Internal audit programme
Annual full-scope audits by evidence sampling — with the honest statement that a single-operator company cannot satisfy the auditor-independence requirement internally and must engage an external auditor.
What this policy commits us to
- Openly recorded as not yet met: no internal audit has been conducted, and a founder self-audit is explicitly rejected as inadmissible.
- Audits test both the standard and First Six's own public claims — HECVAT answers, Statement of Applicability statuses, risk-register closures.
- For every automated control, the auditor confirms it genuinely executed recently, not merely that it reported green.
- Findings close only on evidence at a later management review, never on the auditor's say-so.
Need the detail behind this page?
Request access and we can share the full policy set, assessment reports, and completed questionnaires under NDA — or answer your security questionnaire directly.