Internal Audit

    Independent.
    Your platform, your choice.

    A practical, independent internal audit for ISO 27001, ISO 42001, and SOC 2 run without changing how your team works.

    Book an audit consultation See our audit approach

    The test every control faces

    1. Designed

      The control fits the risk it exists for

    2. Implemented

      It exists in practice, not just on paper

    3. Operating effectively

      It keeps working between audits

    Every verdict documented, backed by evidence.

    Backed by certifications FEHA holds independently

    ISO 27001 Lead Auditor CertificationISO 27001ISO 42001 Lead Auditor CertificationISO 42001CSA STAR Lead Auditor CertificationCSA STAR

    What we audit

    Three frameworks, one discipline: whether each control is properly designed, implemented, and operating effectively.

    Information security

    ISO 27001

    Your information security management system: controls, risk management, and operational effectiveness.

    AI management

    ISO 42001

    Your AI management system: governance, AI risk, and the AI controls that apply to you.

    Trust services

    SOC 2

    Controls assessed across the applicable Trust Services Criteria, with security and related areas in your scope.

    How the audit runs

    Five stages, the same discipline every cycle. You always know where the engagement stands.

    1. 01

      Scope & Planning

      Audit objectives, scope, applicable framework, controls, stakeholders, and timeline, agreed before fieldwork starts.

    2. 02

      Evidence Review

      Policies, procedures, records, system evidence, and the documentation that shows how controls actually run.

    3. 03

      Control Validation

      Each control assessed for design, implementation, and operating effectiveness against the framework.

    4. 04

      Findings & Risk Assessment

      Gaps and nonconformities documented with root cause, risk, and potential impact.

    5. 05

      Remediation & Follow-Up

      Corrective actions tracked and verified, so findings close instead of resurfacing next cycle.

    Independent by design

    Our internal audit team operates independently from the implementation and operation of every control it assesses.

    That separation holds on FEHA GRC too: auditors stay independent from the teams managing your compliance program, preserving the objectivity an internal audit function owes you.

    Compliance team

    Builds and operates your controls, on FEHA GRC or your own stack.

    Audit team

    Assesses those controls. Takes no part in building or running them.

    One audit. Any workflow

    The engagement adapts to your tooling, not the other way around.

    Already have a GRC platform?

    Keep it. Our auditors work inside your existing environment, so your team keeps its workflow and its system of record.

    VantaDrataSecureframe

    No GRC platform?

    No problem. We run the engagement on your existing documentation and evidence workflow.

    Want a dedicated compliance platform?

    Use FEHA GRC to manage controls, risks, evidence, findings, and remediation alongside the audit.

    More than internal audit

    An audit tells you where you stand. If you need help moving, FEHA provides separate vCISO and penetration testing services.

    vCISO

    A fractional security leader who sets strategy, reports to your board, and guides governance. Kept separate from audit work wherever independence requires it.

    Penetration Testing

    Manual testing by CREST and OSCP certified experts across web apps, APIs, cloud, and networks, uncovering exploitable vulnerabilities that automated scanners miss.

    Use one or combine them

    FAQ

    Frequently asked questions

    Everything you need to know
    about our internal audit.

    Still have questions? Talk to us

    Yes. Our consulting services support implementation, gap assessment, readiness, remediation, and ongoing compliance activities. Consulting and internal audit engagements are kept appropriately separated where independence is required.

    Ready to schedule your internal audit?

    Tell us your framework, scope, and timeline.

    Book an audit consultation