ISO/IEC 27001 Internal Audit
A full internal audit of your ISMS against ISO/IEC 27001:2022, clauses 4 to 10 and the Annex A controls declared in your Statement of Applicability.
Independent assurance & assessment
An audit is only worth having if the person running it is willing to tell you something you would rather not hear. We assess what you have built, evidence what we find, and hand you a report you can act on.
We get you ready to certify, and we prove you are
ZULTIV runs your internal audit, your readiness assessment and your third-party review against the same standards we teach. You finish with the evidence pack, the corrective plan and the confidence to book the certification audit.
Our independence is what makes that verdict worth having. We have no certificate to sell you and no implementation of our own to defend, so nothing is softened. You get an honest read on where you stand before a certification body, a regulator or a customer forms their own.
Scope note: ZULTIV is not an accredited certification body. Your accredited certificate is issued by the registrar you appoint. Our job is to make sure that audit is one you pass.
Category 01
Internal audits
Clause 9.2 requires an internal audit programme. Running it with your own people is allowed, and often the wrong call, nobody audits the system they built with a straight face.
ISO/IEC 22301 Internal Audit
Business continuity management audited against ISO/IEC 22301: BIA, recovery objectives, continuity strategy, and whether the exercises actually test anything.
ISO/IEC 9001 Internal Audit
Quality management system audit against ISO/IEC 9001: process interactions, risk-based thinking, and evidence of improvement rather than intention.
Category 02
Readiness & assessment
Before the certification audit, the customer security review or the regulator's question, find out what the answer is going to be.
HIPAA Readiness
Administrative, physical and technical safeguards reviewed against the HIPAA Security and Privacy Rules, with a gap register you can work through.
SOC 2 Readiness
Trust Services Criteria walked control by control, so your CPA firm's examination is not the moment you discover the evidence does not exist.
Risk & Compliance Assessment
A structured look at your risk universe and control environment against the obligations that actually apply to you, including India's DPDP Act.
Third-Party / Vendor Assessment
Your suppliers hold your data and your uptime. We assess them properly, on evidence, rather than on a returned questionnaire nobody read.
Category 03
Attestation of Compliance
When a customer, an investor or a regulator asks for proof, a signed independent attestation answers the question in one document.
An Attestation of Compliance (AOC) is a formal statement, issued and signed by ZULTIV, confirming that we examined your controls against a named framework on a named date and found them implemented and operating.
It is the document you hand to a client security team that will not accept a self-assessment questionnaire, and the one that keeps a deal moving while a full certification audit is still months away.
What you receive
A signed attestation letter, the scope statement it rests on, the control testing summary behind it, and a findings log for anything that had to be fixed first.
How long it takes
Typically three to six weeks from scoping to signature, depending on the size of the estate and how much evidence already exists.
Frameworks covered
ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001, ISO/IEC 22301, HIPAA, SOC 2 criteria and India's DPDP Act, individually or combined.
An Attestation of Compliance is ZULTIV's own independent attestation. It sits alongside, and is not a substitute for, an accredited ISO management system certificate issued by a certification body.
How we work
The same method, every engagement
No two organisations look alike, but the discipline does not change. Every assessment we run follows ISO 19011 audit principles: evidence-based, impartial, and reported in language you can hand to a board.
01: Scope
We agree what is in scope, what is deliberately out, and what "good" looks like before anything is examined.
02: Examine
Documents, interviews, system evidence and sampling, enough to reach a conclusion that survives challenge.
03: Report
Findings with the requirement, the evidence and the gap kept separate, each graded and each traceable.
04: Close
A prioritised remediation path, and a follow-up review when you are ready to show the gaps are shut.
What you receive
Deliverables, not opinions
Assessment report
Scope, method, sample, and every finding with its evidence trail, written so a third-party can follow your reasoning without you in the room.
Gap and risk register
Each gap mapped to the clause or criterion it breaches, graded, and ranked by the risk it actually carries rather than how easy it is to fix.
Remediation roadmap
A sequenced plan with owners and realistic effort, plus a management summary your leadership will read to the end.
Questions
Before you engage us
No. Certification is issued by an accredited certification body, and ZULTIV is not one.
What we do is get you ready for that body and audit you the way they will, and,
separately, run the internal audit programme the standard requires you to have.
Not on the same scope, and we will say so up front. Auditing your own implementation
destroys the independence that makes the audit worth anything. Where we have advised on
implementation, we will tell you to have the internal audit run by someone else,
and vice versa.
It depends entirely on scope, headcount and how many sites or systems are in play. A
focused readiness review can be a few days; a full internal audit of a multi-site ISMS
is longer. We scope it before quoting, and the scope is written down.
Yes, most document review and many interviews work well remotely. Physical
controls, site security and anything requiring observation are better done on site, and
we will tell you which parts of your scope fall into that category.
Entirely. Engagements run under a signed confidentiality agreement, findings are shared
only with the people you nominate, and we do not use client names as references without
written permission.
Request an assessment
Tell us what you need assessed
Describe the scope in your own words: a system, a standard, a customer's security questionnaire, or just a deadline you have been handed. We will tell you what it takes.