to where evidence lives.

Service page last reviewed 26 August 2026 by the Optimum Web compliance team.

Also Relevant

ISO 27001

ISO 27001 Readiness Assessment

€539 · 7–10 business days
ISO 27001

Internal Audit Dry Run

€539 · 10 business days
ISO 27001

Technical Controls Implementation Package

€639 · 10–14 business days
ISO 27001

Risk Assessment & Treatment Plan

€449 · 7–10 business days
+373 22 843569

Secured by PayPal · 256-bit SSL encryption

or order without payment
📞Call Us💬Get Free Quote