Preparing your ISO 27001 certification audit: the practical guide

You have built your ISMS, your controls are in place and your Statement of Applicability is ready: it is time for the audit. This moment often worries teams, yet it can be prepared very well. Here is how to approach it calmly.

How certification works

1. Choosing an accredited certification body. Check its accreditation for ISO/IEC 27001 by a national accreditation body that signed the European and international recognition agreements (COFRAC in France). Compare quotes on the number of audit days, which depends mainly on your headcount and the complexity of the scope.
2. Stage 1 audit: review of documentation and readiness.
3. Stage 2 audit: verification of the implementation and effectiveness of the ISMS.
4. Certification decision and a certificate valid for three years.
5. Surveillance audits in the first and second years, then recertification in the third year.

Before contacting the body

Check that:

• the scope is stable and described (sites, activities, systems, interfaces);
• the ISMS has been running for a few months, so you have operating evidence (access reviews, tested backups, handled incidents);
• a full internal audit has been carried out and its findings handled or planned;
• a management review has taken place and its decisions are recorded;
• the Statement of Applicability is approved and consistent with the risk treatment plan.

Expected documented information

The standard requires, in particular, keeping or maintaining:

• the ISMS scope (4.3);
• the information security policy (5.2);
• the risk assessment and treatment processes (6.1.2 and 6.1.3) and the Statement of Applicability;
• the security objectives (6.2);
• evidence of competence (7.2);
• the results of risk assessment and treatment (8.2 and 8.3);
• monitoring and measurement results (9.1);
• the internal audit programme and results (9.2);
• the results of the management review (9.3);
• nonconformities and corrective actions (10.2).

On top of that come the documents you decided were necessary: topic-specific policies, procedures, records of the Annex A controls.

Stage 1: the documentation review

The auditor checks that your system is complete and consistent, and that you are ready for stage 2. They may raise “areas of concern” to address before the next stage. Tips:

• share a clear, up-to-date file rather than a scattered folder tree;
• prepare a short presentation of the context, scope and risk method;
• check the consistency between risk assessment, treatment plan and Statement of Applicability: it is the first thing checked.

Stage 2: the implementation audit

The auditor interviews people, observes practices and samples evidence. They may ask for: the last access review, a change ticket, a restore test report, the incident register, proof of awareness training, a supplier contract with its security clauses.

Findings can be major nonconformities (requirement not met, systemic failure), minor nonconformities, observations or opportunities for improvement. A major nonconformity blocks certification until it is resolved.

Handling nonconformities

For each gap, present within the deadline set by the body:

1. the immediate correction;
2. the root cause analysis (for example the 5 whys);
3. the corrective action plan, with owners and deadlines;
4. in due course, evidence of the effectiveness of the actions.

After certification

The ISMS must keep running: internal audits, annual management review, risk updates, action follow-up. Surveillance audits check precisely that continuity.

Your D-30 checklist

• Statement of Applicability approved and up to date
• Risk treatment plan approved by the risk owners
• Internal audit completed, findings followed up
• Management review held and minutes available
• Recent evidence for the key controls (access, backups, vulnerabilities, incidents, training)
• Contacts identified and available on audit days
• Auditor access to documents prepared

How OK-GRC helps

OK-GRC brings together everything the auditor asks for: a Statement of Applicability exportable to PDF, risks and treatment plan, dated and versioned evidence, internal audit programme, findings and corrective actions, and an automatically prepared management review. You can invite your auditor with free, traced, read-only access.