ISO Internal Auditing

Small and medium-sized enterprises (SMEs) often face structural and resource-based challenges in delivering an effective internal audit program, particularly in information security.
Most SMEs do not have staff with the specialised knowledge required to interpret and apply the detailed requirements of standards such as ISO/IEC 27001. 

Developing this expertise in-house requires a significant investment of time and money in training, not only to understand the technical and procedural elements of the standard but also to build auditing competence—often an entirely new discipline for existing staff.
In addition, maintaining the objectivity and independence needed for a credible audit process is difficult in smaller teams where roles often overlap. This can undermine the integrity and value of the audit findings.

I help by bringing independent support that isn’t caught up in the day-to-day pressures of the business. I’ve worked extensively with ISO 27001, ISO 9001, auditing of cloud controls such as ISO 27017 so I understand how these standards overlap and how they work in practice — not just on paper.

I use that experience to help you strengthen controls, simplify what can often feel complex, and build a management system that genuinely works for your organisation, not just for the certificate.