What Happens During an ISO 27001 Audit? A Practical Guide to Your First Certification

If you're approaching your first ISO 27001 certification audit, there's a good chance you're wondering how the day will unfold.

Who will the auditor speak to? What evidence will they ask for? Will they want to inspect your systems? And what happens if they discover something you've overlooked?

These are reasonable questions, particularly if you've spent months developing your Information Security Management System (ISMS) and are now preparing to have it independently assessed.

The good news is that the process is fairly structured. You'll know the scope of the assessment, you'll receive an audit plan, and you'll have opportunities to explain how your organisation manages information security.

There can still be challenging questions and unexpected findings, of course. Understanding how the assessment works makes those situations much easier to handle.

Understanding the certification process

For an organisation seeking ISO 27001 certification for the first time, the external assessment is divided into two stages.

Stage 1 examines your ISMS documentation and readiness for certification. Stage 2 goes further, evaluating how the management system has been implemented and whether it operates effectively.

In the UK, organisations commonly choose a certification body accredited by the United Kingdom Accreditation Service (UKAS). It's worth checking the certification body's accreditation and scope before engaging them.

The certification auditor is independent of your organisation. Their responsibility is to assess conformity with the standard and report their findings objectively.

Stage 1: Reviewing your ISMS and readiness

Stage 1 is where the auditor develops an understanding of your organisation, its activities and the management system you've established.

Much of this involves reviewing documented information, including:

• The scope of your ISMS and the information, systems and activities it covers

• Your approach to assessing and treating information security risks

• The Statement of Applicability (SoA), including which Annex A controls you've selected and why

• Information security policies, objectives and responsibilities

• Arrangements for internal audits, management reviews and ongoing improvement

The auditor will also consider whether your organisation is sufficiently prepared to proceed to Stage 2.

You may be asked to explain decisions made during implementation. For example, why certain activities fall within your ISMS scope, how risk acceptance criteria were established, or how you decided which controls were necessary.

These conversations are useful because they can expose inconsistencies that weren't obvious when individual documents were being prepared.

If your risk assessment identifies a particular threat, for instance, the auditor may expect to see how that risk has been addressed through your treatment plan and reflected in the SoA.

At the end of Stage 1, you'll receive feedback on your readiness and any areas of concern that need attention.

Significant issues may require additional work before Stage 2 can proceed. The interval between the two assessments should allow enough time to address the findings and will be agreed with your certification body.

Stage 2: Putting the management system to the test

Stage 2 is generally the more substantial assessment.

By this point, the auditor understands what your organisation says it does. The next task is to establish whether those arrangements have been implemented and are effective.

The audit normally begins with an opening meeting to confirm the assessment scope, timetable and practical arrangements. The auditor then works through the audit plan, speaking with relevant staff and examining selected evidence.

Depending on your organisation and the agreed audit arrangements, this might include interviews, system demonstrations, document reviews, physical site inspections and remote assessment activities.

One important point is that auditors work by sampling. They cannot examine every transaction, account, supplier or security event, so they'll select examples that help them evaluate how reliably your processes operate.

Consider a straightforward example: employee access management.

Your policy may state that access is removed promptly when someone leaves the organisation.

An auditor could ask to see the leavers procedure, select a recent departure and request evidence showing when the employee left, when IT was notified and when their accounts were disabled.

If everything happened as expected, the records help demonstrate that the process is working.

If there was a delay, the auditor may explore why it happened, whether the organisation identified the issue and what action followed.

That last part matters. An organisation should be capable of identifying and addressing weaknesses in its own arrangements.

The same approach can be applied to supplier assessments, security awareness training, incident management, vulnerability management and other activities within your ISMS.

Will staff be interviewed?

Potentially, yes. The auditor may speak with employees outside the IT or information security teams. We regularly see 5 employees as a number for standard employees picked for the auditor to speak to.

The questions will depend on their responsibilities.

Someone in HR might be asked how new starters are introduced to information security requirements or how departures are communicated to IT.

A manager might be asked how they approve access to sensitive information.

An employee might be asked how they would report a suspected phishing email or a lost device.

Where physical security is relevant, the auditor may also examine visitor management, office access and arrangements for securing information.

Staff don't need to memorise the wording of every policy. They should understand the procedures relevant to their roles and know where to find guidance when they need it.

I would avoid coaching employees to deliver prepared answers. It's far more useful to make sure they understand their responsibilities and can describe how things work in practice.

If someone doesn't know an answer, it's perfectly reasonable for them to say so and explain who they would contact for assistance.

What are auditors looking for?

ISO 27001 places considerable emphasis on the management of information security risks and the effectiveness of the ISMS.

An auditor will therefore be interested in how your organisation makes security decisions, puts controls into operation and evaluates whether those arrangements remain suitable.

Your documentation is part of that evidence, but it needs to be supported by operational records and the knowledge of the people responsible for the processes.

The auditor will also examine the management system itself.

Have internal audits been completed? Has senior management reviewed the ISMS? Are information security objectives being monitored? When problems have been identified, has appropriate corrective action been taken?

These requirements sometimes receive less attention than technical security controls during implementation, despite being fundamental to certification.

It's also worth remembering that ISO 27001 does not require every Annex A control to be implemented automatically. Your risk assessment and treatment decisions, together with applicable requirements, should determine which controls are necessary. Exclusions need to be justified in your Statement of Applicability.

What happens if the auditor identifies a problem?

An audit finding doesn't necessarily prevent certification, although its significance matters.

Auditors distinguish between minor and major nonconformities.

Minor nonconformities concern failures to meet a requirement that do not undermine the management system's ability to achieve its intended results.

For example, a particular review might have been missed despite an otherwise established and functioning process.

Major nonconformities are more significant. They affect the management system's ability to achieve its intended results and may indicate that an important requirement or process has not been effectively implemented.

A systemic failure in risk assessment or a serious breakdown in the operation of security controls could lead to a major finding.

The classification depends on the circumstances and supporting evidence. Several related minor issues may also indicate a wider problem.

For initial certification, the certification body must review, accept and verify the correction and corrective action associated with major nonconformities before granting certification.

For minor nonconformities, the certification body must review and accept an appropriate plan for correction and corrective action.

The specific deadlines and follow-up arrangements will be explained by your certification body.

You'll normally have the opportunity to discuss findings during the audit and at the closing meeting, where the auditor explains the conclusions and next steps.

One distinction worth understanding is that the auditor's recommendation and the formal certification decision are separate. The certification body makes that decision following its review of the audit results.

How long does certification take?

There isn't a particularly useful single answer to this because organisations vary considerably.

The time allocated to the certification audits depends on factors including the size of the organisation, its activities, the complexity of the ISMS, the number of locations and the scope being assessed.

Stage 1 may be relatively short for a smaller organisation, while Stage 2 can require several auditor days. More complex organisations will generally need longer assessments.

The preparation period is equally variable.

An organisation with mature risk management, established security processes and reliable records may be much closer to certification than one building its arrangements from scratch.

If you're planning a certification project, ask your certification body for an audit programme and allow time for internal auditing, management review and any necessary corrective actions.

Preparing for the audit

My advice would be to focus your final preparation on how well you can demonstrate that the ISMS operates.

Start by selecting a few processes and following them through using genuine records.

Take a recent supplier assessment, for example. Can you identify who completed it, what risks were considered, who approved the supplier and whether any outstanding actions were followed up?

Do the same with an employee departure, an access review or a security incident.

This exercise often reveals practical issues that reviewing policies alone won't uncover.

Before the audit, I would also recommend:

• Completing your internal audit programme. Make sure identified findings have been addressed appropriately and that the results are available for review.
  

• Holding and documenting management review. Senior management should be able to demonstrate its involvement in the ISMS and the decisions made.
  

• Checking that evidence is accessible. You don't want to spend valuable audit time searching through folders for records that should be readily available.
  

• Preparing the people involved. Make sure relevant employees know when they may be needed and understand the processes they're responsible for.
  

• Reviewing outstanding actions and risks. Be ready to explain their status, the decisions taken and the arrangements for managing them.

You may still discover gaps during this exercise. Address what you can, record what remains outstanding and make sure any associated risks are understood.

Where an issue is known, being able to explain how it is being managed is considerably more useful than hoping nobody asks about it.

What happens after certification?

Achieving certification is an important milestone, but your organisation will need to continue maintaining and improving its ISMS.

Certification normally follows a three-year cycle, with surveillance audits typically carried out annually and recertification taking place before the certificate expires.

Surveillance audits are generally more focused than the initial assessment. They examine selected elements of the ISMS alongside matters such as internal audits, management review, changes to the organisation and the handling of previous findings.

A well-maintained ISMS makes these assessments more manageable because the records and evidence are generated through ordinary business activities.

Where an organisation has allowed its processes to lapse since certification, surveillance can expose those weaknesses.

A final thought

The most useful preparation for an ISO 27001 audit happens throughout the year.

It's in the access reviews that are completed on time, the security incidents that are investigated properly, the risks that are revisited when circumstances change and the management decisions that are recorded.

By the time the auditor arrives, you should already have a reasonable understanding of how effectively your ISMS is operating.

There may be findings. There may be questions that require further investigation. Neither should come as a complete surprise if you've been reviewing your arrangements regularly.

And if the audit identifies a weakness you hadn't recognised, use that information.

Improving the way your organisation manages information security is, after all, why the management system exists.

Jeff Pullen, CISSP, CCSP

Information Security Consultant

Kafico