Transition Audit Booked Against an Outdated Prerequisite
Northwind People Systems is a 900-person HR software vendor headquartered in Germany. It holds an ISO/IEC 27001:2013 certificate issued in 2022 that expires in ten months, and an ISO/IEC 27701:2019 certificate whose scope reads 'processing of employee data on behalf of EU clients'. The compliance manager has booked a 27701:2025 transition audit in eight weeks and intends to leave the 27001:2013 certificate untouched until its normal renewal, arguing that the two certificates are independent. The Statement of Applicability still lists the 114 controls of 27001:2013 Annex A; privacy documentation references the 2019 controller and processor annexes. The internal auditor has told the team that 27701 is 'an extension', so the 27701 certificate 'stands alone'. Meanwhile a large client has asked for written confirmation of certification to 27701:2025 by the end of Q3, and the engineering team has already renamed several internal policies to match the 2022 control themes without updating the SoA.
1. Assess the compliance manager's plan. Can Northwind be certified to ISO/IEC 27701:2025 while its ISO/IEC 27001 certificate is still against the 2013 edition? Show your reasoning.
Read the worked answer
The plan fails on a structural point, not a scheduling one. ISO/IEC 27701:2025 is an extension standard: it adds privacy requirements and guidance on top of ISO/IEC 27001:2022 and ISO/IEC 27002:2022, and it follows their harmonised clause structure 4-10. A 27701 certificate therefore certifies the PIMS as an extension of an ISMS that conforms to 27001:2022. If Northwind's underlying ISMS certificate is still against the 2013 edition, the audit criteria the 27701 auditor must test do not exist: there is no 2022 Annex A SoA, no 2022 risk-treatment logic, and no clause 4-10 conformity to extend.
Reasoning steps: (1) confirm the prerequisite - a current 27001:2022 certificate or a combined transition audit; (2) check the applicable accreditation and IAF transition arrangements for both standards rather than inventing a date; (3) sequence: gap analysis, 27001 transition (it can be combined with a surveillance), then 27701 transition; (4) the 2019 27701 certificate cannot be 'converted' - it is replaced at transition. The internal auditor is half right: 27701 is an extension, which is precisely why it cannot stand alone.
2. What must change in the Statement of Applicability and control mapping before an auditor can accept a 27701:2025 scope?
Read the worked answer
The SoA is the first artefact an auditor reads, and here it is two editions out of date. Required changes: rebuild the SoA against 27001:2022 Annex A (93 controls in four themes - organisational, people, physical, technological), with justification for inclusion and exclusion plus implementation status; add the privacy controls and guidance from 27701:2025 Annex A, linked through the same structure rather than the retired 2019 controller/processor annexes; produce a mapping table 2019 to 2025 so nothing silently disappears (de-identification, privacy impact assessment and PII transfer guidance that used to sit in the 2019 annexes are the usual casualties); verify that renamed policies reflect real implementation - a title change is not evidence, so sample approvals, distribution, training records and operating evidence; align documented-information control (7.5) so version, owner and retention are consistent; and reconcile the client-facing scope statement. The judgement point: the auditor tests whether the SoA is a decision record or a copy-paste. An exclusion must trace to risk, not to convenience.
3. Draft the sequence of activities and the message to the client, given the Q3 deadline and the ten-month 27001 expiry.
Read the worked answer
Sequence: weeks 1-2 gap analysis against 27001:2022 and 27701:2025; weeks 2-8 close high-priority gaps, rebuild the SoA and risk register; combine the 27001 transition with the next surveillance or a special audit; only then run the 27701 transition, ideally in the same window with a combined programme, since the criteria overlap. Do not let the eight-week booking drive the order - an auditor who finds a 2013-based ISMS will stop or raise a major nonconformity, and the client conversation then becomes much harder.
Client message: state facts - current certification, planned transition dates, the dependency on 27001:2022, and the earliest credible date for a 27701:2025 certificate. Offer a signed statement of status or a bridge letter rather than implying certification. Note the ten-month expiry: if the 27001 transition slips past it, there is no valid prerequisite at all, so the 27001 work is on the critical path, not parallel paperwork. Also warn internally that the renamed policies must be backed by implementation evidence before either audit, otherwise the same gap appears twice.