Internal audit vs external audit
Certification involves two different audits, done by two different parties. We run the first and help you prepare for, choose and get through the second.
| Internal audit | External (certification) audit | |
|---|---|---|
| Who runs it | Cyber Veda, or your own trained staff | An accredited certification body (for SOC 2, a licensed CPA firm) |
| Who engages them | You, as part of your engagement with us | You, directly, under a separate contract |
| Purpose | Find and fix gaps; required by the standard (ISO 27001 Clause 9.2) | Decide whether you meet the standard |
| Outcome | Findings report and corrective action register, for you | The certificate (or SOC 2 report), for your customers |
| When | Before Stage 1, then at least once a year | Stage 1 and Stage 2, then surveillance in years one and two and recertification in year three |
| Our role | We run it | We recommend and introduce auditors we have worked with in your region, then support you through it |
Impartial by design
We assess what’s in evidence, not what was intended. Fieldwork follows ISO 19011:2018: document review, technical verification, evidence sampling and control-owner interviews. Findings are graded against the acceptance criteria your certification auditor will apply.
Your ISMS at a glance, in real time
Every audit lands in a single live view of your conformance across all 11 mandatory clause groups and 93 Annex A controls, colour-coded by status. It’s the same control map an external auditor builds, published as fieldwork ends and updated as gaps close. You can answer “where do we really stand?” on any day of the engagement, not just on report day.
Beyond ISO 27001
We run internal audits the same way for ISO 42001 AI management systems, ISO 27701 privacy management and ISO 9001 quality management: independent of whoever built the system, to ISO 19011:2018, and graded the way your certification body will grade you. If you run several standards together, we audit them as one integrated program.
What's included
- Independent fieldwork by a Lead Auditor
- Full assessment of Clauses 4–10 and all 93 Annex A controls
- Document review, technical verification, evidence sampling and interviews
- Quantified findings: Conforming, Opportunity for Improvement, Minor NC, Major NC, Out of Scope
- Root-cause cross-mapping, with related findings consolidated rather than just listed
- Live bird’s-eye conformance dashboard
- Detailed audit report: executive summary plus per-control findings
- Corrective Action Register with root cause, corrective action and effectiveness-review templates
- Management-review-ready evidence pack (Clause 9.3.2 inputs)
- Formal close-out meeting and handover
When you'd use this
- Pre-certification: close gaps before Stage 1 and Stage 2
- Annual surveillance preparation, to keep certification in good standing
- After an incident or scope change, to re-baseline
- As a Management Review prerequisite (Clause 9.3.2 requires internal audit results as an input)
- M&A or vendor due diligence: independent attestation of how an ISMS actually operates