Audit plan
Scope, criteria, timetable, and a pre-audit list of the evidence needed.
Services / Internal & GAP audits
Internal & GAP audit for ISO 27001 and ISO 9001
Audits are performed in line with ISO 19011, with lead auditor training in ISO/IEC 27001 and ISO 9001, backed by hands-on IT, information security, and quality-management experience.
ISO 19011ISO 27001Evidence-basedRisk-basedPractical recommendations
ISO 19011ISO 27001CCSKInternal & GAP
ISO Internal & GAP Audits
What you receive from the audit
A clear process, traceable evidence, and output that can support real improvement.
Traceable findings
Each finding is linked to a criterion, evidence, and risk assessment.
Practical priorities
Clear recommendations and corrective-action guidance for the real context.
Final report
A structured outcome for management and the people responsible for the system.
About us
Business Key Consult
ISO 19011ISO 27001ISO 9001CCSK
Business Key Consult delivers internal and GAP audits with a consulting nature, with a primary focus on ISO/IEC 27001 and complementary work across ISO 9001 and related standards.
Audit services follow ISO 19011 and are delivered from Sofia, Bulgaria, backed by hands-on experience in IT, cybersecurity, IAM, and cloud environments.
Audit expertise
Our team has 6+ years of hands-on experience across cybersecurity and IT, including participation in internal and external audits of management systems.
Publicly stated credentials include ISO 19011 audit methodology, ISO/IEC 27001 and ISO 9001 lead auditor training, and CCSK cloud-security knowledge.
We combine:
- ISO 19011 audit methodology
- real technical and operational experience
- deep understanding of business processes
This approach allows us to assess not only formal compliance, but the real effectiveness of controls and processes.
Standards and frameworks
Audits and assessments are performed against:
- ISO/IEC 27001:2022 – Information Security Management Systems
- ISO 9001:2015 – Quality Management Systems
- ISO/IEC 27701 – Privacy Information Management (GDPR readiness)
- ISO/IEC 27017 – Cloud security controls
- ISO/IEC 27018 – Protection of PII in public clouds
Our audit approach is aligned to your context and applicable requirements.
Cloud & technology expertise
Business Key Consult holds CCSK (Certificate of Cloud Security Knowledge) by Cloud Security Alliance, confirming deep knowledge in cloud security.
This enables audits and assessments in public and hybrid cloud environments, focusing on:
- shared responsibility model
- supplier management
- data and privacy protection
- cloud-specific risks
CCSK complements our ISO/IEC 27017 and ISO/IEC 27018 audit capability.
Industry experience
We have practical experience with organisations across:
- IT & software companies
- SaaS & cloud-based services
- BPO & outsourcing
- fintech & tech startups
- corporate & international organisations
This helps us apply an audit approach tailored to your environment and risk profile.
Client approach
We work closely with clients while remaining professional, independent, and confidential.
We focus on:
- clear communication
- process transparency
- practical recommendations
- minimal operational impact
Audits are delivered 100% remotely, without compromising quality or objectivity.
Independence & ethics
All audit activities follow the principles of:
- independence
- objectivity
- confidentiality
Audits are internal/GAP in nature with a consulting orientation and are not certification audits or certification body activities.
Why Business Key Consult
- ISO 19011 audit methodology
- 6+ years of hands-on IT & cybersecurity experience
- ISO 19011-aligned audits
- Expertise across ISO/IEC 27001, ISO 9001, ISO/IEC 27701, ISO/IEC 27017 and ISO/IEC 27018
- CCSK cloud certification
- 100% remote audit model
- Focus on practical value and effectiveness
Important note
These are internal and GAP audits with a consulting nature and do not represent a certification audit or the activity of a certification body.