Service
Internal Audit & Evidence
Check your controls really work, and keep the evidence that proves it.
Internal audit is how you test your own controls between external assessments. We check that what your policies claim is actually happening, gather the evidence that proves it and flag what is drifting before it becomes a finding.
A reliable evidence process is often the difference between a smooth external audit and a scramble. We help you set one up so evidence is collected as you go rather than reconstructed under pressure.
What we test
Control operation
We sample live evidence to confirm each control is running as your documentation describes, not just that it exists on paper.
Evidence pipeline
We check that proof of each control is being captured as work happens and stored where it can be found again.
Requirement mapping
We trace every control and its evidence back to the specific clause or criterion it is meant to satisfy, so nothing is left unmapped.
Control drift
We look for places where practice has quietly moved away from policy since the last assessment and flag them before they become findings.
Corrective action tracking
We record each gap with a prioritised owner and remediation step, then confirm it closes before the external audit.
Audit readiness
We assemble the evidence into an organised pack and walk your team through how the external assessor is likely to read it.
Standards we work to
What's included
- Internal audits against SOC 2, ISO 27001 or your target framework
- Testing that controls operate as your policies describe
- A repeatable evidence collection process mapped to requirements
- An organised, audit-ready evidence pack
- Findings with clear, prioritised corrective actions
- Preparation for the next external assessment
What you walk away with
- Confidence that your controls work in practice, not just on paper
- An organised evidence pack ready for the next external audit
- Problems found and fixed on your terms rather than the auditor's
How it runs
Plan
We agree which controls to audit and against which framework, and set a schedule that fits your assessment cycle.
Test
We check that controls operate as described, sampling evidence rather than taking policies at face value.
Evidence
We set up a repeatable process so evidence is collected as work happens and maps cleanly to each requirement.
Correct
We hand back findings with prioritised corrective actions, so gaps are closed before an external auditor sees them.
How we approach it
An internal audit is most useful when evidence is gathered as work happens rather than rebuilt from memory the week the auditor arrives.
| Evidence collected as you go | Reconstructed before the audit | |
|---|---|---|
| Timing | Captured continuously while controls run | Assembled in a rush before the assessment |
| Accuracy | Reflects what actually happened on the day | Relies on recollection and back-filled records |
| Gaps | Surfaced early while there is time to fix them | Discovered by the external auditor as findings |
| Team load | Spread across the cycle as routine work | Concentrated into a stressful scramble |
What this supports
Internal audit and a reliable evidence process feed directly into the frameworks you are working towards or already hold.
- SOC 2
- Tests that controls operate against the Trust Services Criteria and builds the evidence an auditor samples over the observation period.
- ISO 27001
- Delivers the internal audit that Clause 9.2 of the management system expects, with evidence mapped to the Annex A controls in your statement of applicability.
- PCI DSS
- Checks that required controls are operating and keeps the supporting evidence organised ahead of your assessment.
- HIPAA
- Reviews whether safeguards are working in practice and keeps evidence of them ready should they need to be demonstrated.
FAQ
- Is an internal audit required?
- Frameworks such as ISO 27001 expect internal audits as part of the management system. Even where they are optional, they are the cheapest way to catch problems before an external assessment.
- Does this replace the external audit?
- No. It prepares for it. The external audit is still carried out by an independent body, but internal audit means you walk in already knowing what they will find.
- Can you help with evidence collection ongoing?
- Yes. We can set up the process and, if you prefer, run it for you as part of a managed compliance arrangement.
Related services
Related reading
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read
SOC 2 vs ISO 27001: an honest comparison to help you choose
A plain-English guide to the real differences between SOC 2 and ISO 27001: what each one is, who asks for which, how the audits work, what you end up holding, and whether you should do both.
8 min read