The forgotten obligation: Why the internal audit is often the stumbling block

The problem in many organizations is that the internal audit is seen as an administrative checkbox. "Just quickly check whether we have everything." But the ISO standard sets strict requirements for this audit: it must be objective and impartial.

The objectivity dilemma

In a company with 25 to 50 employees, roles are often intertwined. The IT manager wrote the policy and set up the systems. When you ask this person to carry out the internal audit, you are essentially asking: "Would you please check your own homework and judge it strictly?"

The standard is clear about this: Auditors may not audit their own work.

This means you need to find someone else in the organization who meets three conditions:

1. Knowledge: Understands the ISO 27001 standard.

2. Impartiality: Has not been involved in the implementation.

3. Capacity: Has time to go through all processes.

In 90% of SMEs, this person simply is not available.

Expert Tip: A weak internal audit is the number one cause of findings during the external audit. Do not see it as an obligation, but as the dress rehearsal.

Cost comparison: Do it yourself vs. Outsource

Let us set aside the emotion and look at the hard numbers. We compare the situation for an average SME (IT/Services, 50 employees) in 2025.

Scenario A: Do it yourself (Internal)

You assign an operational manager (not IT, because they implemented it) to carry out the audit.

• Training/reading ISO 27001: 8 hours (minimum).

• Preparing audit questions: 4 hours.

• Conducting interviews & checks: 12 hours.

• Writing the report: 6 hours.

• Total: 30 hours.

At an internal cost rate (gross salary + employer costs + overhead + opportunity cost) of €85 per hour, this project will cost you internally €2,550.

The hidden risk: The chance that an untrained colleague misses errors is high. Will the external auditor find these errors? Then a re-audit follows. Cost: approx. €1,500 extra.

Total estimated impact: €4,050 (plus the necessary stress).

Scenario B: Outsource (External via AuditDirect)

You hire a specialist who does this every day.

• Reading in: Done efficiently in advance.

• Execution: Audit on site or remote in 1 day. The expert sees through weak spots.

• Reporting: Immediately usable as evidence for the external auditor.

• Costs: Fixed price, on average between €1,600 - €2,500 (depending on scope).

The balance: Internal vs. External

The 'WC-eend' effect and false security

The consequence of "we will just do it ourselves" is often the so-called WC-eend effect: "We of WC-eend recommend WC-eend."

When colleagues audit each other, people often do not dare to dig deeply. "Colleague X has been busy, I can see this document is not finished, but I know he is working on it. I approve it." This is human, but risky for your certification. You create a false sense of security and leave blind spots that an external auditor from NEN or a certification body will spot immediately.

An external party such as AuditDirect looks with the same lens as the certification auditor:

• Is a procedure missing? We see it.

• Is the evidence incomplete? We report it.

• Do your employees not know what to answer? We coach them.

Glossary for ISO 27001 Audits

To properly understand the internal audit, it is important to use the correct terminology. This also helps you interpret the audit report.

• Non-Conformity (Deviation): Failing to meet a requirement of the standard.

  • Major: A serious shortcoming that makes certification impossible.

  • Minor: A smaller shortcoming that must be resolved within a certain time.

• Objectivity: The requirement that the auditor must be impartial and have no interest in the outcome of the audit.

• ISMS (Information Security Management System): The entire set of policies, procedures and processes being assessed.

• External Audit: The official assessment by an accredited party to obtain the certificate.

Conclusion: Do not buy an audit, buy certainty

At the end of the day, outsourcing is often cheaper than doing it yourself, especially if you include the 'opportunity cost' of your own staff. But the real gain is not in the euros, it is in the quality.

With an audit by AuditDirect, the internal audit changes from a mandatory exercise into a valuable dress rehearsal. You eliminate the stress for the external audit because you know the gaps have already been closed.

Ready for the next step?

Do you want to be sure you will pass your ISO 27001 certification without burdening your own staff with tasks they are not trained for?

• Click here now to schedule your Internal Audit as soon as possible!

• Are you just getting started on the path to ISO 27001 certification? View our Gap Analysis here. Together with you, we take a thorough look at your current situation and build a pragmatic action plan so your certification process starts without errors!

• Stress-free guidance so your entire certification journey runs smoothly? Book a free, no-obligation consultation with us here to see how we can help you from the start through to certification.

AuditDirect: A fresh perspective for a fixed price. We do not deliver a list of mistakes, but a list of solutions.