Eighteen Days to Stage 1: Scope, Gaps and the Temptation to Rewrite
Kestrel Financial Services has its Stage 1 certification audit in 18 days, with Stage 2 six weeks later. The scope statement reads 'the provision of Kestrel's online lending platform'. However, loan servicing and the payroll of 300 staff are performed by a wholly owned subsidiary in the same building, which shares the network and the Active Directory domain. The internal audit programme covered clauses 4 to 8 and 10, but not 9. The last management review was 13 months ago, and its minutes record only 'ISMS reviewed - OK'. The CISO proposes to add 12 new Annex A controls and rewrite the SoA before Stage 1, and asks whether the auditor can be asked to treat the subsidiary as out of scope 'just for now'.
1. Advise on the scope question. What are the risks, and what must be decided before Stage 1?
Read the worked answer
What 4.3 requires: the scope must state the boundaries and applicability of the ISMS, taking into account external and internal issues, the requirements of interested parties, and the interfaces and dependencies between activities performed by the organisation and those performed by others. It must be available as documented information and must not be misleading.
The risk: shared network and shared Active Directory mean the subsidiary is not merely adjacent - it is inside the technical boundary. If subsidiary staff hold identities that can reach the lending platform, excluding them from the scope statement is inaccurate. A regulator-facing financial client will also read a scope statement that omits payroll processing as a gap in governance.
The three honest options:
- Extend the scope to include the subsidiary's shared services and the payroll function. Costly but truthful. Given six weeks to Stage 2, this may be feasible if the subsidiary operates the same controls.
- Genuinely segregate - separate domain, separate network segment, contractual and technical controls - and document the segregation as evidence. This cannot be delivered in 18 days.
- Narrow the scope further to a service that is demonstrably separable, with a documented dependency analysis.
On 'just for now': no. A scope statement cannot be time-limited for audit convenience. Say so plainly to the CISO, and take the decision to top management, which owns it.
Judgement: raise it with the certification body now. Arriving at Stage 1 with a scope the auditor disputes converts a manageable planning issue into a scope-limitation finding.
2. Which findings are likely at Stage 1, and how should the 18 days be used?
Read the worked answer
What Stage 1 examines: readiness for Stage 2 - that the ISMS documentation exists, that scope and SoA are defined, that risk assessment and treatment have been performed, that internal audit and management review have been carried out, and that management is committed and the internal resources are in place.
Likely findings:
- Clause 9.2 not fully audited. An internal audit programme that skips clause 9 leaves performance evaluation unaudited - a direct 9.2 nonconformity and a strong signal of an incomplete cycle.
- Clause 9.3. Management review 13 months ago with no substantive inputs or outputs fails 9.3.2/9.3.3 and the documented-information requirement. Without a credible review, Stage 2 is usually deferred.
- Scope (4.3) as discussed, unless resolved.
How to spend the 18 days, in order:
- Decide and document the scope with top management - this gates everything else.
- Run a full internal audit of clause 9 with an impartial auditor, and close or formally plan the resulting findings.
- Hold a proper management review with the required inputs and a recorded set of decisions with owners and dates.
- Walk the SoA against the risk register to confirm traceability, fixing only genuine breaks.
Judgement: items 1–3 are what will actually be examined at Stage 1 and are achievable in 18 days. Rewriting the control set is not.
3. Evaluate the CISO's proposal to add 12 controls and rewrite the SoA before Stage 1.
Read the worked answer
Arguments the CISO might make: 'the SoA is wrong, better to fix it now'. That instinct is sound in principle - an inaccurate SoA is a real problem.
Why the timing is bad:
- Changes must be planned (6.3) and risk-driven. Adding 12 controls without a corresponding change in the risk assessment creates exactly the traceability gap the SoA exists to prevent. The auditor will ask which risk required control X; 'we added it in the last fortnight' is a weak answer.
- Stage 2 tests operation, not paper. A control added 18 days before Stage 1 will have no operating evidence six weeks later; it will read as documentation activity rather than implementation.
- It signals panic. Wholesale SoA rewrites immediately before Stage 1 invite the auditor to look harder at whether the original assessment was ever valid.
What to do instead:
- Reconcile the SoA against the risk treatment plan and fix only broken links and missing justifications, with the change recorded and approved.
- Where a genuine gap is identified, log it as a finding against the risk process and schedule it into the treatment plan with a date - a documented, owned plan is a legitimate position at Stage 2.
- Defer the 12 controls until the post-certification cycle, unless one of them addresses a risk the assessment already identifies.
Reasoning: certification auditors distinguish between 'not yet implemented, planned and owned' and 'implemented on paper three weeks ago'. The first is survivable; the second is not.