Conducting the certification audit: stage 1 and stage 2, the opening meeting, communication, guides and observers, evidence collection, sampling, checklists, working papers and test plans, corroboration, drafting findings and nonconformities, and the benefit of the doubt.
5 minutes
5 Questions
Conducting an ISO/IEC 27001 audit is the core competency of a Lead Auditor. It follows the guidance of ISO 19011 (auditing management systems) and, for certification bodies, ISO/IEC 27006 and ISO/IEC 17021-1. The goal is to gather objective evidence showing whether an organization's Information Security Management System (ISMS) conforms to ISO/IEC 27001 requirements and is effectively implemented.
The process begins with initiating the audit. The Lead Auditor establishes contact with the auditee, confirms the audit objectives, scope, and criteria, and checks feasibility. Next comes preparation. This includes reviewing documented information such as the ISMS scope, information security policy, risk assessment and treatment methodology, Statement of Applicability (SoA), and prior audit results. The Lead Auditor then develops a risk-based audit plan, assigns team roles, and prepares work documents like checklists and sampling plans.
In certification audits, Stage 1 evaluates documentation and readiness. Stage 2 assesses whether the ISMS is implemented and effective. On-site or remote activities start with an opening meeting to confirm the plan, logistics, and confidentiality. Auditors then collect and verify evidence through interviews, observation of activities, and review of records. They use sampling to test clauses 4 to 10 and the applicable Annex A controls.
Evidence is evaluated against the audit criteria to produce findings. These are classified as conformities, major or minor nonconformities, or opportunities for improvement. Each nonconformity must be clearly stated, referenced to a specific requirement, and supported by verifiable evidence. Regular audit team meetings help review progress and reach consensus on conclusions.
The audit concludes with a closing meeting, where findings and conclusions are presented. If applicable, a certification recommendation is also given. Afterward, the Lead Auditor prepares and distributes the audit report. The process ends with follow-up, which means verifying the auditee's corrective actions.
Throughout the audit, auditors must uphold integrity, fair presentation, due professional care, confidentiality, independence, and an evidence-based, risk-based approach.Conducting an ISO/IEC 27001 audit is the core competency of a Lead Auditor. It follows the guidance of ISO 19011 (auditing management systems) and, for certification bodies, ISO/IEC 27006 and ISO/IEC 17021-1. The goal is to gather objective evidence showing whether an organization's Information Sec…
