# Certification Audit Explained: [Organization name] > Learning guide that explains, end to end, how accredited certification > to ISO/IEC 27001:2022 + Amd 1:2024 works: accreditation, choosing a > certification body (CB), audit time, Stage 1, Stage 2, findings, the > certification decision, the certificate, surveillance, recertification, > transfers, remote audits and what happens on audit days. It follows the > rules that ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 set for > certification bodies, written in plain words. Use it to brief top > management, process owners and interviewees before the first audit. > Replace every `[bracketed]` value and every row marked *Example*. ## Document control | Field | Value | |---|---| | Document ID | LRN-ISMS-07 | | Version | [1.0] | | Status | [Draft / Approved / Superseded] | | Owner | [@isms-manager] | | Approvers/reviewers | [@top-management-sponsor], [@internal-audit-lead] | | Last updated | YYYY-MM-DD | | Classification | [Internal] | | Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024; CB rules from ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 | | Certification body | [CB name], accredited by [accreditation body] | | ISMS scope reference | DOC-ISMS-002 [version] | | Audience | [Top management, ISMS team, process owners, interviewees] | | Next scheduled review | [Before each external audit, at least yearly] | ### Approvals | Role | Name | Decision | Date | |---|---|---|---| | ISMS manager | [@isms-manager] | [Prepared] | YYYY-MM-DD | | Top management sponsor | [@ceo] | [Approved for briefings] | YYYY-MM-DD | ### Revision history | Version | Date | Author | Change | |---|---|---|---| | 0.1 *(Example)* | 2027-02-01 | [@isms-manager] | First draft for the steering committee | | 1.0 *(Example)* | 2027-03-22 | [@isms-manager] | CB name, dates and briefing plan added after contract signature | | [x.y] | YYYY-MM-DD | [@author] | [Change] | ## Contents 1. The certification journey at a glance 2. Accreditation: why it matters 3. Choosing a certification body 4. Application, contract and audit time 5. Stage 1 audit 6. Stage 2 audit 7. Findings: how they are graded and answered 8. The certification decision and the certificate 9. Surveillance audits 10. Recertification 11. Transfers, special audits, suspension and withdrawal 12. Remote, multi-site and integrated audits 13. What to expect on audit days 14. Preparing your people 15. Size tiers 16. Common myths 17. Records and evidence 18. References ## 1. The certification journey at a glance Certification is a third-party confirmation that the organization's information security management system (ISMS) conforms to ISO/IEC 27001 for a defined scope. The organization builds and runs the ISMS; an independent certification body audits it; a person or committee at the CB who did not take part in the audit makes the certification decision. The certificate then lasts three years, with surveillance audits in between and a recertification audit before it expires. ```mermaid flowchart TD A["Decide to certify and define scope"] --> B["Choose an accredited CB"] B --> C["Application, audit time and contract"] C --> D["Stage 1: documentation and readiness"] D --> E{"Ready for Stage 2?"} E -- "No" --> F["Close areas of concern"] F --> D E -- "Yes" --> G["Stage 2: implementation and effectiveness"] G --> H["Findings answered: corrections and corrective actions"] H --> I["Independent certification decision by the CB"] I --> J["Certificate issued, three-year cycle starts"] J --> K["Surveillance audit year 1"] K --> L["Surveillance audit year 2"] L --> M["Recertification audit before expiry"] M --> J ``` Our certification at a glance: | Item | Value | |---|---| | Certification body | [CB name] *(Example: CB selected through DOC-ISMS-090)* | | Accreditation body | [name], member of the Global ACI MRA (formerly IAF MLA) | | Scope to appear on the certificate | [scope wording from DOC-ISMS-002] | | Statement of Applicability version | DOC-ISMS-011 [version] | | Stage 1 | YYYY-MM-DD | | Stage 2 | YYYY-MM-DD to YYYY-MM-DD | | Target decision date | YYYY-MM-DD | | ISMS contact for the CB | [@isms-manager] | ## 2. Accreditation: why it matters Accreditation is the check on the checkers. A national accreditation body assesses a certification body against ISO/IEC 17021-1 (general rules for bodies that certify management systems) and ISO/IEC 27006-1 (additional rules for ISMS certification, such as auditor competence and audit time). An accredited CB is itself audited regularly. Mutual recognition makes a certificate useful across borders. On 2026-01-01 the International Accreditation Forum (IAF) and the International Laboratory Accreditation Cooperation (ILAC) were replaced by Global Accreditation Cooperation Incorporated (Global ACI). The IAF Multilateral Recognition Arrangement (MLA) and the ILAC arrangement were replaced by a single Global ACI MRA. Existing recognition continues. The IAF mandatory documents used in this guide have been re-issued by Global ACI (IAF MD 1 as Global ACI-TECH-3-001, MD 2 as TECH-3-002, MD 4 as TECH-3-003 and MD 11 as TECH-3-008; version 1.0 issued 2026-07-10, in force 2026-08-28, as reported at the time of writing), and legacy IAF MLA marks remain usable by accreditation bodies and accredited CBs during the mark transition. Certified organizations generally may not use the IAF MLA or Global ACI MRA mark, only the CB's own mark under its rules (`isms/certification-mark-usage`). Check the current issue and status on the Global ACI and accreditation body websites. What to check: 1. The CB's accreditation certificate names ISO/IEC 27001 (an ISO 9001 accreditation alone is not enough). 2. The accreditation body is a signatory of the Global ACI MRA (formerly IAF MLA) for management system certification. 3. The accreditation covers the countries and, where relevant, the sectors in your scope. 4. Certificates the CB issues can be looked up in the accreditation body's register or in the CertSearch database that IAF set up and transferred to Global ACI (check its current address). Unaccredited certificates exist. They may be cheaper and faster, but they carry no independent assurance and many customer contracts, tenders and regulators do not accept them. ## 3. Choosing a certification body Choose the CB as a three-year relationship, not a one-off purchase. The selection template `isms/certification-body-selection` (DOC-ISMS-090) holds the full method. The main criteria: | Criterion | What good looks like | |---|---| | Accreditation | ISO/IEC 27001 accreditation from a Global ACI MRA signatory, covering your countries | | Sector and technology experience | Auditors who know cloud services, OT, health or finance, as your scope needs | | Audit time quote | Days calculated from ISO/IEC 27006-1 and explained, not a round number | | Three-year cost | Stage 1, Stage 2, two surveillances, travel, annual fees and the recertification compared side by side | | Languages and locations | Auditors who can interview your people in their working language at your sites | | Remote audit policy | Clear rules for remote and hybrid audits in line with IAF MD 4 (now Global ACI-TECH-3-003) | | Independence | No ISMS consultancy to you from the CB or a related body; ask how the CB manages independence and how long it waits after any past link | | Process and service | Clear certification rules, findings deadlines, appeal and complaint process, portal for submissions | Independence matters in both directions. A CB may not offer you ISMS consultancy, and a consultant who built your ISMS should not present themselves as linked to the CB. Training that is open to the public is not consultancy. ## 4. Application, contract and audit time The CB sends an application form. Expect questions on: - the scope you want certified, the sites and the activities at each; - the number of persons doing work under the organization's control within scope (employees, contractors and part-time staff, counted as the CB's rules require); - the IT environment, outsourced processes, cloud services and development activities; - legal and regulatory requirements that apply; - other certifications held, for integrated audits; - any use of consultants. **Audit time.** The CB calculates audit days from ISO/IEC 27006-1. The starting point is the number of persons in scope, then adjusted for business and IT complexity factors (for example, the criticality of information, the number of IT platforms, outsourcing and in-house development). The CB must document how it arrived at the number. Any day count you see in this library is an *Example*, not a rule. *Example*: Quillmere Analytics Ltd (46 persons in scope: 38 employees and 8 contractors) received a quote of 1.5 days for Stage 1 and 3.5 days for Stage 2, 5.0 days in total for initial certification (1.5 + 3.5 = 5.0). Stage 1 was held on 2027-04-12 and 2027-04-13 and Stage 2 from 2027-05-10 to 2027-05-12; `isms/isms-worked-walkthrough` follows the whole timeline. These figures illustrate a small SaaS company; your CB's calculation will differ. **Contract.** The certification agreement binds you to the CB's certification rules: access to records and people, notification of significant changes, rules for using the certificate and marks, fees, confidentiality and the appeal process. Read it before signing, in particular the findings deadlines and the cancellation terms. ## 5. Stage 1 audit Stage 1 tells both sides whether Stage 2 can go ahead. The CB auditor: - reviews the documented information the standard requires (scope, policy, risk assessment and treatment processes and results, SoA, objectives, competence evidence, monitoring results, audit programme and results, management review results, nonconformities and corrective actions); - confirms the scope, sites, processes and the persons in scope, and checks the audit time is still right; - checks that the internal audit and the management review have been planned and performed; - assesses your understanding of the requirements, the key risks and the controls in the SoA; - agrees the Stage 2 plan: dates, sites, people and the evidence to sample. Stage 1 is often partly on site, partly remote, depending on the CB and the scope. The auditor issues a Stage 1 report with areas of concern: items that could become nonconformities at Stage 2. Close them before Stage 2. The CB decides the interval between the two stages; it must leave time for you to act. Certification bodies usually expect one full internal audit of the ISMS and one management review before Stage 2 (CB practice, not a clause), and the ISMS to have run long enough to produce records. Build the plan around that. Use `isms/stage-1-readiness-pack` (DOC-ISMS-091) to assemble what the auditor will ask for. ## 6. Stage 2 audit Stage 2 evaluates implementation and effectiveness. The audit team follows the plan agreed at Stage 1 and looks for evidence that: - the clauses 4 to 10 processes run as described, with records; - risks are assessed and treated as the methodology says, and risk owners have approved the treatment plan and accepted residual risks; - the controls in the SoA operate, tested by sampling (for example, joiners and leavers, access reviews, backups and restore tests, vulnerability remediation, supplier reviews, incidents); - objectives are measured and performance is evaluated; - internal audit and management review produce actions that are followed up; - people know the policy, their role and how to report an event. Expect interviews with top management, the ISMS manager, process and control owners, and a few staff chosen by the auditor. Expect requests for live demonstrations ("show me the access review for the production cloud accounts"). Use `isms/stage-2-audit-evidence-index` (DOC-ISMS-092) to find each record within minutes. The audit ends with a closing meeting where the lead auditor presents the findings and the recommendation to the CB. The recommendation is not the decision. ## 7. Findings: how they are graded and answered | Grade | Plain meaning | What the CB needs before a decision | |---|---|---| | Major nonconformity | A serious gap: a whole process is missing or has broken down, or the gap is big enough that the auditor no longer trusts the ISMS to do its job | Correction, root cause and corrective action accepted, and implementation verified (document review or a follow-up visit, as the CB decides) | | Minor nonconformity | A requirement is not fully met in an isolated way that does not undermine the system | Correction and corrective action plan accepted; implementation checked at the next audit | | Observation or area of concern | A weakness that could become a nonconformity | No formal response required by most CBs; act on it anyway | | Opportunity for improvement | A suggestion | Your decision; record it | Grade names vary between CBs. The CB grades, not the auditee. If you disagree, discuss it at the closing meeting with evidence, then use the CB's documented clarification or appeal process. **Answering a nonconformity.** For each finding provide: 1. the correction (fix the instance found); 2. the extent check (how many other cases exist); 3. the root cause; 4. corrective actions that remove the cause, with owners and dates; 5. the effectiveness criterion; 6. evidence, with document versions and dates. The CB sets the deadlines. *Example*: 30 days for the plan and 90 days for evidence of major nonconformities, as set by the CB. A major nonconformity not closed within the CB's limit can mean repeating Stage 2. Track every finding in `isms/certification-findings-action-plan` (DOC-ISMS-093) and log it in `isms/audit-findings-register` (DOC-ISMS-086). ## 8. The certification decision and the certificate A person or committee at the CB who was not on the audit team reviews the audit report, the findings and your responses, then decides to grant, not grant or defer certification. No one can promise certification in advance, including consultants and the auditor. The certificate typically shows: - the organization's name and certified sites; - the scope (activities, products and services); - the standard and edition, ISO/IEC 27001:2022 (CBs may also reference the 2024 amendment); - a reference to the version of the Statement of Applicability; - the initial certification date, the issue date and the expiry date; - the accreditation body mark (where the CB is accredited for that scope) and a certificate number. Ask for a draft and check the scope wording, legal entity name and site addresses. Use of the certificate and marks follows the CB's rules: see `isms/certification-mark-usage` (DOC-ISMS-097). A certificate is never a product certification; do not put the mark on products or test reports. ## 9. Surveillance audits The certificate is maintained by surveillance audits at least once each calendar year, except in recertification years. The first surveillance after initial certification must take place no later than 12 months from the certification decision date. Surveillance audits are shorter than Stage 2 and cover a sample of the ISMS, but each one typically checks: - internal audits and the management review since the last audit; - actions on previous findings, including minor nonconformities from Stage 2; - complaints, incidents and changes to the scope, organization or technology; - the use of the certificate and marks; - progress on objectives and continual improvement; - a rotating set of controls, so that the whole SoA is covered across the cycle. Plan the cycle in `isms/certification-cycle-plan` (DOC-ISMS-094) and run `isms/surveillance-readiness-health-check` (DOC-ISMS-096) about eight weeks before each visit. ## 10. Recertification Before the certificate expires the CB performs a recertification audit, similar in depth to Stage 2. It reviews the ISMS's performance over the whole three-year period, the results of surveillance, and changes in context. Plan it and complete it, including closure of any major nonconformity and the new decision, before the expiry date. If the decision comes after expiry, the CB's rules define whether and how certification can be restored; continuity of the certificate dates is not guaranteed. Book the recertification audit with enough time for findings; *Example*: about three months before expiry. ## 11. Transfers, special audits, suspension and withdrawal **Transfer to another CB.** You may move an accredited certificate to another accredited CB during the cycle. IAF MD 2:2023 on the transfer of accredited certification of management systems, now re-issued by Global ACI as Global ACI-TECH-3-002 (check the current issue), describes the process: the receiving CB carries out a pre-transfer review of the certificate, the last audit reports, open findings, complaints and the reason for transfer. Certificates that are suspended, or that have open major nonconformities, are generally not transferable until resolved. **Special audits.** The CB can audit at short notice to extend the scope, to investigate a complaint or a serious incident, after major changes, or to follow up on a suspension. Tell the CB about significant changes (legal entity, ownership, scope, sites, key processes) as the agreement requires. Plan extensions with `isms/scope-extension-multisite-plan` (DOC-ISMS-095). **Suspension and withdrawal.** The CB can suspend a certificate when the ISMS persistently fails, when surveillance or recertification cannot be carried out on time, or when the organization asks. During suspension the certificate is temporarily invalid. If the issue is not resolved in the time the CB sets, the certificate is withdrawn or the scope is reduced. **Appeals and complaints.** Every accredited CB has a documented process for appeals against decisions and for complaints. Use it rather than arguing at the audit. ## 12. Remote, multi-site and integrated audits **Remote and hybrid audits.** Information and communication technology can be used for interviews, document review and screen-shared demonstrations. IAF MD 4:2025 on the use of ICT for conformity assessment (issue 3, applicable from 2026-01-30), now re-issued by Global ACI as Global ACI-TECH-3-003, sets the conditions: the CB assesses the risks, confirms that the technology and connection work, and plans on-site time where physical controls or processes need direct observation. Prepare a quiet room, a stable connection, screen sharing, and a way to show records without sending copies of sensitive data. Agree in advance what may be recorded. **Multi-site organizations.** Where several sites run the same ISMS, the CB may sample sites instead of visiting all of them each year. ISO/IEC 27006-1 and IAF MD 1:2023 on multi-site organizations, now re-issued by Global ACI as Global ACI-TECH-3-001, set the conditions: a central function that controls the ISMS, internal audits of every site, and a sampling plan. Sites that differ in activities or risk are not interchangeable. **Integrated audits.** If you hold other certificates with the same CB (ISO 9001, ISO 22301, ISO/IEC 20000-1, ISO/IEC 27701, ISO/IEC 42001), the audits can be combined. IAF MD 11:2023 on audits of integrated management systems, now re-issued by Global ACI as Global ACI-TECH-3-008, governs how audit time can be adjusted. Integration saves time when the shared processes (document control, internal audit, management review, corrective action) are genuinely shared. Check the current issue of each document on the Global ACI website before relying on it; references in contracts and CB rules may still use the IAF numbers. ## 13. What to expect on audit days A typical audit day follows the plan the CB sends in advance. | Time *(Example)* | Activity | Who attends | |---|---|---| | 09:00 | Opening meeting: scope, plan, method, confidentiality, finding grades | Top management, ISMS manager, guides | | 09:30 | Interviews and evidence review by process (for example, risk management, access control, supplier management) | Process owners, ISMS manager as guide | | 12:30 | Lunch; the auditor reviews notes | Auditor only | | 13:30 | Sampling and demonstrations (records pulled from live systems) | Control owners | | 16:00 | Auditor's private review time | Auditor only | | 16:30 | Daily debrief: issues so far, requests for tomorrow | ISMS manager | | Last day | Closing meeting: findings, grades, recommendation, next steps | Top management, ISMS manager, process owners | Guidance for interviewees: 1. Answer the question asked, with what you actually do. "I do not know, but I will find out who does" is a good answer. 2. Show records from the real system rather than describing them. 3. Do not offer documents that are not under control. 4. Never alter or create records during the audit to fill a gap. Report the gap to the ISMS manager; a correction made openly is better than a record that looks back-dated. 5. Ask for clarification if a question is unclear. The guide (usually the ISMS manager) keeps a log of requests and promised evidence, and makes sure everything is delivered before the debrief. ## 14. Preparing your people | Audience | Briefing content | When *(Example)* | Owner | |---|---|---|---| | Top management | Their role at opening and closing meetings, policy, objectives, management review decisions, resources | 4 weeks before Stage 1 | [@isms-manager] | | Process and control owners | Their procedures, records and where to find them, likely samples | 3 weeks before Stage 2 | [@isms-manager] | | All staff in scope | Policy, how to report a security event, their key responsibilities, interview etiquette | 2 weeks before Stage 2 | [@isms-manager] | | Guides | Plan, evidence index, request log, escalation | 1 week before each audit | [@isms-manager] | Hold a short mock interview for each process owner. Rehearse the record retrieval: an auditor who waits ten minutes for every sample loses confidence in the system. ## 15. Size tiers | Aspect | Small: Quillmere Analytics Ltd *(Example)* | Medium: Quillmere Health Systems *(Example)* | Large or multi-site: Quillmere Group *(Example)* | |---|---|---|---| | Profile | 46 staff (38 employees, 8 contractors), one office plus remote staff, SaaS on one public cloud in two regions | 320 staff, two offices and one colocation suite | 2,400 staff, 6 sites in 4 countries, OT and IT, ISO 9001 and ISO 22301 certified | | Target | Certificate in 6 months | ISO/IEC 27001 in 10 months, ISO/IEC 27701 the year after | Group certificate in 15 months, phased by site | | Audit format | Stage 1 largely remote, Stage 2 on site at the office plus remote cloud demonstrations | Stage 1 on site, Stage 2 at both offices and the colocation suite | Integrated audit with ISO 9001 and ISO 22301, site sampling under IAF MD 1 (Global ACI-TECH-3-001), OT sites visited in person | | Interviewees | Most of the leadership team and several engineers | Process owners, 3-person security team, colocation provider contacts | Site managers, CISO office, OT engineers, local interpreters where needed | | Coordination | Part-time ISMS manager (0.5 FTE) acts as the only guide | ISMS manager plus one guide per site | Central certification coordinator, a guide per site, daily cross-site debrief | | Main risk at Stage 2 | Records missing because one person holds many roles | Inconsistent practice between the two offices | Sites at different maturity; a weak site can affect the group certificate | ## 16. Common myths | Myth | Reality | |---|---| | "The consultant guarantees we will pass." | Only the accredited CB decides; nobody can guarantee the outcome. | | "All 93 Annex A controls must be implemented." | Controls are selected through risk treatment; excluded controls are justified in the SoA. | | "One nonconformity means failure." | Minor nonconformities are normal; majors must be closed and verified before the decision. | | "After the certificate we can relax." | Surveillance every year checks that the ISMS keeps working. | | "Remote audits are always allowed." | The CB decides under IAF MD 4 (Global ACI-TECH-3-003), after assessing feasibility and risk. | | "The certificate covers the whole company." | It covers only the scope written on it. | | "We need a 2013 certificate first." | The 2013 edition certificates expired at the end of the transition, 2025-10-31; certify to the 2022 edition. | ## 17. Records and evidence | Record | Owner | Where kept | Retention *(Example)* | |---|---|---|---| | CB selection and contract (DOC-ISMS-090) | [@isms-manager] | ISMS repository, contracts folder | Cycle plus 3 years | | Application form and audit time calculation from the CB | [@isms-manager] | ISMS repository | Cycle plus 3 years | | Stage 1 pack and report (DOC-ISMS-091) | [@isms-manager] | ISMS repository | Cycle plus 3 years | | Stage 2 evidence index and audit report (DOC-ISMS-092) | [@isms-manager] | ISMS repository | Cycle plus 3 years | | Findings action plan and CB acceptance (DOC-ISMS-093) | [@isms-manager] | ISMS repository | Cycle plus 3 years | | Certificate and certification decision letter | [@isms-manager] | ISMS repository, legal | Validity plus 3 years | | Briefing attendance (section 14) | [@isms-manager] | Training records (DOC-ISMS-026) | 3 years | | Mark usage approvals (DOC-ISMS-097) | [@marketing-lead] | Marketing repository | Validity plus 1 year | Map these records to clauses and controls in `isms/control-evidence-matrix` (DOC-ISMS-033) and list them in `isms/isms-documented-information-register` (DOC-ISMS-028). ## 18. References | Reference | Edition and link | Use | |---|---|---| | ISO/IEC 27001:2022 + Amd 1:2024 | https://www.iso.org/standard/82875.html ; Amd 1: https://www.iso.org/standard/88435.html | Requirements being certified | | ISO/IEC 17021-1:2015 | https://www.iso.org/standard/61651.html | Rules for CBs: stages, surveillance, recertification, decisions | | ISO/IEC 27006-1:2024 | https://www.iso.org/standard/82908.html | ISMS-specific CB rules: audit time, competence, multi-site | | ISO/IEC 27007:2020 | https://www.iso.org/standard/77802.html | ISMS auditing guidance (under revision; check for a newer edition) | | ISO 19011:2026 | https://www.iso.org/standard/88984.html | Guidance on auditing management systems | | IAF MD 1:2023, MD 2:2023, MD 4:2025, MD 11:2023, re-issued as Global ACI-TECH-3-001, -002, -003 and -008 | Global ACI v1.0 issued 2026-07-10, in force 2026-08-28; check the current issue | Multi-site, transfer, ICT in audits, integrated audits | | Global ACI MRA (formerly IAF MLA) | Global ACI and accreditation body websites | Recognition of accredited certificates | Related templates: `isms/certification-body-selection` (DOC-ISMS-090), `isms/stage-1-readiness-pack` (DOC-ISMS-091), `isms/stage-2-audit-evidence-index` (DOC-ISMS-092), `isms/certification-findings-action-plan` (DOC-ISMS-093), `isms/certification-cycle-plan` (DOC-ISMS-094), `isms/scope-extension-multisite-plan` (DOC-ISMS-095), `isms/surveillance-readiness-health-check` (DOC-ISMS-096), `isms/certification-mark-usage` (DOC-ISMS-097), `isms/audit-findings-register` (DOC-ISMS-086), `isms/isms-worked-walkthrough` (LRN-ISMS-09). ## Standard and licence note Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 and with the certification process that ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 set for certification bodies. The explanations, tables and examples are original. No ISO or IEC text is reproduced; read the official standards (purchase or licensed access from ISO, IEC or your national standards body), the current IAF or Global ACI documents and your certification body's rules before relying on any statement here. Check the current edition of each standard before use. Certification decisions are made only by the accredited certification body. This is a learning guide, not certification or legal advice. Template licence: MIT.