Keep The scope restricted, make use of a documentation toolkit instead of a expert, operate the internal audit and management assessment by yourself, and only increase a GRC platform Should your proof quantity justifies it. As an ISO 27001 Guide Auditor, my tips is straightforward: help save your money to waiting for link from Web 2.0 Profiles (2)