Closing an ISO/IEC 27001 Audit
From findings to report
After evidence is gathered, the audit team meets to consolidate and agree findings and reach audit conclusions. The closing meeting presents findings, conclusions and any recommendations to the auditee and client; the auditee should confirm the factual accuracy of the evidence (not necessarily agree with the grading). Written findings normally follow shortly after.
The audit report contains objectives, scope, criteria, dates and places, identification of client, auditee and team, a summary of the process, findings with evidence and criteria, conclusions, and a statement on conformity - plus the caveat that the audit was sample-based. The report belongs to the client, is confidential, and its distribution is controlled.
Follow-up
For certification audits, the organisation submits corrective action plans within defined timelines; the audit team verifies implementation and effectiveness, then the certification decision is taken by an independent competent person - never by the auditors themselves. Subsequent surveillance audits confirm continuing conformity across the three-year certification cycle.
Traps
- Saying the lead auditor 'certifies' the organisation.
- Introducing brand-new findings after the closing meeting without clear justification.
- Writing recommendations as if they were requirements - reports should not become consulting advice.
- Treating the corrective action plan as closure: closure requires verification of effectiveness.
Rule of thumb
An audit ends when three things are done: findings accepted as factually correct, the report issued, and the follow-up route agreed.