Preparation for an ISMS Certification Audit
The certification framework
Certification is performed by an accredited certification body operating to ISO/IEC 17021-1 and ISO/IEC 27006, using auditors competent in information security and in auditing (ISO/IEC 19011 guidance). Certification is a third-party attestation of conformity with ISO/IEC 27001 - not a guarantee that the organization is secure, and not a consultancy engagement.
The two-stage initial audit
Stage 1 evaluates readiness: is the ISMS documented, is the scope and SoA coherent, have internal audits and management review been completed, are risk assessment and treatment performed, and is the organization prepared for stage 2? Stage 2 evaluates implementation and effectiveness: does the ISMS actually operate, is evidence available, are objectives met, are controls working? The certification decision is made by the certification body, not by the audit team, on the basis of the audit evidence.
Findings and the cycle
Audit findings include major nonconformity, minor nonconformity, and observations or opportunities for improvement; conformities are also recorded. A certificate is typically valid for three years with surveillance audits at least annually and a recertification audit before expiry.
Traps. Expect questions on independence: an auditor must not audit their own work, and a consultant who built the ISMS creates a conflict if they later audit it. Another myth is that stage 1 is a full trial audit that can be passed without internal audit and management review. Also, a major nonconformity normally requires verification before certification; it cannot simply be promised in a plan. Fabricated or back-dated records destroy the credibility of the entire system.
Rule of thumb. Before booking stage 2, run a readiness checklist: scope and SoA current, risk assessment performed at the planned interval and after changes, evidence across Clauses 4–10, internal audit covering all clauses and a sample of controls, management review with complete inputs and outputs, and corrective actions closed with proof of effectiveness.