A financial services company is preparing for its annual ISO 27001 certification audit of its cloud-hosted trading platform. The compliance manager wants an internal review conducted first to identify areas where current controls fall short of the standard's requirements before the external certification body arrives, so that remediation can occur in advance. Which audit activity best fits this objective?