An internal audit you can use to make better security decisions.
For security and GRC leaders who outsource their internal audit. Understand what your controls support, where protection is missing and what needs attention. Keep your tools; we take responsibility for the examination.
Agree the work before it starts.
A fixed quote after discovery and feasibility checks. One agreed audit cycle, the report and supporting records, handover, and one corrective-action verification. Your team owns the fixes.
Proposed service in development. Discovery conversations are open; this brief is not an engagement agreement, an announcement of an available service, or an issued audit report.
What you receive
- An internal audit report: scope, programme rationale, conformity, nonconformities, observations, improvement opportunities and explicit unknowns, with evidence limits and confidence.
- Supporting audit-evidence records per claim: criteria, population, procedure and method version, results, coverage, proposed wording and the named auditor's determination. File them into your existing programme.
- Guidance on the protection a finding shows missing and the evidence needed to show it restored. Your team designs and implements the fix.
- One corrective-action verification within an agreed window. A new, linked run preserves the original finding, dates and remaining limitations.
- Handover with workpapers, procedure versions, populations, permitted evidence access and machine-readable records consistent with the report.
Your team's part
Keep your tools, risk assessment, control operation and certification body. Provide a sponsor, source owners, the current risk assessment and Statement of Applicability, relevant prior audit reports and authorized evidence access. Your management review and risk decisions remain yours.
Access is scoped, read-only and time-bounded for each claim and stage. We collect the agreed records or your engineers export them, using reviewed, versioned decoders. Access lapses at stage end; no standing connection or synchronised copy of your systems is maintained. Access duration does not establish the period the evidence supports. Retention and permitted later review are agreed and recorded.
Read the detailed terms.
Explore scope, review, fees and boundaries. You can also download the complete brief above.
Who the first engagement is for
Security and GRC leaders at companies with an established ISO/IEC 27001 programme that outsource their internal audit or are preparing to do so. Épreuve's proposed first engagement is the clause 9.2 internal audit: completed examination of your controls, with findings you can use to make security decisions. SOC 2 audit readiness is a planned application of the same assessment method.
Scope and depth
The whole information security management system: clauses 4 to 10 and Annex A according to your Statement of Applicability, over the agreed assessment period. Every applicable requirement is covered. Your top risks add deeper examination of the controls they depend on, including scrutiny of relevant not-applicable decisions. Risk-led depth does not replace coverage.
We start with your risk assessment and control register. Relevant peer and vendor incidents can inform scenarios, with sources and dates kept distinct. Records, interviews and observation are used as needed. Procedures address the intended protection, population completeness, period coverage, exceptions and bypass paths. Untested requirements, exclusions and evidence gaps remain visible. A snapshot does not establish protection throughout a period.
How the work is reviewed
AI helps investigate evidence and propose procedures and explanations. Reviewed, versioned software performs defined checks. Named people remain accountable for judgment and release. A BSI-trained ISO/IEC 27001 Lead Auditor leads the proposed engagement; a second qualified auditor is named as reviewer before it starts. An adversarial agent joins only once qualified.
Review challenges both favourable and adverse conclusions. Unsupported conclusions, a missed known material failure, or missing evidence treated as a pass block release. Épreuve does not internally audit a control it helped remediate in the same cycle. Advice-related conflicts are disclosed in the engagement letter; the second qualified auditor owns the examination of controls Épreuve advised on. These roles are resolved before engagement work begins.
Fixed quote and included verification
Agree a fixed fee after discovery and any separately authorized feasibility check. It covers one internal audit cycle, review, report, supporting records, handover and one corrective-action verification in an agreed window. No fee amount or delivery timetable has been selected.
Payment is for completed examination, including adverse or inconclusive results. Épreuve absorbs its delivery inefficiency within the agreed scope. Our missing connector, procedure or expertise cannot become completed work or a client evidence gap. Correcting our assessment errors does not consume your included verification. Further cycles are quoted separately.
The first conversation
Request a free 45-minute discovery call with Ayoub. Discuss your audit dates, top risks, who needs the report, evidence availability and access constraints. No credentials or confidential evidence are collected on this call. Where feasibility is uncertain, agree a small, separate evidence check before a firm quote. Sending an email requests a conversation; it does not book a slot.
What this does not include
Épreuve issues no certificate or attestation. Your certification body decides what to inspect or reperform and issues its own certificate. No certification body has yet reviewed an Épreuve report. Certification, a favourable result or a shorter external audit is not promised.
This service does not establish an internal audit function under IIA standards, rewrite your Statement of Applicability, implement remediation, provide continuous monitoring or a hosted trust centre, or replace a penetration test.
The website example
The site contains fictional examples. Alder Works shows a retained offboarding examination for three departures in June 2026. Northstar Labs illustrates three views of the same broader assessment scope in September 2026. They are separate cases, not customer engagements or evidence for one another. Their respective scope, review status and limitations remain visible beside each example.
Contact
Email ayoub@grcengineer.com to request a discovery call. Keep the initial conversation high-level; do not send credentials or confidential evidence. Downloading this brief sends no inquiry.
Founder background
Let’s talk about your next audit.
Free · 45 minutes with Ayoub. Discuss dates, risks and evidence availability. No credentials or confidential evidence. Email requests a conversation; it does not book a slot.