{"id":769,"date":"2026-08-16T18:55:07","date_gmt":"2026-08-16T18:55:07","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=769"},"modified":"2026-08-16T18:55:07","modified_gmt":"2026-08-16T18:55:07","slug":"iso-27001-internal-audit-2","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/iso-27001-internal-audit-2\/","title":{"rendered":"ISO 27001 Internal Audit: A Startup&#8217;s Guide"},"content":{"rendered":"\n<meta charset=\"UTF-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<title>ISO 27001 Internal Audit: A Startup&#8217;s Guide | Osto<\/title>\n<meta name=\"description\" content=\"ISO 27001 internal audit explained for startups: why it is mandatory, who can run it, the five-step cycle, what auditors expect, and common mistakes to avoid.\">\n<style>\n  :root{\n    --ink:#0e1330;\n    --brand:#1c267a;\n    --brand-2:#3a46c0;\n    --accent:#00c2a8;\n    --accent-soft:#e6f7f4;\n    --paper:#ffffff;\n    --mist:#f4f6fb;\n    --line:#e3e7f2;\n    --muted:#5a6284;\n    --danger:#e2564d;\n    --radius:16px;\n    --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n    --maxw:860px;\n  }\n  *{box-sizing:border-box}\n  html{scroll-behavior:smooth}\n  body{\n    margin:0;\n    font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n    color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n  }\n  a{color:var(--brand-2);text-decoration:none}\n  a:hover{text-decoration:underline}\n\n  .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n  .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n  .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n  .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n  .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n  .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n  .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n  .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n  .breadcrumb a{color:var(--muted)}\n  .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n  h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n  .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n  .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n  .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n  .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n  .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n  .tldr p{margin:0 0 10px;font-size:16.5px}\n  .tldr p:last-child{margin:0}\n\n  h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n  h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n  p{margin:0 0 16px;font-size:16.5px}\n  .lead-in{color:var(--muted)}\n  em{font-style:italic}\n\n  .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n  .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n  .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n  .jump li{margin:6px 0;font-size:15px}\n  @media(max-width:560px){.jump ol{columns:1}}\n\n  .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n  .analogy strong{color:var(--brand)}\n\n  ul.clean{padding-left:0;list-style:none;margin:16px 0}\n  ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n  ul.clean li:last-child{border-bottom:none}\n  ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n  ul.warn li::before{background:var(--danger)}\n\n  \/* TSC cards *\/\n  .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n  .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n  .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n  .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n  .tsc-card.req .tag{color:var(--brand)}\n  .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n  .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n  @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n  @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n  \/* stat band *\/\n  .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n  .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n  .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n  .fig-head .src{font-size:11.5px;color:#b9c0f0}\n  .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n  .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n  .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n  .stat-cell:last-child{border-right:none}\n  .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n  .stat-cell .num.accent{color:var(--accent)}\n  .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n  @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n  \/* timeline *\/\n  .timeline{padding:8px 24px 4px}\n  .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n  .tl-item:last-child{border-bottom:none}\n  .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n  .tl-what{font-size:14.5px}\n  .tl-what b{display:block;margin-bottom:2px}\n  @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n  .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n  table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n  thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n  thead th.osto{background:var(--brand);color:#fff}\n  tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n  tbody tr:last-child td{border-bottom:none}\n  tbody td:first-child{font-weight:600;color:var(--ink)}\n  td.osto{background:#f6f8ff;font-weight:600}\n  .yes{color:var(--accent);font-weight:700}\n  .no{color:var(--danger);font-weight:700}\n\n  .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n  .callout h3{margin:0 0 8px;color:#fff}\n  .callout p{color:#cfd4f5;margin:0 0 18px}\n  .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n  .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n  .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n  .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n  details{border-bottom:1px solid var(--line);padding:6px 0}\n  summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n  summary::-webkit-details-marker{display:none}\n  summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n  details[open] summary::after{content:\"\u2013\"}\n  details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n  footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n  .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n  .foot-inner .logo{font-size:17px}\n\n  .related{margin:42px 0 0}\n  .related h3{margin-bottom:14px}\n  .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n  .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n  .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n  .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n  @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n  \/* --- bright, clean additions --- *\/\n  .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n  .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n  .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n  .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n  .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n  .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n  .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n  @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n  .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n  .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n  .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n  .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n  .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n  .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n  .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n  .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n  @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n  .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n  .keyrow>div{padding:20px 22px}\n  .keyrow .k1{background:#eef0ff}\n  .keyrow .k2{background:var(--accent-soft)}\n  .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n  .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n  .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n  .keyrow .sm{font-size:13.5px;color:var(--muted)}\n  @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n  .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n  .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n  .flow .step .t{font-weight:800;font-size:14px}\n  .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n  .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n  .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n  .bbox strong{color:var(--brand)}\n  .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n  .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n  .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n  .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n  .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n  .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n  .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n  .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n  .checkarea ul{margin:0;padding:0;list-style:none}\n  .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n  .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n  @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n  .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n  .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n  .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n  .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n  .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n  .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n  @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n  .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n  .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n  .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n  .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n\n\n<div class=\"wrap\">\n  <p class=\"dek\">ISO 27001 internal audit, a startup&#8217;s guide: the mandatory self-check that catches problems before the certification body does, and how to run it without a big team.<\/p>\n\n  <div class=\"meta\">\n    <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>8 min read<\/span><span class=\"dot\"><\/span><span>Compliance &amp; Trust<\/span>\n  <\/div>\n\n  <div class=\"tldr\">\n    <h2>TL;DR<\/h2>\n    <p>An internal audit is a mandatory ISO 27001 requirement under Clause 9. It is your own review of whether the ISMS actually works, run before the external certification body arrives, so you can fix problems on your own terms.<\/p>\n    <p>It must be objective: the person auditing a process should not be the one who runs it. For a startup that can mean a different team member or an external assessor. Findings feed a management review and corrective action.<\/p>\n  <\/div>\n\n  <div class=\"jump\">\n    <h4>On this page<\/h4>\n    <ol>\n      <li><a href=\"#what\">What it is and why it is required<\/a><\/li>\n      <li><a href=\"#who\">Who can run it<\/a><\/li>\n      <li><a href=\"#cycle\">The five-step cycle<\/a><\/li>\n      <li><a href=\"#expect\">What auditors expect<\/a><\/li>\n      <li><a href=\"#mistakes\">Mistakes to avoid<\/a><\/li>\n      <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n    <\/ol>\n  <\/div>\n\n  <h2 class=\"sec\" id=\"what\">ISO 27001 internal audit: what it is and why it is required<\/h2>\n  <p>An internal audit is your organisation&#8217;s own assessment of whether the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/isms\/\">ISMS<\/a> is working as intended, conducted before the external audit. ISO 27001 makes it mandatory under Clause 9, because the standard treats self-checking as a core part of a living management system. Done well, it is the dress rehearsal that turns the certification audit into a formality.<\/p>\n\n  <div class=\"bbox teal\"><div class=\"bt\">The purpose<\/div>The internal audit exists so that you, not the certification body, are the first to find the gaps. Every finding you catch and fix beforehand is one that will not become a certification obstacle.<\/div>\n\n  <h2 class=\"sec\" id=\"who\">Who can run an internal audit<\/h2>\n  <p>The one firm rule is objectivity: the person auditing a process must not be the person responsible for running it. Beyond that, ISO 27001 does not require a certified professional. For a lean team, there are two practical options.<\/p>\n\n  <div class=\"keyrow\">\n    <div class=\"k1\"><div class=\"lab\">Internal, but independent<\/div><div class=\"sm\" style=\"margin-top:4px\">A team member who does not own the area being audited. Workable in a startup, as long as the separation is genuine and documented.<\/div><\/div>\n    <div class=\"k2\"><div class=\"lab\">External assessor<\/div><div class=\"sm\" style=\"margin-top:4px\">An independent consultant runs the internal audit for you. Common when the team is too small to provide real objectivity in-house.<\/div><\/div>\n  <\/div>\n\n  <h2 class=\"sec\" id=\"cycle\">The five-step cycle<\/h2>\n  <p>A sound internal audit follows a clear sequence, and it is repeatable each year.<\/p>\n\n  <div style=\"background:linear-gradient(180deg,#fbfcff,#f4f6ff);border:1px solid #e3e6f5;border-radius:18px;padding:30px 32px;margin:28px 0;box-shadow:0 8px 30px rgba(28,38,122,.07)\">\n  <div style=\"font-size:11.5px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;color:#3a46c0;margin-bottom:6px\">The internal audit cycle<\/div>\n  <div style=\"font-size:19px;font-weight:800;color:#0e1330;margin-bottom:6px\">Catch problems before the certification body does<\/div>\n  <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">A repeatable five-step loop you run at least once a year.<\/div>\n  <svg viewBox=\"-24 0 724 250\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"ISO 27001 internal audit cycle: plan, test controls, log findings, fix root cause, management review\">\n    <defs>\n      <marker id=\"iaA\" markerWidth=\"12\" markerHeight=\"12\" refX=\"7\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L8 4 L0 8 Z\" fill=\"#c2c7e0\"><\/path><\/marker>\n      <linearGradient id=\"iaTeal\" x1=\"0\" y1=\"0\" x2=\"0\" y2=\"1\"><stop offset=\"0\" stop-color=\"#12d3b6\"><\/stop><stop offset=\"1\" stop-color=\"#00c2a8\"><\/stop><\/linearGradient>\n      <linearGradient id=\"iaInd\" x1=\"0\" y1=\"0\" x2=\"0\" y2=\"1\"><stop offset=\"0\" stop-color=\"#4a57d4\"><\/stop><stop offset=\"1\" stop-color=\"#3a46c0\"><\/stop><\/linearGradient>\n      <linearGradient id=\"iaVio\" x1=\"0\" y1=\"0\" x2=\"0\" y2=\"1\"><stop offset=\"0\" stop-color=\"#a8a3ff\"><\/stop><stop offset=\"1\" stop-color=\"#9d97ff\"><\/stop><\/linearGradient>\n      <linearGradient id=\"iaNavy\" x1=\"0\" y1=\"0\" x2=\"0\" y2=\"1\"><stop offset=\"0\" stop-color=\"#26317f\"><\/stop><stop offset=\"1\" stop-color=\"#1c267a\"><\/stop><\/linearGradient>\n    <\/defs>\n    <g font-family=\"Inter,Arial,sans-serif\">\n      <!-- top row: 1 2 3 -->\n      <!-- card template: rounded rect w\/ number chip + title + subtitle -->\n      <g>\n        <rect x=\"20\" y=\"24\" width=\"196\" height=\"82\" rx=\"16\" fill=\"#fff\" stroke=\"#e3e6f5\" stroke-width=\"1.5\"><\/rect>\n        <circle cx=\"54\" cy=\"58\" r=\"20\" fill=\"url(#iaTeal)\"><\/circle><text x=\"54\" y=\"65\" text-anchor=\"middle\" font-size=\"18\" font-weight=\"800\" fill=\"#fff\">1<\/text>\n        <text x=\"84\" y=\"55\" font-size=\"15\" font-weight=\"800\" fill=\"#0e1330\">Plan<\/text>\n        <text x=\"84\" y=\"76\" font-size=\"11.5\" fill=\"#5b6178\">scope what to review<\/text>\n      <\/g>\n      <g>\n        <rect x=\"252\" y=\"24\" width=\"196\" height=\"82\" rx=\"16\" fill=\"#fff\" stroke=\"#e3e6f5\" stroke-width=\"1.5\"><\/rect>\n        <circle cx=\"286\" cy=\"58\" r=\"20\" fill=\"url(#iaInd)\"><\/circle><text x=\"286\" y=\"65\" text-anchor=\"middle\" font-size=\"18\" font-weight=\"800\" fill=\"#fff\">2<\/text>\n        <text x=\"316\" y=\"55\" font-size=\"15\" font-weight=\"800\" fill=\"#0e1330\">Test controls<\/text>\n        <text x=\"316\" y=\"76\" font-size=\"11.5\" fill=\"#5b6178\">check they operate<\/text>\n      <\/g>\n      <g>\n        <rect x=\"484\" y=\"24\" width=\"196\" height=\"82\" rx=\"16\" fill=\"#fff\" stroke=\"#e3e6f5\" stroke-width=\"1.5\"><\/rect>\n        <circle cx=\"518\" cy=\"58\" r=\"20\" fill=\"url(#iaVio)\"><\/circle><text x=\"518\" y=\"65\" text-anchor=\"middle\" font-size=\"18\" font-weight=\"800\" fill=\"#1a1a4a\">3<\/text>\n        <text x=\"548\" y=\"55\" font-size=\"15\" font-weight=\"800\" fill=\"#0e1330\">Log findings<\/text>\n        <text x=\"548\" y=\"76\" font-size=\"11.5\" fill=\"#5b6178\">record gaps + evidence<\/text>\n      <\/g>\n\n      <!-- arrows across top -->\n      <line x1=\"216\" y1=\"65\" x2=\"248\" y2=\"65\" stroke=\"#c2c7e0\" stroke-width=\"2.5\" marker-end=\"url(#iaA)\"><\/line>\n      <line x1=\"448\" y1=\"65\" x2=\"480\" y2=\"65\" stroke=\"#c2c7e0\" stroke-width=\"2.5\" marker-end=\"url(#iaA)\"><\/line>\n\n      <!-- down connector from card 3 to card 4 -->\n      <path d=\"M582 106 L582 132 L384 132 L384 158\" fill=\"none\" stroke=\"#c2c7e0\" stroke-width=\"2.5\" marker-end=\"url(#iaA)\"><\/path>\n\n      <!-- bottom row: 5 <- 4 (centered) -->\n      <g>\n        <rect x=\"252\" y=\"160\" width=\"196\" height=\"82\" rx=\"16\" fill=\"#fff\" stroke=\"#e3e6f5\" stroke-width=\"1.5\"><\/rect>\n        <circle cx=\"286\" cy=\"194\" r=\"20\" fill=\"url(#iaInd)\"><\/circle><text x=\"286\" y=\"201\" text-anchor=\"middle\" font-size=\"18\" font-weight=\"800\" fill=\"#fff\">4<\/text>\n        <text x=\"316\" y=\"191\" font-size=\"15\" font-weight=\"800\" fill=\"#0e1330\">Fix root cause<\/text>\n        <text x=\"316\" y=\"212\" font-size=\"11.5\" fill=\"#5b6178\">corrective action<\/text>\n      <\/g>\n      <g>\n        <rect x=\"20\" y=\"160\" width=\"196\" height=\"82\" rx=\"16\" fill=\"url(#iaNavy)\"><\/rect>\n        <circle cx=\"54\" cy=\"194\" r=\"20\" fill=\"url(#iaTeal)\"><\/circle><text x=\"54\" y=\"201\" text-anchor=\"middle\" font-size=\"18\" font-weight=\"800\" fill=\"#04261b\">5<\/text>\n        <text x=\"84\" y=\"191\" font-size=\"15\" font-weight=\"800\" fill=\"#fff\">Management<\/text>\n        <text x=\"84\" y=\"212\" font-size=\"11.5\" fill=\"#c6ccf0\">leadership review<\/text>\n      <\/g>\n\n      <!-- arrow 4 -> 5 -->\n      <line x1=\"252\" y1=\"201\" x2=\"220\" y2=\"201\" stroke=\"#c2c7e0\" stroke-width=\"2.5\" marker-end=\"url(#iaA)\"><\/line>\n\n      <!-- loop-back dashed arrow from 5 up to 1 -->\n      \n      \n    <path d=\"M20 190 C-8 190 -8 69 20 69\" fill=\"none\" stroke=\"#9d97ff\" stroke-width=\"2\" stroke-dasharray=\"5 5\" marker-end=\"url(#iaA)\"><\/path><text x=\"-2\" y=\"133\" font-size=\"10\" font-weight=\"700\" fill=\"#9d97ff\" transform=\"rotate(-90 -2 133)\" text-anchor=\"middle\">repeat yearly<\/text>\n    <\/g>\n  <\/svg>\n<\/div>\n\n  <h2 class=\"sec\" id=\"expect\">What auditors expect to see<\/h2>\n  <p>When the certification body arrives, they will check that your internal audit was real and acted upon. They look for these.<\/p>\n\n  <ul class=\"clean\">\n    <li><strong>An audit plan and scope.<\/strong> Evidence you planned what to review, not just glanced over things.<\/li>\n    <li><strong>Documented findings.<\/strong> A record of what passed, what did not, and the evidence behind each.<\/li>\n    <li><strong>Corrective action.<\/strong> Proof that findings led to fixes at the root cause, not quick patches.<\/li>\n    <li><strong>A management review.<\/strong> Evidence leadership saw the results and made decisions on them.<\/li>\n  <\/ul>\n\n  <h2 class=\"sec\" id=\"mistakes\">Mistakes to avoid<\/h2>\n  <ul class=\"clean warn\">\n    <li><strong>Auditing your own work.<\/strong> It breaks the objectivity requirement and auditors will flag it.<\/li>\n    <li><strong>Treating it as a formality.<\/strong> A rubber-stamp internal audit that finds nothing looks less credible, not more.<\/li>\n    <li><strong>Not closing findings.<\/strong> An open finding with no corrective action is worse than none at all.<\/li>\n    <li><strong>Skipping the management review.<\/strong> Clause 9 expects leadership to engage with the results.<\/li>\n  <\/ul>\n\n  <h2 class=\"sec\" id=\"osto\">The lean-team path to a smooth internal audit<\/h2>\n  <p>Much of an internal audit is checking whether controls are operating and whether there is evidence to prove it. That is slow and painful when the answer lives across scattered tools and you have to chase each one down before you can even assess it.<\/p>\n\n  <div class=\"bbox indigo\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. Because the controls run on one platform and the evidence is collected from the same modules, an internal audit becomes a matter of reviewing what is already visible in one place, rather than assembling proof from a dozen sources. That is why lean teams treat Osto as the default foundation for an internal audit that goes smoothly.<\/div>\n\n  <div class=\"callout\">\n    <h3>Make your internal audit a review, not a scramble.<\/h3>\n    <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Keep controls and their evidence in one place, so your internal audit confirms what is already there. No security team required.<\/p>\n    <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo \u2192<\/span><\/a><\/p>\n  <\/div>\n\n  <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n  <details><summary>Is an internal audit mandatory for ISO 27001?<\/summary><p>Yes. Clause 9 of ISO 27001 requires internal audits of the ISMS at planned intervals. They are a core part of the standard&#8217;s management-system requirements, and the certification body will check that you conducted and acted on them.<\/p><\/details>\n  <details><summary>Who can perform an ISO 27001 internal audit?<\/summary><p>Anyone objective enough that they are not auditing their own work. It does not require a certified professional. A startup can use an independent team member or bring in an external consultant to provide the necessary objectivity.<\/p><\/details>\n  <details><summary>What is the difference between an internal audit and the certification audit?<\/summary><p>The internal audit is your own self-assessment, run before certification, to catch and fix gaps. The certification audit is conducted by an external accredited body and determines whether you earn the certificate.<\/p><\/details>\n  <details><summary>How often should internal audits happen?<\/summary><p>At planned intervals, typically at least annually, and covering the whole ISMS over time. Many organisations audit different parts across the year so the full system is reviewed within each certification cycle.<\/p><\/details>\n  <details><summary>What happens to internal audit findings?<\/summary><p>They are documented, addressed through corrective action that fixes the root cause, and reported to leadership in a management review. The certification body looks for evidence that findings were genuinely closed, not just recorded.<\/p><\/details>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>ISO 27001 Internal Audit: A Startup&#8217;s Guide | Osto ISO 27001 internal audit, a startup&#8217;s guide: the mandatory self-check that\u2026<\/p>\n","protected":false},"author":8,"featured_media":770,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[293],"class_list":["post-769","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-iso-27001-internal-audit"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/769","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=769"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/769\/revisions"}],"predecessor-version":[{"id":771,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/769\/revisions\/771"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/770"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=769"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=769"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=769"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}