By Alex Fernandez
🛡️ Second consecutive year passing the ISO 27001 audit with zero nonconformities — and the first cycle entirely without external consultancy.
A few days ago we received the final report from DNV for our 2026 ISO 27001 external audit. The result: zero nonconformities. It is the second consecutive year we keep that figure, but this cycle has a detail that makes it, for me, especially relevant: it was the first time the company faced the process without external consultancy, and the first time I personally executed the prior internal audit.
I am writing this post because I think the case illustrates well a strategic decision many ISMS leaders are weighing right now: when does it stop making sense to outsource, and when does it make sense to internalize the audit function? I am not selling a universal recipe. I will share what we did, why we did it, and what I read into it.
ISO/IEC 27001 is the international reference standard for Information Security Management Systems (ISMS). It does not certify a company as “secure” in absolute terms — that does not exist — but it certifies that there is a documented, living, auditable system to identify information risks, treat them, and continuously improve.
An external certification or surveillance audit reviews, among other things, the system’s scope, risk analysis, statement of applicability, effective implementation of Annex A controls, the continuous improvement cycle, and management’s traceability over the system. Any of those blocks can generate major or minor nonconformities, and it is common — even in mature organizations — to close the cycle with at least a minor NC or some observations.
That is why a clean report is not a given. And keeping it clean two years in a row, less so.
For years, the reasonable approach for us was to lean on external consultancy to prepare audits. That decision changed when I obtained the ISO 27001 Lead Auditor credential from AENOR in 2025. From that point, the question stopped being “who helps us prepare?” and became “does it still make sense to pay for a layer we already cover internally?”
My answer — after discussing it with management — was no. Three reasons:
1. Context knowledge. Nobody understands the processes, critical assets, and culture of Process Control Tech better than the internal team. A consultancy always needs warm-up time; we do not.
2. System ownership and traceability. When the internal audit is run by a third party, there is a silent risk: the ISMS gets lived as “what the consultancy asks for” instead of “what we need”. Internalizing reinforces real ownership of the system.
3. Economic efficiency. I will not put concrete figures here because the saving depends on each contract, but eliminating a recurring consultancy line frees budget that can be reinvested in controls, training, or tooling. The ROI of certifying the internal lead materializes precisely when the intermediate layer is removed.
Adding to this, this year I obtained the ISO 42001 Lead Auditor credential (AI Management System, April 2026), which prepares us to integrate AI governance into the same management framework when the time comes. But that is another conversation.
I personally executed the prior internal audit, applying the same approach an external auditor would: functional independence from the audited areas, a formal program, defined audit criteria, documented evidence, and a report with classified findings.
The Security and ISO Committee was the throughline of the entire cycle. It is the body where system decisions are channeled, risks are reviewed, treatment plans approved, and corrective actions followed up. Without a committee that actually works — not one that exists only on the org chart — a serious internal audit is not viable.
Methodologically, the approach was:
It is not magic. It is discipline and method.
With the internal audit closed and findings resolved, we faced the external audit with DNV. DNV evaluated, at a high level, the same blocks any ISO 27001 surveillance audit covers: organizational context, leadership and management commitment, risk-based planning, support (resources, competence, communication), operation, performance evaluation and continuous improvement, plus the implementation of applicable controls.
The difference compared to previous years is that this time there was no external consultant acting as intermediary. The interaction was direct: internal team, committee, management, and auditor. And honestly, that simplifies the conversation a lot.
Zero nonconformities for the second consecutive year, in the first cycle without external consultancy. That is the headline. But the reading I take is not one of victory — it is one of model validation:
If you are considering taking the step to internalize, here is what I would do:
Closing an ISO 27001 cycle with DNV with zero nonconformities, without external consultancy, and with the internal audit run in-house is, above all, a sign that the management model is mature. It is not an arrival point; it is the foundation for the next step — in our case, the gradual integration of AI governance under ISO 42001.
Considering internalizing your ISO 27001 cycle, or integrating ISO 42001 into your management system?
If you would like to exchange experiences or discuss the case in more detail, you can reach me at:
EN 
ES 