Free readiness assessment
Are you ready for your ISO internal audit?
Take our free 5-minute ISO 27001 / ISO/IEC 42001 Internal Audit Readiness Assessment and identify potential audit gaps before your next certification or surveillance audit.
No credit card required. Get your readiness score immediately.
What the assessment covers
Twelve weighted questions mapped to the management system requirements auditors actually test: scope, risk assessment and treatment, documented information, evidence that controls operated, the internal audit program, corrective action, and management review.
- Takes about 5 minutes
- Readiness score out of 100
- Your weakest areas, ranked
- No credit card, no obligation
Informational readiness assessment only. This is not an ISO certification audit and does not determine certification status.
ISO 27001 and ISO/IEC 42001 internal audit readiness, explained
Both ISO 27001 and ISO/IEC 42001 require internal audits at planned intervals. In practice, most findings at a certification or surveillance audit are not surprises: they come from scope statements that no longer match the business, risk assessments that were never refreshed, evidence that only covers part of the period, and corrective actions that were opened and never verified. An audit readiness check catches those before the external auditor does.
What an ISO 27001 internal audit checklist should cover
- ISMS scope, interested parties, and interfaces
- Risk assessment methodology, criteria, and current results
- Risk treatment plan and residual risk acceptance
- Statement of Applicability with justifications
- Security objectives and how they are measured
- Documented information and version control
- Operational controls and evidence they operated across the period
- Internal audit program, findings, corrective actions, and management review
What an ISO 42001 internal audit checklist should cover
- AIMS scope and the AI systems inside it
- AI policy, governance roles, and decision authority
- AI risk assessment and AI system impact assessments
- AI system inventory, including third-party models
- AI lifecycle processes and data provenance requirements
- Monitoring, measurement, and production oversight
- Internal audit, corrective action, management review, continual improvement
Common questions
- What is an ISO 27001 internal audit?
- An ISO 27001 internal audit is a planned, independent review of your information security management system against the requirements of the standard and your own documented processes. ISO 27001 requires internal audits at planned intervals, and certification auditors will ask to see the program, the reports, and the corrective actions that followed.
- What is an ISO/IEC 42001 internal audit?
- ISO/IEC 42001 is the AI management system standard. An internal audit reviews your AIMS scope, AI policy, AI risk and impact assessments, AI system inventory, lifecycle controls, and monitoring against the standard, and confirms that evidence exists for the period under review.
- Is this readiness assessment a certification audit?
- No. This is an informational self-assessment intended to highlight areas worth reviewing before your internal or external audit. It is not an ISO certification audit and does not determine certification status.
- How long does the assessment take?
- About five minutes. It is 12 questions, weighted, with a readiness score and a short list of areas to review at the end.
Read more on our services, audit experience, and the resources.