Agree
Confirm the objective, authority, systems, criteria, access and exclusions. Establish how information will be shared and handled.
Internal audit / New Zealand
ISO 27001 internal audit
Aegentra conducts scoped ISO 27001 internal audits for New Zealand organisations. We evaluate the agreed management-system criteria and evidence, including scope, risk treatment and operating controls, and report findings and follow-up needs.
On this page
Start with the boundary
Define the work that is needed.
For organisations preparing or maintaining a ISMS, fulfilling an internal-audit programme or needing an objective review of information security evidence.
- Audit objectives, ISMS boundary and the applicable standard edition
- Auditor competence, conflicts and impartiality checks
- Risk-based sampling of scope, risk treatment and operating controls
- Findings, conclusions and agreed corrective-action follow-up
Keep the responsibilities distinct
An internal audit is not a certification audit or a guarantee of certification. Auditor assignments require impartiality checks; we do not present review of our own implementation work as independent assurance.
What the engagement can produce
Useful outputs, agreed in advance.
- An agreed audit plan and evidence request
- Recorded findings tied to criteria and sampled evidence
- An audit report with scope and limitations
- A follow-up plan; remediation work separately agreed
Service pricing is provided by scoped quote, not the Academy’s per-learner course prices. The proposal identifies deliverables, assumptions, exclusions, responsibilities and commercial terms. No fixed price or completion date is promised before the scope is understood.
How we work
From evidence to a practical next step.
Examine
Gather the records and context required by the scope. Distinguish what evidence supports from what is still uncertain.
Act or report
Carry out the agreed consulting, audit, assessment or implementation task. Obtain approval before operational changes.
Verify and hand over
Document outcomes, limitations, owners and follow-up. Retesting or ongoing work is included only when expressly scoped.
We deliver online and arrange visits by appointment where agreed. Scope, assigned competence, timing, access requirements and any travel are confirmed before an engagement.
An illustrative starting point
What a useful first decision looks like.
Fictional example to explain the service, not a New Zealand client case study or a promised outcome.
An ISMS risk treatment is marked complete, but the selected records do not show that the control operated. The audit distinguishes documented intent from evidence and reports the resulting gap.
Questions for the first discussion
- Which ISMS activities, sites and period should the audit cover?
- What implementation work has already been performed, and by whom?
- Which prior findings or changes should inform the audit plan?
Before you begin
Your questions, answered.
Can the person who implemented the ISMS independently audit it?
Auditor objectivity and impartiality must be protected. Before accepting an internal-audit scope, we check responsibilities and potential conflicts. Implementation and audit assignments cannot simply be treated as interchangeable; another suitably competent and impartial resource may be needed.
What can be included in iso 27001 internal audit?
The agreed scope can include audit objectives, ISMS boundary and the applicable standard edition; auditor competence, conflicts and impartiality checks; risk-based sampling of scope, risk treatment and operating controls; findings, conclusions and agreed corrective-action follow-up. We confirm the exact deliverables and exclusions before work begins, rather than treating every organisation as the same project.
How much does this service cost?
Service pricing is provided by scoped quote, not the Academy’s per-learner course prices. The proposal identifies deliverables, assumptions, exclusions, responsibilities and commercial terms. No fixed price or completion date is promised before the scope is understood.
How do you deliver the work in New Zealand?
We deliver online and arrange visits by appointment where agreed. Scope, assigned competence, timing, access requirements and any travel are confirmed before an engagement.
What should we provide before a proposal?
Bring answers to these starting questions: Which ISMS activities, sites and period should the audit cover? What implementation work has already been performed, and by whom? Which prior findings or changes should inform the audit plan? A short initial discussion should establish the boundary and next evidence needed. Do not email secrets or detailed personal records before secure handling has been agreed.
Reference points
Check the underlying guidance.
Page prepared and source references checked . References explain the relevant standard or technology; they are not endorsements of Aegentra.
Discuss your requirement
Start with your business.
Start with the requirement, the systems involved and the outcome you need. Please do not send passwords, sensitive records or unrestricted tenant access in an initial enquiry.