Who audits compliance?

An internal audit is how you go from gap assessment to ready for external audit.

External auditors should be selected by looking for ones who themselves are audited by your regional government auditing body. Eg if you wanted to be audited and certified for ISO27001, and you happened to be in UK, you may choose BSI as your external auditor, who themselves are audited by UKAS.

It’s a web of trust model.

The purpose of these certificates are to shortcut compliance checks by your customers (or in some cases suppliers).