ISO/IEC 27001 Certification Audit Explained Template

Certification Audit Explained: [Organization name]

Learning guide that explains, end to end, how accredited certification to ISO/IEC 27001:2022 + Amd 1:2024 works: accreditation, choosing a certification body (CB), audit time, Stage 1, Stage 2, findings, the certification decision, the certificate, surveillance, recertification, transfers, remote audits and what happens on audit days. It follows the rules that ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 set for certification bodies, written in plain words. Use it to brief top management, process owners and interviewees before the first audit. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. The certification journey at a glance
2. Accreditation: why it matters
3. Choosing a certification body
4. Application, contract and audit time
5. Stage 1 audit
6. Stage 2 audit
7. Findings: how they are graded and answered
8. The certification decision and the certificate
9. Surveillance audits
10. Recertification
11. Transfers, special audits, suspension and withdrawal
12. Remote, multi-site and integrated audits
13. What to expect on audit days
14. Preparing your people
15. Size tiers
16. Common myths
17. Records and evidence
18. References

1. The certification journey at a glance

Certification is a third-party confirmation that the organization's information security management system (ISMS) conforms to ISO/IEC 27001 for a defined scope. The organization builds and runs the ISMS; an independent certification body audits it; a person or committee at the CB who did not take part in the audit makes the certification decision. The certificate then lasts three years, with surveillance audits in between and a recertification audit before it expires.

Our certification at a glance:

2. Accreditation: why it matters

Accreditation is the check on the checkers. A national accreditation body assesses a certification body against ISO/IEC 17021-1 (general rules for bodies that certify management systems) and ISO/IEC 27006-1 (additional rules for ISMS certification, such as auditor competence and audit time). An accredited CB is itself audited regularly.

Mutual recognition makes a certificate useful across borders. On 2026-01-01 the International Accreditation Forum (IAF) and the International Laboratory Accreditation Cooperation (ILAC) were replaced by Global Accreditation Cooperation Incorporated (Global ACI). The IAF Multilateral Recognition Arrangement (MLA) and the ILAC arrangement were replaced by a single Global ACI MRA. Existing recognition continues. The IAF mandatory documents used in this guide have been re-issued by Global ACI (IAF MD 1 as Global ACI-TECH-3-001, MD 2 as TECH-3-002, MD 4 as TECH-3-003 and MD 11 as TECH-3-008; version 1.0 issued 2026-07-10, in force 2026-08-28, as reported at the time of writing), and legacy IAF MLA marks remain usable by accreditation bodies and accredited CBs during the mark transition. Certified organizations generally may not use the IAF MLA or Global ACI MRA mark, only the CB's own mark under its rules (isms/certification-mark-usage). Check the current issue and status on the Global ACI and accreditation body websites.

What to check:

1. The CB's accreditation certificate names ISO/IEC 27001 (an ISO 9001 accreditation alone is not enough).
2. The accreditation body is a signatory of the Global ACI MRA (formerly IAF MLA) for management system certification.
3. The accreditation covers the countries and, where relevant, the sectors in your scope.
4. Certificates the CB issues can be looked up in the accreditation body's register or in the CertSearch database that IAF set up and transferred to Global ACI (check its current address).

Unaccredited certificates exist. They may be cheaper and faster, but they carry no independent assurance and many customer contracts, tenders and regulators do not accept them.

3. Choosing a certification body

Choose the CB as a three-year relationship, not a one-off purchase. The selection template isms/certification-body-selection (DOC-ISMS-090) holds the full method. The main criteria:

Independence matters in both directions. A CB may not offer you ISMS consultancy, and a consultant who built your ISMS should not present themselves as linked to the CB. Training that is open to the public is not consultancy.

4. Application, contract and audit time

The CB sends an application form. Expect questions on:

• the scope you want certified, the sites and the activities at each;
• the number of persons doing work under the organization's control within scope (employees, contractors and part-time staff, counted as the CB's rules require);
• the IT environment, outsourced processes, cloud services and development activities;
• legal and regulatory requirements that apply;
• other certifications held, for integrated audits;
• any use of consultants.

Audit time. The CB calculates audit days from ISO/IEC 27006-1. The starting point is the number of persons in scope, then adjusted for business and IT complexity factors (for example, the criticality of information, the number of IT platforms, outsourcing and in-house development). The CB must document how it arrived at the number. Any day count you see in this library is an Example, not a rule.

Example: Quillmere Analytics Ltd (46 persons in scope: 38 employees and 8 contractors) received a quote of 1.5 days for Stage 1 and 3.5 days for Stage 2, 5.0 days in total for initial certification (1.5 + 3.5 = 5.0). Stage 1 was held on 2027-04-12 and 2027-04-13 and Stage 2 from 2027-05-10 to 2027-05-12; isms/isms-worked-walkthrough follows the whole timeline. These figures illustrate a small SaaS company; your CB's calculation will differ.

Contract. The certification agreement binds you to the CB's certification rules: access to records and people, notification of significant changes, rules for using the certificate and marks, fees, confidentiality and the appeal process. Read it before signing, in particular the findings deadlines and the cancellation terms.

5. Stage 1 audit

Stage 1 tells both sides whether Stage 2 can go ahead. The CB auditor:

• reviews the documented information the standard requires (scope, policy, risk assessment and treatment processes and results, SoA, objectives, competence evidence, monitoring results, audit programme and results, management review results, nonconformities and corrective actions);
• confirms the scope, sites, processes and the persons in scope, and checks the audit time is still right;
• checks that the internal audit and the management review have been planned and performed;
• assesses your understanding of the requirements, the key risks and the controls in the SoA;
• agrees the Stage 2 plan: dates, sites, people and the evidence to sample.

Stage 1 is often partly on site, partly remote, depending on the CB and the scope. The auditor issues a Stage 1 report with areas of concern: items that could become nonconformities at Stage 2. Close them before Stage 2. The CB decides the interval between the two stages; it must leave time for you to act.

Certification bodies usually expect one full internal audit of the ISMS and one management review before Stage 2 (CB practice, not a clause), and the ISMS to have run long enough to produce records. Build the plan around that. Use isms/stage-1-readiness-pack (DOC-ISMS-091) to assemble what the auditor will ask for.

6. Stage 2 audit

Stage 2 evaluates implementation and effectiveness. The audit team follows the plan agreed at Stage 1 and looks for evidence that:

• the clauses 4 to 10 processes run as described, with records;
• risks are assessed and treated as the methodology says, and risk owners have approved the treatment plan and accepted residual risks;
• the controls in the SoA operate, tested by sampling (for example, joiners and leavers, access reviews, backups and restore tests, vulnerability remediation, supplier reviews, incidents);
• objectives are measured and performance is evaluated;
• internal audit and management review produce actions that are followed up;
• people know the policy, their role and how to report an event.

Expect interviews with top management, the ISMS manager, process and control owners, and a few staff chosen by the auditor. Expect requests for live demonstrations ("show me the access review for the production cloud accounts"). Use isms/stage-2-audit-evidence-index (DOC-ISMS-092) to find each record within minutes.

The audit ends with a closing meeting where the lead auditor presents the findings and the recommendation to the CB. The recommendation is not the decision.

7. Findings: how they are graded and answered

Grade names vary between CBs. The CB grades, not the auditee. If you disagree, discuss it at the closing meeting with evidence, then use the CB's documented clarification or appeal process.

Answering a nonconformity. For each finding provide:

1. the correction (fix the instance found);
2. the extent check (how many other cases exist);
3. the root cause;
4. corrective actions that remove the cause, with owners and dates;
5. the effectiveness criterion;
6. evidence, with document versions and dates.

The CB sets the deadlines. Example: 30 days for the plan and 90 days for evidence of major nonconformities, as set by the CB. A major nonconformity not closed within the CB's limit can mean repeating Stage 2. Track every finding in isms/certification-findings-action-plan (DOC-ISMS-093) and log it in isms/audit-findings-register (DOC-ISMS-086).

8. The certification decision and the certificate

A person or committee at the CB who was not on the audit team reviews the audit report, the findings and your responses, then decides to grant, not grant or defer certification. No one can promise certification in advance, including consultants and the auditor.

The certificate typically shows:

• the organization's name and certified sites;
• the scope (activities, products and services);
• the standard and edition, ISO/IEC 27001:2022 (CBs may also reference the 2024 amendment);
• a reference to the version of the Statement of Applicability;
• the initial certification date, the issue date and the expiry date;
• the accreditation body mark (where the CB is accredited for that scope) and a certificate number.

Ask for a draft and check the scope wording, legal entity name and site addresses. Use of the certificate and marks follows the CB's rules: see isms/certification-mark-usage (DOC-ISMS-097). A certificate is never a product certification; do not put the mark on products or test reports.

9. Surveillance audits

The certificate is maintained by surveillance audits at least once each calendar year, except in recertification years. The first surveillance after initial certification must take place no later than 12 months from the certification decision date. Surveillance audits are shorter than Stage 2 and cover a sample of the ISMS, but each one typically checks:

• internal audits and the management review since the last audit;
• actions on previous findings, including minor nonconformities from Stage 2;
• complaints, incidents and changes to the scope, organization or technology;
• the use of the certificate and marks;
• progress on objectives and continual improvement;
• a rotating set of controls, so that the whole SoA is covered across the cycle.

Plan the cycle in isms/certification-cycle-plan (DOC-ISMS-094) and run isms/surveillance-readiness-health-check (DOC-ISMS-096) about eight weeks before each visit.

10. Recertification

Before the certificate expires the CB performs a recertification audit, similar in depth to Stage 2. It reviews the ISMS's performance over the whole three-year period, the results of surveillance, and changes in context. Plan it and complete it, including closure of any major nonconformity and the new decision, before the expiry date. If the decision comes after expiry, the CB's rules define whether and how certification can be restored; continuity of the certificate dates is not guaranteed. Book the recertification audit with enough time for findings; Example: about three months before expiry.

11. Transfers, special audits, suspension and withdrawal

Transfer to another CB. You may move an accredited certificate to another accredited CB during the cycle. IAF MD 2:2023 on the transfer of accredited certification of management systems, now re-issued by Global ACI as Global ACI-TECH-3-002 (check the current issue), describes the process: the receiving CB carries out a pre-transfer review of the certificate, the last audit reports, open findings, complaints and the reason for transfer. Certificates that are suspended, or that have open major nonconformities, are generally not transferable until resolved.

Special audits. The CB can audit at short notice to extend the scope, to investigate a complaint or a serious incident, after major changes, or to follow up on a suspension. Tell the CB about significant changes (legal entity, ownership, scope, sites, key processes) as the agreement requires. Plan extensions with isms/scope-extension-multisite-plan (DOC-ISMS-095).

Suspension and withdrawal. The CB can suspend a certificate when the ISMS persistently fails, when surveillance or recertification cannot be carried out on time, or when the organization asks. During suspension the certificate is temporarily invalid. If the issue is not resolved in the time the CB sets, the certificate is withdrawn or the scope is reduced.

Appeals and complaints. Every accredited CB has a documented process for appeals against decisions and for complaints. Use it rather than arguing at the audit.

12. Remote, multi-site and integrated audits

Remote and hybrid audits. Information and communication technology can be used for interviews, document review and screen-shared demonstrations. IAF MD 4:2025 on the use of ICT for conformity assessment (issue 3, applicable from 2026-01-30), now re-issued by Global ACI as Global ACI-TECH-3-003, sets the conditions: the CB assesses the risks, confirms that the technology and connection work, and plans on-site time where physical controls or processes need direct observation. Prepare a quiet room, a stable connection, screen sharing, and a way to show records without sending copies of sensitive data. Agree in advance what may be recorded.

Multi-site organizations. Where several sites run the same ISMS, the CB may sample sites instead of visiting all of them each year. ISO/IEC 27006-1 and IAF MD 1:2023 on multi-site organizations, now re-issued by Global ACI as Global ACI-TECH-3-001, set the conditions: a central function that controls the ISMS, internal audits of every site, and a sampling plan. Sites that differ in activities or risk are not interchangeable.

Integrated audits. If you hold other certificates with the same CB (ISO 9001, ISO 22301, ISO/IEC 20000-1, ISO/IEC 27701, ISO/IEC 42001), the audits can be combined. IAF MD 11:2023 on audits of integrated management systems, now re-issued by Global ACI as Global ACI-TECH-3-008, governs how audit time can be adjusted. Integration saves time when the shared processes (document control, internal audit, management review, corrective action) are genuinely shared.

Check the current issue of each document on the Global ACI website before relying on it; references in contracts and CB rules may still use the IAF numbers.

13. What to expect on audit days

A typical audit day follows the plan the CB sends in advance.

Guidance for interviewees:

1. Answer the question asked, with what you actually do. "I do not know, but I will find out who does" is a good answer.
2. Show records from the real system rather than describing them.
3. Do not offer documents that are not under control.
4. Never alter or create records during the audit to fill a gap. Report the gap to the ISMS manager; a correction made openly is better than a record that looks back-dated.
5. Ask for clarification if a question is unclear.

The guide (usually the ISMS manager) keeps a log of requests and promised evidence, and makes sure everything is delivered before the debrief.

14. Preparing your people

Hold a short mock interview for each process owner. Rehearse the record retrieval: an auditor who waits ten minutes for every sample loses confidence in the system.

15. Size tiers

16. Common myths

17. Records and evidence

Map these records to clauses and controls in isms/control-evidence-matrix (DOC-ISMS-033) and list them in isms/isms-documented-information-register (DOC-ISMS-028).

18. References

Related templates: isms/certification-body-selection (DOC-ISMS-090), isms/stage-1-readiness-pack (DOC-ISMS-091), isms/stage-2-audit-evidence-index (DOC-ISMS-092), isms/certification-findings-action-plan (DOC-ISMS-093), isms/certification-cycle-plan (DOC-ISMS-094), isms/scope-extension-multisite-plan (DOC-ISMS-095), isms/surveillance-readiness-health-check (DOC-ISMS-096), isms/certification-mark-usage (DOC-ISMS-097), isms/audit-findings-register (DOC-ISMS-086), isms/isms-worked-walkthrough (LRN-ISMS-09).

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 and with the certification process that ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 set for certification bodies. The explanations, tables and examples are original. No ISO or IEC text is reproduced; read the official standards (purchase or licensed access from ISO, IEC or your national standards body), the current IAF or Global ACI documents and your certification body's rules before relying on any statement here. Check the current edition of each standard before use. Certification decisions are made only by the accredited certification body. This is a learning guide, not certification or legal advice. Template licence: MIT.