Independent ISO 27001 internal audits, without the consultancy bill.

Our reports follow the structure expected under ISO 27001:2022 — a documented audit plan, sampling methodology, evidence trail, written findings, and a final report — and have been used successfully by SMEs going through stage 1, stage 2, and surveillance audits with their certification bodies. That said, every certification body is different and we cannot guarantee acceptance in every case. We are not responsible if a certification body rejects or requests changes to the report; final acceptance always rests with your auditor.

In principle they can — but ISO 27001:2022 explicitly requires that auditors do not audit their own work. In a small company, the person who manages access controls, the person who wrote your incident response policy, and the person who runs HR onboarding are often the same one or two people. That makes a genuinely independent internal audit nearly impossible without an external auditor. Booking us removes the conflict of interest cleanly.

Most certification bodies don't offer it because of independence rules between certification and consultancy work. Where it is offered as a separate consultancy service, it's typically billed at £900–£1,500 per day across multiple days, which is many times the cost of a dedicated, fixed-fee internal audit service like ours.

Every report goes through a structured two-stage quality review before it reaches your inbox: a first pass against the audit methodology and evidence, and a second pass for findings classification, language, and consistency. Automation handles the parts that should be automated — scheduling, evidence intake, and mapping controls to clauses — so the audit work itself gets the attention it deserves.

After we send your draft report, you have time to address any findings. When you're ready, we'll re-check the closed findings against fresh evidence and update the report — included in the £299. Any further revisits beyond that first one are charged at a flat £150 each.

No problem. You can send your evidence as a zip file during onboarding — policies, records, screenshots, asset registers, the lot. We work the same way from a zip as we do from a portal.

As soon as you've checked out and completed onboarding, we begin work. The 24–72 hour clock for your draft report starts when we have access to your evidence — not when you book.