Outsourced vs In-House ISO Internal Audits: Cost, Independence and Competence

Whether to run ISO internal audits in-house or outsource them comes down to three questions: can your own people audit without auditing their own work, do they have the competence to test the standard and your sector properly, and is the true internal cost lower than buying the audit in. Many smaller organisations struggle to satisfy all three in-house for every part of the scope, which is why a hybrid model is common.

None of the certifiable management system standards - ISO 9001, ISO/IEC 27001 or ISO/IEC 42001 - says who must perform the internal audit. Clause 9.2 in each requires audits at planned intervals, an audit programme, and auditors selected so the audit is objective and impartial. The choice is yours. This article sets out how to make it on evidence rather than habit.

What the standards actually require of the auditor

Clause 9.2 asks for three things that bear on the in-house versus outsourced decision:

• Objectivity and impartiality. The auditor must not audit their own work. This is a structural test, not a test of good intentions.
• A programme. Audits are planned at intervals, based on the importance of the processes and the results of previous audits. That does not mean one full audit every year. It means planned coverage that you can justify.
• Results reported to relevant management, with documented evidence of the programme and the results.

ISO 19011:2026, the fourth edition of the guidance on auditing management systems, published in May 2026 and replacing the 2018 edition, adds the practical detail: how to manage a programme, how to conduct an audit, and how to evaluate auditor competence. It is guidance, not a certifiable requirement, but certification auditors use it as the reference point for what a credible internal audit looks like.

Note what is missing. No standard requires an external auditor, a Lead Auditor certificate, or a minimum number of auditor days. Those are choices you make to meet the impartiality and competence tests.

The real cost of in-house internal audits

In-house audits look free because nobody sends an invoice. They are not. When you estimate the cost, include:

• Auditor time. Planning, document review, fieldwork, writing findings, the report and follow-up. Fieldwork is usually the smaller part. Preparation and reporting take longer than most people budget.
• Training. Internal auditors need training in the standard and in audit technique. A short internal auditor course is a start. It is not the same as experience of testing controls or processes under time pressure.
• Opportunity cost. The people best placed to audit are usually your most knowledgeable staff. Every day they spend auditing is a day not spent on their own job.
• Rework. If a certification auditor finds the internal audit was not impartial, or did not cover the scope, you may need to repeat it, and you may carry a nonconformity against clause 9.2.
• Rotation. To keep independence, internal auditors need to rotate around areas they do not own. In a small organisation, the pool runs out quickly.

In-house audits also have real advantages that do not show up in a cost model. Your people know where the bodies are buried. They can audit little and often across the year. And building internal audit skill strengthens the management system itself.

What drives the cost of an outsourced internal audit

An external internal audit is priced on effort. The main drivers are:

• Scope. The number of processes, Annex A controls, sites and functions in scope.
• Number of standards. A combined audit of two standards costs less than two separate audits, because shared clauses are tested once, but more than a single-standard audit.
• Sites and travel. Onsite fieldwork at multiple sites adds days and travel costs. Remote audit reduces travel but not the testing effort.
• Maturity and evidence quality. A system with organised evidence takes less time to audit than one where evidence must be found and assembled during fieldwork.
• Depth. A full-scope programme audit, a single process audit and a pre-certification readiness check are different products.
• Follow-up. Verification of corrective actions is sometimes included, sometimes a separate engagement.

What is not included in an internal audit fee: certification body fees, corrective work on the findings, and implementation support. Our pricing page explains how we scope engagements without publishing figures, because the drivers above vary too much for a meaningful list price.

Independence: where in-house programmes break

Independence is often the deciding factor when organisations outsource some or all of their internal audits. Our article on internal audit independence at Stage 2 covers the failure patterns in detail. For the purposes of this decision, the question is narrower: can you staff every part of your programme with someone who did not design, implement or operate what they are auditing?

Use this test for each audit area:

Area	Who owns it	Who could audit it in-house	Independent?
Purchasing and supplier control	Procurement lead	Quality manager	Yes, if quality did not write the supplier procedure
Access control	IT lead	Finance controller, trained	Yes for process testing; limited for technical depth
Management system core clauses (4-10)	Management system manager	Nobody else knows them	No
AI system impact assessments	Product and data science leads	Legal or risk	Possibly, if competence is there

The row that usually fails is the core management system. The person who wrote the risk methodology, the objectives, the document control procedure and the management review pack cannot audit them. In most small and mid-sized organisations, that person is the only one who knows the standard well enough. That is the gap an outside auditor fills most efficiently.

One option that is not available: your certification body. ISO/IEC 17021-1, the requirements standard for certification bodies, prohibits a certification body from offering internal audits to the clients it certifies, because it would then be certifying its own work. Use a separate provider.

Competence: what good looks like

ISO 19011 describes auditor competence as a combination of personal behaviour, knowledge of audit principles and methods, knowledge of the specific management system standard, and knowledge of the sector and the organisation's context. For your decision, translate that into four questions:

1. Does the auditor know the standard well enough to test it, not just read it? For ISO/IEC 27001 that means understanding how a risk treatment decision flows into the Statement of Applicability and into operating controls. For ISO 9001 it means following a customer requirement from contract review to release. For ISO/IEC 42001 it means understanding AI system impact assessment and the 38 Annex A controls.
2. Do they know your sector? An auditor who has never seen a production line or a CI/CD pipeline will ask surface questions and accept surface answers.
3. Can they sample and evaluate evidence? Interviews alone do not make an audit.
4. Can they write a finding that someone can act on? A finding needs a requirement, objective evidence and a clear statement of the gap.

A Lead Auditor certificate shows training in audit technique against a specific standard. It is useful evidence of competence. It is not approval by a certification body and it does not make an internal audit a certification audit. Equally, a trained in-house auditor with deep process knowledge can be fully competent for their area without one.

Three models compared

	In-house	Outsourced	Hybrid
Independence	Hard for core clauses in small teams	Strong by design	Strong where it matters most
Competence in the standard	Varies; depends on training and practice	Strong if the provider is chosen well	External for depth, internal for process knowledge
Knowledge of your operation	High	Lower at first; improves with continuity	High
Cash cost	Low	Higher	Moderate
Hidden cost	Staff time, rework risk	Your time supporting the audit	Coordination
Best for	Larger organisations with a trained auditor pool	First certification cycle, small teams, multi-standard systems	Organisations with some internal capacity but a small audit pool

The hybrid model usually splits the work like this: an external auditor covers the core management system clauses, the highest-risk processes and anything the management system owner touches; trained internal auditors cover departmental process audits across the year; and the programme is owned internally so it reflects real priorities.

Decision criteria you can apply this week

Work through these in order.

1. List the areas in your programme and who owns each one. If any area has no possible in-house auditor who is independent of it, you need external support for at least that area.
2. Check competence for each standard. If you hold or are pursuing more than one certification, confirm that someone can test the standard-specific parts of each. Shared Harmonized Structure clauses are not where the hard questions are.
3. Estimate internal time honestly. Include preparation, reporting and follow-up, not just audit days. Multiply by a realistic day rate for the people involved.
4. Look at your certification calendar. If a Stage 2 or recertification audit is coming, an internal audit with findings you have time to fix is worth more than one squeezed in the week before.
5. Decide what you want to own long-term. Some organisations want to build internal audit capability; others want assurance without the overhead. Both are legitimate.

For example, a hypothetical 80-person software company certified to ISO/IEC 27001 and adding ISO/IEC 42001 might find that its security lead owns most of the ISMS and that nobody else knows either standard. Outsourcing the core and the AI-specific audits, while training two engineering managers to audit each other's change and access processes, would give independent coverage at a lower cost than outsourcing everything.

Common mistakes in either model

• Choosing on cash cost alone and ending up with an internal audit that fails the impartiality test.
• Outsourcing and then disengaging. The organisation still owns the programme, the findings and the corrective actions. An external auditor cannot accept risk or close findings on your behalf.
• Buying a consultant's gap analysis and calling it an internal audit. A gap assessment against the standard is useful, but an internal audit tests whether the system you have is implemented and effective, with sampled evidence.
• Using the same external person who built the system. If a consultant wrote your procedures, they are not independent of them either.
• Training internal auditors and never letting them audit. Competence decays without practice.

Where Kellwick fits

We run independent ISO internal audits for ISO 9001, ISO/IEC 27001, ISO/IEC 42001 and integrated systems, either as the whole programme or as the independent component of a hybrid one. We work to the audit principles in ISO 19011. We are not a certification body, we do not issue certificates, and an internal audit is not a guarantee of any certification outcome. For quality systems specifically, our ISO 9001 internal audit page explains the scope in more detail.