Scope, self-audit and an open nonconformity before certification
Havenbrook Care operates six care homes and is seeking ISO/IEC 27001 certification. The scope statement covers 'all information processing in support of care delivery'. The payroll system, however, is run by a subsidiary in another city that is not in the scope; it holds 1,900 staff records. The internal audit was performed by the ISMS manager, who also wrote the risk assessment and the policies. Management review minutes from last year record only 'security discussed; no actions'. One major nonconformity from the previous internal audit - no restore tests - remains open with a due date of last December. The certification body has scheduled a stage 1 audit in six weeks. The managing director wants to postpone the internal audit until after certification 'to save time'.
1. Is the scope statement defensible? Explain with reference to ISO/IEC 27001 scope requirements and interfaces.
Read the worked answer
The wording is broad, but the boundary is questionable and currently unexplained.
Clause 4.3 requires the organisation to determine the ISMS scope considering internal and external issues, interested-party requirements, and the interfaces and dependencies with other organisations. A scope statement must be accurate enough for a reader to know what is covered and what is not.
Here the statement says 'all information processing in support of care delivery', yet payroll for 1,900 staff is excluded because it sits in a subsidiary in another city. Payroll supports the employment of the people who deliver care; it also processes personal data. An auditor will ask why a system that supports the scoped services is outside the boundary.
Excluding a subsidiary is not automatically forbidden. An organisation may define a narrower scope if it can justify the boundary and control the interfaces. But the justification must be documented, and the ISMS must address the dependency: how payroll data is protected, what happens if the subsidiary has an incident, what security requirements are imposed and how they are monitored. Simply leaving it out creates a gap between the certificate and the real service.
The practical options are: bring payroll into scope with the subsidiary as an interface; or keep it out but document the interface controls, supplier-type requirements and risk assessment. The second option must be credible, not a paper exclusion. The stage 1 auditor is likely to test this immediately, because scope is a certification decision, not a marketing sentence.
2. Evaluate the internal audit arrangements against clause 9.2, including independence and the open nonconformity.
Read the worked answer
The audit lacks the objectivity clause 9.2 requires.
Clause 9.2 requires internal audits at planned intervals, an audit programme covering criteria, scope, frequency and methods, and selection of auditors who ensure objectivity and impartiality. The ISMS manager wrote the risk assessment and the policies and then audited their own work. Even with good intentions, that person cannot provide independent assurance: they are testing decisions they own and may have a conflict in reporting findings.
Acceptable fixes include using a competent auditor from another site or subsidiary who is independent of the ISMS work, engaging an external auditor, or pairing the ISMS manager with an independent lead. The audit criteria should include the standard, the organisation's own policies and the risk treatment plan.
The open major nonconformity is a second problem. Clause 10.2 requires action to control and correct the nonconformity, evaluation of the need to eliminate the cause, implementation of corrective action, review of effectiveness and retention of documented information. A 'no restore tests' finding is not administrative: it means the organisation does not know whether its backups work. Leaving it open past December without a root-cause analysis or effectiveness check tells the certification body that corrective action is not functioning.
Before stage 1, the organisation should complete a genuine internal audit of the scoped ISMS, record findings and corrections, and close or credibly progress the restore-test finding with evidence of an actual restore. The auditor will not accept a plan to do this after certification.
3. What should management review cover, and what should be done about the managing director's proposal to postpone the internal audit?
Read the worked answer
The proposal inverts the purpose of internal audit.
Clause 9.3 requires top management to review the ISMS at planned intervals. Inputs include the status of actions from previous reviews; changes in external and internal issues; feedback on information security performance, including trends in nonconformities and incidents; monitoring and measurement results; audit results; risk assessment and treatment status; and opportunities for improvement. Outputs include decisions on improvement and on resources.
'Security discussed; no actions' is not a management review. It does not show that top management considered the open restore-test nonconformity, the payroll scope question, risk acceptance or resource needs. A useful review would have a standing agenda, a record of decisions, named owners and dates, and a follow-up item at the next meeting.
As for postponing the internal audit, that is the wrong way round. Internal audit is a required part of the ISMS and provides the evidence that the management system is working before the certification body tests it. Clause 9.2 is not optional, and a stage 2 audit will expect audit results and corrective actions. Postponing it to 'save time' saves nothing: it increases the chance of findings at certification and forces rework after the certificate is at risk.
The managing director should instead authorise an independent internal audit now, require the restore test to be performed and evidenced, and hold a proper management review with decisions recorded. If resources are tight, scope the internal audit to the highest-risk areas first, but do not pretend the requirement has been met.