ISO 27001 LI common mistakes
ISO 27001 LI · Understand the traps and how to avoid them.
Building the project from an Annex A control matrix and a policy template pack first, then trying to bolt on Clause 4 context analysis, leadership involvement and the Clause 6 risk process at the end of the implementation.
Annex A feels concrete and familiar to candidates with a technical or controls-audit background, so the management-system clauses that carry most of the exam weight get treated as paperwork to be back-filled.
What to do instead
Before opening Annex A, draw a one-page map of Clauses 4-10 with the artefact each one requires (context and interested-party analysis, scope, policy, risk criteria and results, treatment plan and SoA, competence records, audit programme, review minutes, improvement records). Be able to explain how any given Annex A control traces back to a risk in that map.
Writing the scope as 'all information systems of the organization' or excluding an inconvenient business unit by declaring it out of scope, while still claiming conformity to Clauses 4-10 for the whole organization.
Candidates copy scope statements from templates and confuse 'scope of the ISMS' with 'inventory of IT assets'; many also believe scope exclusions can remove requirements they find hard to meet.
What to do instead
Express scope as boundaries and applicability: organizational units, locations, technologies, processes, and interfaces and dependencies on other parties, with a justification. Remember that Clauses 4-10 cannot be excluded; only Annex A controls can be excluded, and each exclusion needs a documented justification in the Statement of Applicability.
Producing a Statement of Applicability that lists only the controls actually implemented, gives no justification for the ones left out, and is frozen at project end rather than updated when the risk treatment changes.
The SoA is treated as a status report written for the auditor instead of what it is: the recorded output of the risk treatment decisions, which must cover the full Annex A set.
What to do instead
Include every Annex A control with four elements per row: included or excluded, justification for that decision, implementation status, and the risk or risk-treatment reference that drove inclusion. Version-control it and show how a change in the risk assessment propagates into the SoA.
Running risk assessment workshops before any risk criteria or risk acceptance criteria exist, and letting the person who facilitated the assessment sign off residual risk instead of a named risk owner.
Risk assessment gets conflated with brainstorming, and the roles of risk owner, control owner and assessor are merged in the candidate's head, so Clause 6.1.2 and 6.1.3 outputs come out mixed together.
What to do instead
Have top management define the impact and likelihood scales, the risk matrix and the acceptance thresholds first. Then keep the outputs distinct: risk assessment results are the output of 6.1.2; the risk treatment plan with named owners and approved residual risk is the output of 6.1.3; the SoA records the control decisions.
Describing controls in documents ('a backup procedure exists', 'access is reviewed periodically') without being able to point to records showing the control actually operated during the audit period.
Candidates equate a written procedure with an implemented control, so the design work is done and the operating evidence is never designed or collected.
What to do instead
For every control in the SoA, name the operating record and the role that produces it (log extract, ticket, approval trail, review minutes), and confirm at least one sample exists inside the audit period. Design the record at the same time as the control, not after the audit.
Evidencing Clause 7.2 with a blanket awareness e-learning completion report and treating attendance as proof that risk owners, internal auditors and control operators are competent.
Competence (7.2) and awareness (7.3) are merged in the candidate's mental model, and training completion is the easiest evidence to produce.
What to do instead
Define the required competence per role, determine the gap, take action to close it, and retain evidence of the resulting competence (assessment, qualification, supervised work, evaluation of effectiveness) rather than attendance. Show awareness evidence separately for the wider workforce.
Running internal audits that only cover Annex A technical controls, with the ISMS manager auditing the risk process they designed themselves, and no audit programme built from process importance and previous results.
Internal audit is treated as a technical security check, and Clause 9.2's requirements for a risk-based programme and auditor objectivity are overlooked.
What to do instead
Derive the audit programme from the importance of the processes and the results of previous audits and risk assessments, cover Clauses 4-10 as well as selected Annex A controls, and allocate auditors who do not audit their own work. Report results and findings to top management.
Holding a management review that is really a project status meeting, omitting required inputs such as audit results, nonconformities and corrective actions, monitoring and measurement results, feedback from interested parties, risk assessment status and improvement opportunities, and ending without recorded decisions.
Candidates skim Clause 9.3 and reuse whatever steering committee already exists, and they do not connect the Clause 9.1 measurement outputs to the review inputs.
What to do instead
Use a standing agenda built from 9.3.2 inputs and 9.3.3 outputs (decisions and actions related to continual improvement and any need to change the ISMS). Minute each decision with an owner and a date, and make sure the 9.1 metrics are reported into the meeting in a defined format with method, frequency and analysis assigned.
Responding to a nonconformity by rewriting the procedure and closing it the same week, with no root cause analysis and no check that the action was effective, and citing clause numbers from the 2013 edition.
Candidates want visible closure and often rely on memory of the older structure, confusing correction with corrective action and mixing up Clause 10.1 (continual improvement) and 10.2 (nonconformity and corrective action) in the 2022 edition.
What to do instead
Work the sequence: react and contain (correction), evaluate the need for action to eliminate causes, determine the causes, implement, review the effectiveness of the action, update risks and the ISMS if needed, and retain documented information. Quote 2022 numbering, and note that a separate preventive action clause no longer exists because risk-based thinking replaces it.
Entering the certification process expecting the certification body to review the risk assessment and advise what to fix, treating Stage 1 as a formality that can be skipped, or assuming a major nonconformity can be carried forward to the next surveillance audit.
Candidates blur the consultant's role with the auditor's, and they do not know the mechanics of the audit cycle: two-stage initial audit, nonconformity classification, closure requirements before certificate issue, and a three-year cycle with surveillance audits.
What to do instead
Treat Stage 1 as a readiness check: scope defined, risk assessment and treatment done, SoA consistent with them, internal audit and management review completed, and the mandatory documented information in place. Treat Stage 2 as evidence of operation. Know that major nonconformities must be closed before certification, minor ones need an accepted plan, and the certificate runs on a three-year cycle with surveillance audits before recertification.