Preparation for a CMS Certification Audit
This domain tests how an ISO 37301 certification audit actually runs and what evidence a certification body will sample.
The framework
ISO 37301 is a certifiable requirements standard; ISO 19600:2014 was guidance only and could not be certified. Certification is granted by a conformity assessment body operating under ISO/IEC 17021-1 with accredited competence in compliance management.
The audit sequence
- Application and contract - the certification scope must match the documented scope under 4.3, including boundaries, sectors and any exclusions.
- Stage 1 - readiness and documentation review: is the CMS designed to meet clauses 4–10, have internal audit and management review been completed, is there enough evidence to proceed? It is not a gap audit and not a rehearsal.
- Stage 2 - implementation and effectiveness: sampling of processes, interviews with top management, the compliance function and operational staff, and evidence of controls, risk assessment, objectives and performance.
- Findings - major nonconformities normally block certification until corrected and verified; minor ones may be cleared through an accepted corrective-action plan.
- Decision and cycle - certification decision by an impartial body, then a three-year cycle with surveillance audits at least annually and recertification before expiry.
Worked example
An organization produces a complete policy set, but its internal audit report covers only clauses 4–6 and management review has no minutes. Stage 1 closes with a finding and stage 2 is deferred. The fix is not more documentation - it is running an audit across 4–10 and holding a minuted review, then letting evidence accumulate.
Traps
Believing certification guarantees legal compliance - it certifies the CMS, not outcomes. Buying a template pack describing a CMS nobody operates. Withholding incidents, which sampling will surface anyway. Treating stage 1 as an optional pre-audit.