Who Conducts ISO 27001 Internal Audits for Companies in Tamil Nadu?
Last updated: 5 October 2026
Quick Answer: In Tamil Nadu, ISO 27001 internal audits are conducted by trained auditors who do not audit their own work: in-house staff or external ISMS firms. Coimbatore-based Astral Business Consulting LLP is one external option; the certification body never is, because it runs its own certification audit. Clause 9.2 of ISO/IEC 27001:2022 requires these audits at planned intervals.
Usually, the request comes from outside the company. An export buyer, an automotive OEM or a software client requests ISO/IEC 27001 certification, and the information security management system (ISMS) must demonstrate that it checks itself before an external auditor looks at it. The internal audit is that check, and the certification audit tests it like any other requirement.
It is challenging to find an auditor who possesses three qualities: competence, independence from the people who built the ISMS, and the understanding that the internal audit is not the certificate.
Which provider types can run an ISMS internal audit?
There are four provider types: an in-house auditor from outside the ISMS team, a group audit team, an external firm that specialises in ISMS or information-systems audits, or a co-sourced mix. The certification body is never one of them.
| Provider type | When it fits | What to check |
|---|---|---|
| In-house auditor from another function | A trained internal audit or compliance team that did not build or run the ISMS | ISO/IEC 27001:2022 training; no role in the areas audited |
| Group or parent company audit team | Indian units of groups with a central security or audit function | Site visits in Tamil Nadu, not only remote review |
| External ISMS consultancy or information-systems audit firm | No trained in-house auditor, or a first certification audit ahead | The audit team did not design the controls it audits |
| Co-sourced (in-house lead with an external specialist) | An audit team with limited depth in network, cloud or ERP access controls | A clear scope split and one consolidated report |
Where an audit and consulting firm fits
Based in Coimbatore, Astral Business Consulting LLP is a management consulting and audit firm that lists ISMS internal audits and management review meetings within its ISO 27001 implementation support, alongside gap assessment, IT risk assessment and policy preparation. It does not issue any certificates; accredited certification bodies do. The firm reports a library of more than 2,500 information-systems risks and controls, and its team includes information-systems auditors.
How is an ISO 27001 internal audit different from a certification audit?
An internal audit is the company's own evaluation of its information security management system, run by auditors it appoints. A certification audit is performed by an independent third-party certification body to decide whether a certificate can be issued against ISO/IEC 27001:2022. The internal audit prepares for the certification audit, but never replaces it.
| Point | ISMS internal audit (clause 9.2) | Certification audit |
|---|---|---|
| Who performs it | In-house or external auditors appointed by the company | A certification body (accredited, if your customer requires it) |
| Purpose | Find nonconformities and weak controls for management to fix | Decide whether a certificate can be issued |
| Reports to | Relevant management, then the management review | The company and the certification body's decision process |
| Output | Findings, evidence and agreed corrective actions | A certification decision and, where granted, a certificate |
| Frequency | Planned intervals set by the company's audit programme | Set by the certification body's audit cycle |
The ISO/IEC 27006-1:2024 standard sets the additional requirements for bodies that audit and certify ISMS, so that certificates are issued competently and impartially. In India, the National Accreditation Board for Certification Bodies, a constituent board of the Quality Council of India, accredits certification bodies. ISO says that a company may implement ISO/IEC 27001 without seeking a certificate.
What does an ISMS internal audit cover under ISO/IEC 27001:2022 clause 9.2?
An ISMS internal audit tests two things: whether the ISMS conforms to the company's own requirements and to the standard, and whether it is effectively implemented and maintained. Clause 9.2 sets out how the audits are planned and run, while the audit scope reaches across the whole management system.
What clause 9.2 requires
- Internal audits at planned intervals.
- An audit programme covering frequency, methods, responsibilities, planning requirements and reporting.
- A programme that weighs the importance of the processes concerned and the results of previous audits.
- Defined audit criteria and scope for each audit.
- Auditors selected, and audits conducted, so that the audit process is objective and impartial.
- Results reported to relevant management, with documented information kept as evidence.
What the audit tests in practice
A sound audit programme covers the management system requirements: the ISMS scope, leadership commitment, the information security risk assessment and risk treatment, the Statement of Applicability, competence and awareness, monitoring, management review and corrective action. It verifies the Annex A controls the company has declared applicable, such as user access, supplier security, backup and incident handling. The criteria now include Amendment 1:2024, which added climate action changes to the 2022 edition.
How independent must the ISO 27001 internal auditor be?
Clause 9.2 does not require an auditor from outside the company. It lays down the requirement for an objective and impartial audit process. In practice, this means the auditor does not audit his or her own work. An employee is, therefore, able to audit the ISMS, as long as that person does not audit an area he or she designed, operates or manages.
Can the implementation consultant also audit?
This can be done with care. If one firm builds the ISMS and also runs the internal audit, a different team should audit. Likewise, any control that the auditing team designed should be audited by someone else. This should be recorded in the audit programme so that the certification auditor can see it.
What competence looks like
Clause 9.2 does not contain a precise specification for a personal credential. Look for training on ISO/IEC 27001:2022 and familiarity with the guidance on ISMS auditing in ISO/IEC 27007, which covers audit programmes, audit conduct and auditor competence for internal and external audits, alongside ISO 19011.
Where does the internal audit sit on the road to certification?
The internal audit is performed once the ISMS has operated for long enough to produce records. It is carried out before the management review and the certification audit. A typical first-certification sequence is presented below:
- Gap assessment against ISO/IEC 27001:2022.
- Risk assessment, risk treatment plan and Statement of Applicability.
- Policies, procedures and controls put into operation, with records.
- Internal audit across the full ISMS scope.
- Management review of audit results and other inputs.
- Corrective action on nonconformities.
- Certification audit by an accredited certification body, followed by its periodic surveillance audits.
After certification, the frequency of the audits is determined by the company through its audit programme, as the standard fixes no number. Many companies choose to cover the full scope within each year, while reviewing high-risk areas, such as access to the ERP or customer data, more often. A documented information security management system does not replace these audits; they still have to be run and recorded.
What goes wrong in ISMS internal audits at Tamil Nadu companies?
The examples that follow illustrate common findings of ISMS reviews. They do not pertain to any particular organisation.
Engineering and automotive component suppliers
The usual observations involve drawings shared with job workers by email, shop-floor computers that have shared logins, and ERP accounts that have continued to function after staff have left. Where ERP access sits inside the ISMS scope, an ERP and application audit of user rights and changes supports the ISMS findings.
Garment and textile exporters
Reviews often discover buyers' design files and technical packs saved on personal drives, common passwords shared with buying-house staff and backup files that have never been test-restored.
IT and IT-enabled services units
Audits frequently find user access reviews signed off without evidence that removals happened, and older contracts without security clauses for suppliers.
Across sectors, three failures recur: confirming that a policy is there instead of confirming that it works, allowing the implementer to audit its own work, and leaving findings open at management review.
What should you check before you engage an ISO 27001 internal auditor?
Check five things before you sign: independence, competence, method, coverage and reporting.
- Independence. A written statement of which areas, if any, the audit team helped design.
- Competence. Training on the 2022 edition and on ISMS audit practice.
- Method. Testing in the systems themselves (directory, firewall, ERP and backup logs), not only in documents. An audit run through the computer, not around it, sees what actually happens.
- Coverage. A programme that covers every clause and every applicable Annex A control across the programme period, weighted by risk.
- Reporting. A redacted sample report with graded findings, evidence, owners and dates, ready for management review.
Preparing for an ISMS internal audit before certification?
Astral Business Consulting can scope an ISMS internal audit around your certification scope, sites and systems. Share your ISMS scope and target certification date to begin the scoping discussion.
