Services / Internal audit
Who checks your ISMS before the certification auditor does?
An independent ISO 27001 internal audit of the ISMS you already run, by a Lead Auditor who did not build it. You see the gaps first, with time to close them.
Know your nonconformities before the auditor writes them.
- You get
- Audit plan and scope, agreed with you before fieldwork
- Interviews and evidence sampling across clauses 4 to 10 and the Annex A controls in scope
- Audit report with nonconformities and observations, each tied to the clause and the evidence
- Closing meeting to walk your team through the findings
- Timeline
- Typically 2 to 3 weeks from kickoff to report. Not guaranteed: it depends on access and interview slots.
- You provide
- A named ISMS owner who answers our questions
- Read access to your compliance platform, documents and evidence
- Interview time with the people who run the controls
- Price
- $5,000. Fixed price. Scope and platform fit are agreed in the proposal before work starts. Prices exclude VAT and other taxes.
What is not included
Not included: certification body fees, software or platform licences, penetration testing, legal advice, and any ongoing managed service after delivery unless we agree it in writing.
No certification guarantee: the certification body decides.
We never act as your implementer and your internal auditor in the same certification cycle. You contract the certification body directly, never through us.
Who does the work
Tristan Roth holds the ISO/IEC 27001:2022 Lead Auditor certificate of competency, awarded by Mastermind Assurance, issued November 2025, valid to November 2028. LinkedIn
Better ISMS is going through its own ISO 27001 certification: Stage 1 on 3 November 2026, Stage 2 on 16 and 17 November 2026. Not certified today. Status and evidence
Questions
- Can you do the implementation and the internal audit?
- Not in the same certification cycle. An internal auditor has to be independent of the work being audited, so if we implement your ISMS, someone else does your internal audit. If we audit you, we did not build it.
- Which compliance platforms do you work on?
- Most compliance platforms, including Drata and Vanta. We check that yours fits when we write the proposal. We need an account with enough access to edit controls, policies and evidence.
- Remote or on-site?
- Remote by default, in English. On-site days are possible when we agree them in the proposal.
- What currency do you invoice in?
- US dollars. Better ISMS EURL, a French company, invoices you. Prices exclude VAT and other taxes, and payment terms are set in the proposal.
- How is this related to ISMS Copilot?
- Better ISMS makes ISMS Copilot, the AI assistant for ISO 27001 and GRC work. We use our own tools to do the drafting and checking faster; a person decides and signs off. You do not need an ISMS Copilot plan to hire us.
Tell us which offer, your company, and the audit date you are aiming for. Every message gets an answer.
We take one engagement at a time.