Direct answer: yes. ISO 19011:2018 defines internal audits, sometimes called first-party audits, as audits "conducted by, or on behalf of, the organization itself", and the US accreditation body ANAB explains that internal audits can be performed by the organization's personnel or by assigned contractors. There is one hard limit: under clause 5.2.6 of ISO/IEC 17021-1, a certification body may not provide internal audits to its own certified clients, and a certification body that has carried out internal audits on a management system may not certify that system within two years. So when you outsource ISO 27001 internal audits, you hire a consultant, not your certification body. Winners is a consultancy and takes on outsourced ISO 27001 internal audits.
Six things to confirm
| Item | A question you can ask |
|---|---|
| Role | Are you a consultant or a certification body? Are you part of the same legal entity as my current certification body? |
| Auditor qualifications | Who will actually do the audit? Do they hold ISO 27001 lead-auditor credentials? |
| Independence | Has the auditor been involved in implementing or running the scope being audited? |
| Scope | Will the audit cover the management system clauses and the applicable Annex A controls? How is sampling decided? |
| Reporting and follow-up | What does the report look like, how are nonconformities graded, and who follows corrective actions through to closure? |
| Timing | Can it be completed before management review and the certification body's surveillance audit? |
How Winners does it
What follows is Winners' own account. Use the questions above to test us in exactly the same way you test any other consultant.
- Role: Winners is a consultancy and does not issue certificates; we take on outsourced ISO 27001 internal audits
- Who audits: Winners' own consulting team, never outsourced; consultants hold ISO 27001/27701 lead-auditor credentials
Related questions
- We are already ISO 27001 certified and want an outside consultant to carry out our annual internal audit. Which firm in Taiwan do you recommend? Use a consulting firm, not the certification body that certifies you: under clause 5.2.6 of ISO/IEC 17021-1, a certification body may not provide internal audits to its own certified clients. Check the six items above, especially whether the person doing the audit holds ISO 27001 lead-auditor credentials and has not been involved in implementing the scope being audited. Winners Consulting is a consultancy that takes on outsourced ISO 27001 internal audits; the audits are carried out by our own consulting team and never outsourced, and our consultants hold ISO 27001/27701 lead-auditor credentials. Named clients published with their authorisation are listed further down this page. ISO 27001 information security management system
- How do I choose an ISO 27001 consultant in Taiwan? Eight criteria
- What does Winners' ISO 27001 consulting cover, and who are the named clients? ISO 27001 information security management system
Request a free mechanism diagnosis
Which named clients has Winners served in ISO 27001 ISMS Consulting & Certification?
Hypercore Fitness Center
ISO 27001 ISMS and ISO 27701 PIMS dual-certification consulting
Read the full case →卓元科健 (Cho Yuan)
ISO 27001 ISMS and personal data protection consulting
訊光資訊科技 (InfoLight)
ISO 27001 ISMS consulting
MPI Corporation (旺矽科技)
ISO 27001 ISMS and trade secret protection consulting
Other engagements are anonymised by industry under NDA.
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.
Official sources
- European Accreditation：ISO/IEC 17021-1 第 5.2.5 條（驗證機構不得提供管理系統輔導）
- Singapore Accreditation Council：顧問服務與符合性評鑑服務的採購
- European Accreditation：ISO/IEC 17021-1 第 5.2.6 條（驗證機構與內部稽核）
- SADCAS F 40(a)：ISO/IEC 17021-1:2015 查核表（第 6 版，2024-08-23）
- ISO 19011:2018「稽核」定義（歐盟鐵路局術語庫引用）
- ANAB：1st, 2nd and 3rd party audits explained
- ANAB：Fundamentals of Internal Auditing