Internal audit & gap analysis, before the real audit
Measure your control environment against a target framework — and fix what you find in private, before the certification body or regulator arrives.
An internal audit measures your control environment against a target framework before the formal certification audit or regulatory inspection. Passeca runs it using the same criteria the certification body will use — documenting and testing controls, ranking findings, and supporting remediation — so you find and fix gaps in private, with no surprises when the real audit arrives.
What is a cybersecurity internal audit?
A cybersecurity internal audit is an independent, evidence-based assessment of your control environment against a target framework or standard. It confirms that controls are designed correctly and that they actually operate in practice — not just that they are documented. It is the dress rehearsal for the real certification audit or regulatory inspection.
Most frameworks require it explicitly. ISO/IEC 27001 Clause 9.2 mandates an internal audit of the whole ISMS at planned intervals. SOC 2, NIS2, DORA and PCI DSS all presume you have tested your own controls before the external assessor does. A gap analysis is the lighter precursor — a high-level review that identifies where controls fall short, before the deeper testing of a full internal audit.
Who needs an internal audit?
- You are pursuing ISO 27001. Clause 9.2 makes an internal audit mandatory before certification.
- You want to avoid a failed certification. Most failures are found — and fixable — in the internal audit.
- A regulator or customer audit is coming. NIS2, DORA and customer assessments all examine controls closely.
- You have never assessed your controls. A gap analysis is the right first step before a full internal audit.
What does an internal audit actually involve?
An internal audit is a structured, evidence-based exercise. It proceeds from documentation through testing to findings, using the same criteria the certification body or regulator will apply later.
- Criteria agreement — confirm the framework, the in-scope controls and the depth of testing.
- Document review — policies, the risk assessment, the Statement of Applicability, and process documentation.
- Control design review — are the controls designed to meet the criteria?
- Testing — sample-based evidence testing: access reviews, change tickets, incident logs, screening records, training completion, scan reports.
- Findings documentation — each finding ranked by severity, with the evidence that supports it.
- Remediation plan — owners, dates and the corrective action for each finding.
- Re-test — confirmation that the closed findings are genuinely resolved.
The output is an internal audit report used to drive remediation and demonstrate that the internal audit has been completed. Certification auditors may request the report or related records as evidence.
How Passeca runs an internal audit
- 01
Target framework & criteria
We confirm the framework or regulation you are measuring against — ISO 27001, SOC 2, NIS2, DORA, PCI DSS or your own internal standard — and agree the audit criteria and the depth of testing.
- 02
Document & control review
We review your policies, the control design, and the evidence that the controls operate — the same documentation a certification body or regulator will examine later.
- 03
Testing & fieldwork
We test a sample of controls in operation — access reviews, change tickets, incident logs, screening records, training completion — to confirm they work in practice, not just on paper.
- 04
Findings & remediation plan
We document the findings, rank them by severity, and build a prioritised remediation plan with owners and dates — so you close them in private, before any external audit.
- 05
Remediation support & re-test
We support the remediation and re-test the closed findings to confirm they are resolved, leaving you audit-ready for the certification body, regulator or customer.
What you get from the engagement
Gap analysis vs internal audit vs external audit
Three levels of assessment, increasing in depth and independence.
| Gap analysis | Internal audit | External audit | |
|---|---|---|---|
| Control design review | |||
| Operating-effectiveness testing | No | ||
| Formal findings report | Summary | ||
| Independence | Consultant | Consultant | Cert. body |
| Issues a certificate | |||
| Mandatory for ISO 27001 | Clause 9.2 | ||
| Typical depth | Shallow | Deep | Deep |
Most clients sequence all three: a gap analysis early to size the work, an internal audit close to certification to confirm readiness, and the external certification audit last. Passeca runs the first two; an independent certification body runs the third.
Internal audit, answered
The questions buyers ask before commissioning an internal audit.
What is an internal audit in cybersecurity?
What is the difference between a gap analysis and an internal audit?
Is an internal audit mandatory for ISO 27001?
How far in advance of certification should we do the internal audit?
What frameworks can Passeca audit against?
Does the internal audit guarantee we will pass certification?
How long does an internal audit take?
How much does an internal audit cost?
Find your gaps in private, not in the audit
Book a free scoping call. Tell us your target framework and your certification date, and we will scope the internal audit that gets you audit-ready — with a timeline and cost band.
Related