The report is the evidence that Clause 9.2 was met
A certification body does not take your word that an internal audit happened. It reads the audit plan, the criteria, the sample, the findings, and the closure record. A thin report is itself a nonconformity.
We produce the full record: plan, scope, criteria, method, evidence examined, findings with classification, and a corrective action plan tracked to closure.
What is included
- ✓An audit plan and criteria mapped to Clauses 4 to 10, your Statement of Applicability, and applicable Annex A controls.
- ✓Interviews and evidence sampling, documented artifact by artifact.
- ✓Findings classified as major nonconformity, minor nonconformity, observation, or opportunity for improvement.
- ✓A nonconformity register with root cause and corrective action, tracked to verified closure.
- ✓A management-review-ready summary under Clause 9.3.
One cycle, or a standing function
A single cycle suits a first certification or a gap in your audit calendar. If you need audits at planned intervals across the year with management review support and surveillance prep, that is the Assurance Program.
A certification body reads your internal audit report to find out whether you audit yourself honestly. Answer that question well and Stage 2 gets much shorter.
ISO 27001 audit report, answered
Is one cycle enough for Clause 9.2?
It depends on your scope and risk. Clause 9.2 requires audits at planned intervals covering the whole ISMS over time. Many first-year programs run one full cycle, then move to multiple cycles.
Who closes the nonconformities?
Your team owns the corrective actions. We define what closure requires, then independently verify it.
Do you issue the certificate?
No. An accredited certification body does. We are the independent internal audit function, which is exactly why our report carries weight with them.