Sustain · Internal Audits

Internal Security Audits —
Testing Controls, Not Ticking Boxes.

Your controls look good on paper. But are they actually working? We test control effectiveness, not compliance theatre, surface gaps with evidence, own the remediation roadmap, and stay accountable until every finding is closed. ISO 27001, Essential Eight, or custom scope.

Book a Free 30-Min Call → View all services

ISO + E8

Framework-aligned audits

Gap → Fix

We own the remediation roadmap

24⁺

Years practitioner-led

Sound Familiar?

Your Last Audit Was a Checklist.
Nothing Actually Changed.

Internal audits are supposed to surface real gaps and drive improvement. Here's what gets in the way.

📋

Your last internal audit was a checklist, nothing actually changed

Box-ticking audits create the illusion of assurance. Real audits test whether controls work as designed and follow findings through to verified remediation, not just a list of observations.

🔎

You need to demonstrate control effectiveness to your external auditor

The gap between what leadership believes about their security posture and what auditors actually find is usually material. Internal audits close that gap before it becomes a certification issue.

⚖️

Your team doesn't have the independence to audit their own controls

Internal audits require objectivity. The person who built the control can't independently verify it works, and auditors know the difference between genuine assurance and self-certification.

📅

ISO 27001 requires internal audits, but you don't have the structure in-house

ISO 27001 mandates at least one internal audit per year as part of the ISMS. Most SMBs don't have qualified auditors on staff or the governance structure to run them effectively.

Audit Scope

Four Types of Audit.
One Accountable Partner.

Whether you need ISO 27001 pre-certification assurance, Essential Eight evidence-based testing, or a custom controls review. we scope it, execute it, and own the findings to closure.

ISO 27001

ISMS Internal Audit

Test ISMS controls before certification or surveillance audits. Identify non-conformities and opportunities for improvement with time to remediate, not the week before the auditor arrives. Includes management review support and evidence preparation.

Essential Eight

Maturity Assessment Audit

Evidence-based maturity testing across all 8 ACSC strategies. Goes beyond documentation to test actual control effectiveness. Findings scored against ACSC maturity criteria and prioritised by risk impact.

Custom Scope

Control-Specific Audits

Scoped to your specific risk register, regulatory requirements, or board concerns. Covers access controls, change management, data protection, vendor management, backup and recovery, or any area requiring independent verification.

Pre-Certification

Readiness Review

A structured pre-certification assessment to identify whether you're genuinely ready for external certification. Reduces the risk of costly surprises and certification audit failure. Typically run 6–8 weeks before Stage 1.

How It Works

Scoping to Closure —
Owned End to End.

Four phases from scoping call to verified remediation. We own the engagement, not just the findings report.

Scoping

Agree audit objectives, scope, sampling methodology, and schedule. We set clear expectations before any testing begins.

Fieldwork

Testing controls through document review, interviews, and evidence inspection. We test what works, not just what's documented or assumed by leadership.

Findings Report

Documented non-conformities, observations, and recommendations, prioritised by risk and severity. Written for your external auditor as much as for you.

Remediation Support

We own the gap list and stay accountable until findings are closed. Verified remediation, not just acknowledged issues.

How We Compare

Internal Audit vs External Audit — and Why You Need Both

Internal audits and external certification audits serve different purposes. Understanding the difference — and how they complement each other — is essential for maintaining a defensible security program under ISO 27001.

Different Purpose, Same Goal

External audits (by BSI, SAI Global, LRQA) determine whether you meet certification requirements. Internal audits test whether your controls actually work day-to-day. Both aim for assurance, but internal audits catch problems with time to fix them — external audits report what they find.

ISO 27001 Mandatory Requirement

Internal audits are not optional under ISO 27001 — clause 9.2 mandates them. You must demonstrate that the ISMS is effectively implemented and maintained. Skipping internal audits is itself a non-conformity that external auditors will flag.

Independence Without Conflict

ISO 27001 requires audit independence — the person who built a control cannot assess it. Logic Weave provides the independence your external auditor expects, without the cost of hiring a dedicated internal audit function. Our auditors carry ISO 27001 Lead Auditor certification.

Remediation, Not Just Findings

Most audit providers deliver a findings report and move on. Logic Weave owns the remediation roadmap — tracking corrective actions, verifying fixes, and ensuring non-conformities are closed before your external auditor arrives. The audit isn't done until the gaps are closed.

Complementary to Pentesting

Internal audits test governance — whether policies, processes, and controls are working as designed. Penetration testing tests technical resilience — whether systems can withstand real-world attacks. Both are required under ISO 27001 and Essential Eight, and together they provide complete assurance.

Preparing for Surveillance Audits

After initial certification, surveillance audits happen annually. Logic Weave's internal audit service includes a readiness review the quarter before each external audit — ensuring your evidence is current, your controls are tested, and your team is prepared. No last-minute scrambling.

Common Questions

Internal Security Audit — Frequently Asked Questions

Do we need internal audits if we're not ISO 27001 certified?

Yes. Internal audits surface gaps before regulators or external auditors find them. For uncertified organisations, they're the most cost-effective way to build assurance. For certified ones, they're mandatory under ISO 27001.

How often should internal audits happen?

ISO 27001 requires at least one per year. For most SMBs, annually is appropriate, with a readiness review the quarter before each external audit. High-risk sectors may warrant more frequent audits.

Can a Logic Weave internal audit replace our external certification audit?

No. Internal audits prepare you for external audits, they don't replace them. External certification must be conducted by an accredited body (BSI, SAI Global, LRQA). We help you pass; we don't certify.

What's the difference between an internal audit and a penetration test?

An internal audit tests whether controls, policies, and processes are working, it's a governance activity. A penetration test actively exploits vulnerabilities, it's a technical assurance activity. Both are complementary under ISO 27001 and Essential Eight.

How long does an internal audit take?

A typical ISMS internal audit for an SMB takes 2–4 weeks from scoping to final report, depending on scope and organisation size. A focused control-specific audit or readiness review can be completed in 1–2 weeks. We agree timelines upfront before any work starts.

What evidence do we need to prepare before the audit?

We provide a document request list during scoping — typically including policies, risk registers, access control records, change management logs, incident records, and training evidence. If evidence doesn't exist, that's a finding we'll help you address, not a reason to delay the audit.

Can you audit Essential Eight maturity as well as ISO 27001?

Yes. We conduct evidence-based maturity assessments across all eight ACSC strategies, scored against the latest maturity model criteria. This can be combined with an ISO 27001 internal audit or delivered as a standalone engagement. Both approaches produce evidence suitable for external review.

What qualifications do your auditors hold?

Our auditors hold ISO 27001 Lead Auditor certification, CISM, CRISC, and practitioner-level security certifications (OSCP, CEH). With 24+ years of experience across FinTech, HealthTech, and SaaS, we bring framework depth and industry context — not just a checklist.

Internal Security Audits —Testing Controls, Not Ticking Boxes.

Your Last Audit Was a Checklist.Nothing Actually Changed.

Four Types of Audit.One Accountable Partner.