ISO 27001 Lead Auditor common mistakes
ISO 27001 Lead Auditor · Understand the traps and how to avoid them.
Writes findings that mangle the audit triad - e.g., records an 'observation' as a nonconformity without stating the criterion, or justifies a nonconformity with 'the auditor believes this is weak' rather than with objective evidence against a named requirement.
Candidates use 'finding' conversationally to mean anything notable they saw, and they carry over the habit of writing improvement advice. ISO 19011 defines finding = result of evaluating evidence against criteria, so a finding without a criterion is unverifiable and cannot be corrected or appealed.
What to do instead
Write every nonconformity in the fixed three-part form: requirement (quote clause/Annex A control or the organisation's own policy) - objective evidence (record ID, date, person, document, sample size) - statement of the gap. If you cannot name the criterion, it is not a nonconformity; record it as a note or omit it.
Treats the Statement of Applicability as a checklist where all 93 Annex A controls must be implemented, and raises nonconformities for every excluded control.
Older training and pre-2022 habits treat Annex A as a mandatory control catalogue, and candidates confuse 'applicability' with 'compliance'. Candidates also forget that the SoA itself has explicit required content in 6.1.3 d).
What to do instead
Audit the SoA as a documented artefact satisfying 6.1.3 d): controls deemed necessary, justification for inclusion, whether each is implemented, and justification for exclusion of any Annex A control. Nonconformities relate to missing/unsupported justification or to an excluded control that the risk assessment clearly requires - not to the mere fact of exclusion.
Spends the audit verifying that documents exist ('there is a policy, there is a procedure, it is signed') and never samples records, observes practice, or tests whether the control actually works.
Document review feels productive and is low-conflict; asking an auditee to prove effectiveness risks confrontation. Candidates also treat ISO 27001 as a documentation standard because clauses 7.5 and the SoA are visible in the text.
What to do instead
For each control sampled, plan three evidence types: documented information, records of operation, and confirmation of effect (interview + record + observation). State in the working papers what would count as evidence of failure; if you cannot articulate it, the test is not yet designed.
Mislabels severity: escalates a single missed record to a major nonconformity, or downgrades an entirely absent required process (e.g., no risk treatment plan, no management review ever held) to a minor one or an 'opportunity for improvement'.
Candidates rely on gut feeling about how 'bad' something seems rather than on the definition, and they fear being seen as harsh. There is also a common misconception that major nonconformities have a numeric threshold or a fixed number of minors.
What to do instead
Apply the definition: major = the management system requirement or control is absent or systematically not implemented, so the intended outcome is not achieved and certification cannot be supported; minor = an isolated lapse within an otherwise operating process. Justify the classification in the finding text and check consistency across all findings in the report.
Starts Stage 2 without a documented audit plan and without a completed documentation review, and works only against ISO/IEC 27001 while ignoring the organisation's own policies, SoA and risk treatment plan as audit criteria.
Candidates equate 'audit' with 'interview', and time pressure plus a supplied checklist discourages planning. The multi-source nature of audit criteria in an ISMS audit is easily missed because the standard is the most salient document.
What to do instead
Before fieldwork, produce a plan stating objectives, scope (including boundaries and interfaces), criteria (ISO/IEC 27001 clauses 4–10, Annex A as applied via the SoA, plus the ISMS's own policies, procedures and risk treatment plan), schedule, roles and sampling rationale; confirm it with the auditee. Review ISMS documented information and prior audit results beforehand and use them to target sampling.
Asks closed or leading questions ('You do review access rights quarterly, don't you?'), accepts the auditee's assurance as evidence, and does not record or justify sample sizes.
Leading questions are how people make conversations flow, and audit anxiety pushes candidates toward confirmation of what they already read. Sampling is invisible work, so it feels optional.
What to do instead
Use open questions ('Walk me through how access is granted and removed'), then follow with 'show me' - request the actual records for a stated sample and trace them to the procedure. Record in the working papers the population, sample size and selection basis so conclusions can be defended.
States that the organisation must use a named risk methodology (e.g., ISO/IEC 27005 or a specific scoring scale), or treats risk assessment and risk treatment as one activity.
Familiarity with guidance documents blurs the line between 'guidance' and 'requirement', and assessment/treatment are colloquially merged into 'risk management'.
What to do instead
Anchor on the requirement: the organisation must define and apply a risk assessment process that produces consistent, valid, comparable results and identifies owners and risk levels, and a separate risk treatment process selecting options and producing a Statement of Applicability with residual risk acceptance by risk owners. Audit against the organisation's own defined methodology, not against your preferred one.
Uses 'audit programme' and 'audit plan' interchangeably, and describes a programme that is a fixed annual list with no risk-based scheduling, no competence management and no monitoring or review of the programme itself.
The two terms sound alike and the programme's PDCA requirements (objectives, extent, risks, monitoring, improvement) are spread across several clauses, so they are easy to omit from an answer.
What to do instead
Define programme = the ongoing set of audits over time with objectives, extent, risk-based scheduling, resources and competence, monitored and improved; plan = the arrangements for one audit. In answers on programme management, explicitly cover establishing, implementing, monitoring/reviewing and improving it.
Closes the audit by writing conclusions that exceed scope or criteria, recommending a specific software tool or solution to fix a nonconformity, or accepting a promised corrective action without requiring verification of effectiveness.
Recommendations feel helpful and are the natural next thought after finding a gap; also, an auditee's confident 'we'll fix it by Friday' is socially hard to push back on.
What to do instead
Keep conclusions strictly to what the evidence supports against the stated criteria and scope. Do not prescribe solutions - this is consulting and compromises objectivity; describe the requirement and the gap only. For each nonconformity, require root-cause analysis, a correction, a corrective action and a defined verification point, and state who verifies effectiveness and when.
Audits almost exclusively against Annex A and never tests the management-system clauses: context of the organisation, leadership and commitment, ISMS scope, objectives, management review, internal audit, corrective action, performance monitoring.
Annex A is a familiar list of technical controls and is easy to convert into questions, while clauses 4–10 feel abstract and 'already covered by the policies'.
What to do instead
Build the audit plan so that clauses 4–10 each have allocated time and a named interviewee, and treat Annex A as the mechanism by which those clauses deliver outcomes. Explicitly test the mandatory documented information required by the standard, and check that internal audit and management review actually occurred and had consequences.