ISO consulting and assurance · ISO/IEC 27001:2022
We audit your information security management system (ISMS) against ISO/IEC 27001:2022, with a fixed scope, a findings report with evidence and an action plan. For companies that are already certified and for those heading to their next external audit.
It is the planned, documented verification that an organization's ISMS meets the requirements of ISO/IEC 27001 and the organization's own requirements, and that it is effectively implemented and maintained. Clause 9.2 of the standard requires it at planned intervals, and it ends in a report with findings and evidence that feeds the improvement of the system.
The 2022 edition of the standard groups the Annex A controls into 93 controls across four themes: organizational, people, physical and technological. The audit checks the management system requirements and the Annex A controls that apply to your company according to your Statement of Applicability.
Each format has its scope, timeline and deliverables defined from the proposal. You choose according to where your company is; nothing is mandatory.
Express internal audit to meet your annual requirement with clear findings.
Audit by risk or critical topic to audit only where the risk is.
External audit simulation so nonconformities show up here and not on audit day.
The timelines are FORQUANTIQ consulting time. The proposal confirms the timeline according to your scope. Want to see the full portfolio? See the products for certified companies.
The audit is performed by internal auditors certified in ISO/IEC 27001. It is a personal certification of the auditors.
FORQUANTIQ does not issue ISO certificates. Certification is granted by an accredited body of your choice. Our internal audit prepares your company and does not replace the certification audit. The audit scope is the management system: it does not include technical testing of your infrastructure.
It is the planned, documented verification that an organization's ISMS meets the requirements of ISO/IEC 27001 and the organization's own requirements, and that it is effectively implemented and maintained. It ends in a report with findings and evidence.
For an organization that implements ISO/IEC 27001:2022, yes: clause 9.2 requires internal audits at planned intervals. In addition, in certification and surveillance audits the certification body reviews the evidence that this internal audit program was carried out.
The standard does not set a numeric frequency: it requires planned intervals. The usual practice in certified companies is to audit the scope of the ISMS at least once a year, before the external surveillance or renewal audit.
The internal audit is commissioned by the organization itself to verify and improve its system. The certification audit is performed by an accredited body of your choice and is the one that grants or maintains the certificate. The internal audit prepares the company, but it does not replace the certification audit.
It depends on the format: Flash Check is 2 days of audit, Focused Audit is 3 days and Dress Rehearsal is 4 days, and in all three the report is delivered within 2 business days. Dress Rehearsal also includes closure verification at 30 days. These are FORQUANTIQ consulting days; the proposal confirms the timeline according to your scope.
Yes. All three services have a fixed scope, agreed in the proposal before work begins. Focused Audit concentrates on a risk or critical topic and Flash Check on one standard and its critical processes.
Each proposal defines scope, timeline, deliverables and fee before work begins, and any scope extension is agreed in writing before it is carried out. Request your proposal and we will send it with the fee for the scope you need.
It is performed by internal auditors certified in ISO/IEC 27001. It is a personal certification of the auditors. FORQUANTIQ does not issue ISO certificates: certification is granted by an accredited body of your choice.
No. The audit scope is the information security management system: the requirements of the standard and the Annex A controls, with their evidence. It does not include technical testing of your infrastructure.
Yes. The internal audit, focused audit and external audit simulation services are designed for companies that are already certified and need to meet their annual internal audit or reach the external audit without surprises.
Depending on the service and scope: for example, Flash Check can be done remotely or on-site. The format is defined in the proposal.
Under a confidentiality agreement before we start, in accordance with Colombian Law 1581 of 2012 and FORQUANTIQ's personal data processing policy.
Tell us about your situation and we will propose the format that fits best. We reply within 24 business hours.
You can also write to us at info@forquantiq.com.
