Hi all! Quick ISO 27001 question on internal audit independence (clause 9.2.2).
I’m the GRC Lead at a small startup and hold an ISO 27001 Lead Auditor cert. I also own most of our ISMS (policies, risk assessment, Vanta program). At my last company I ran the full internal audit myself, with our Head of Legal reviewing and signing off on the results, and our certification body accepted it.
We’re heading into Stage 1 in January and want to do the same here: I audit everything, then Legal and Finance review and sign off for independence. For those who’ve done something similar:
- 1.
Did your certification body accept it for the areas you own (policies, risk, the audit process itself), or raise a finding?
- 2.
Did they want anything specific documented, like the reviewers’ sign-off or a note on how you kept it impartial?
Any experiences appreciated!
.png)