The ISO 27001 audit process
After months of preparation, the moment has arrived: the ISO 27001 certification audit by an accredited body . NEN , the Dutch standards body, publishes the official Dutch version of the standard. For many organisations, this is a tense period. What will the auditor ask? And what happens if something is not right?
The audit process is standardised and predictable, which makes it less intimidating than it may seem. In this article, we explain what you can expect, how to prepare, and how to deal with any findings.
An audit does not only assess documents. It mainly checks whether your ISMS works in practice. The auditor checks technical controls, talks to employees and reviews records.
The ISO 27001 audit process at a glance
| Stage | What happens? | Result |
|---|---|---|
| Stage 1 | Document review (ISMS, SoA, risk assessment) | Ready or no-go for stage 2 |
| Stage 2 | Implementation audit on site | Certification recommendation |
| Surveillance | Annual check audit | Certificate maintained |
| Recertification | Full reassessment in year 3 | Certificate renewed |
What types of ISO 27001 audits are there?
The audit process for ISO 27001 consists of several stages that repeat over a three-year cycle. Understanding this cycle helps you prepare at the right moments.
The certification audit is the first audit you go through to obtain the certificate. It consists of two stages: a document review (stage 1) and an implementation audit (stage 2). After successful completion, you receive the certificate, which is valid for three years.
The surveillance audit takes place every year in years one and two after certification. This audit is shorter than the initial audit and checks whether you still meet the standard. The auditor looks at a selection of your ISMS, not the whole system.
The recertification audit takes place at the end of the three-year cycle. This audit is similar to the initial certification audit and reassesses the whole ISMS. After successful completion, a new three-year cycle begins.
In addition, there is the internal audit, which you carry out yourself (or with help from an external party). It is not part of the certification but a requirement of the standard itself. The internal audit checks whether your ISMS works as intended and helps you find problems before the external auditor does.
The ISO 27001 audit step by step
The initial certification audit runs in two stages, with time in between to address any shortcomings.
Stage 1: Document review
In stage 1, the auditor checks whether your documentation is complete and whether you are ready for the implementation audit. This stage usually takes between half a day and a full day, depending on the size of your organisation.
The auditor looks at, among other things, your scope definition, your information security policy, your risk assessment and risk treatment plan, the Statement of Applicability, your objectives, and evidence that you have carried out your internal audit and management review.
Stage 1 can take place on site or remotely, with the auditor receiving and reviewing your documentation digitally. More and more organisations choose a remote stage 1, which saves time and costs.
After stage 1, you receive a report with findings. If there are significant shortcomings, you must resolve them before stage 2 takes place. The auditor states whether you are ready for stage 2 and what the focus points will be.
Stage 2: Implementation audit
Stage 2 is the actual audit on site (or remotely, if your organisation allows it). The auditor checks whether your ISMS not only exists on paper but also works in practice.
The duration of stage 2 depends on your organisation. For a small company, this may be one to two days; for a large organisation with several locations, it can take a week or longer. The International Accreditation Forum (IAF) has guidance on the minimum number of audit days.
During stage 2, the auditor carries out various activities. They speak with employees at different levels, from management to the shop floor. The auditor reviews systems and asks for demonstrations of security measures. Records are checked: incident logs, access logs, change records. And the auditor follows processes by looking at how they are carried out in practice.
At the end of stage 2, the auditor holds a closing meeting in which the findings are presented.
What the ISO 27001 auditor checks
The auditor systematically checks whether you meet all the requirements of ISO 27001. This covers both the requirements in chapters 4 to 10 and the relevant controls from Annex A that you have included in your Statement of Applicability.
Documentation and records
The auditor checks whether you have the required documented information: the policy, the risk assessment, the SoA, the objectives, the procedures, and the records that show your processes are being followed.
However, documentation alone is not enough. The auditor wants to see that the documentation is up to date, that employees know where to find it, and that the documents are used in day-to-day practice.
Interviews with employees
Conversations with employees are a crucial part of the audit. The auditor does not only speak with the security officer or the IT manager, but also with other employees to verify that the ISMS is genuinely alive in the organisation.
Typical questions might be: “Do you know the information security policy?”, “What do you do if you receive a suspicious email?”, “How do you request access to a system?”, “Have you had security awareness training recently?”
Prepare your employees for the audit, but do not instruct them to give “the right answer”. Auditors are trained to recognise when answers have been rehearsed. Honesty and authenticity work better.
Technical verification
Depending on the auditor’s competencies and the nature of your organisation, the auditor may also carry out technical verification. This can range from reviewing configurations and log files to observing security systems in operation.
The auditor is not a penetration tester and will not carry out technical attacks on your systems. But they do want to see evidence that your technical controls work as described.
Evidence of operation
A recurring theme in the audit is evidence. It is not enough to say that you do something; you must be able to demonstrate it. This means records, log files, minutes, reports, and other artefacts that show processes are being followed.
If you say that you scan for vulnerabilities and patch them, the auditor will want to see the scan reports and the patch records. If you say that you record incidents, the auditor will want to review the incident database. If you say that employees are trained, the auditor will want to see the training records.
What does the auditor ask each role?
The auditor asks different questions of the management than of an employee on the shop floor. Below you can see, per role, what the auditor asks about, so you can prepare in a targeted way. Do not coach people on “the right answer”; honesty works better.
| Role | What the auditor asks about |
|---|---|
| Management | Involvement in the ISMS, objectives, management review, resources made available |
| Security officer / ISMS owner | Risk assessment, SoA, incident handling, internal audit, controls from Annex A |
| IT / systems administration | Access management, backups, patch management, logging and monitoring |
| Employee (shop floor) | Do they know the policy? What do they do with a suspicious email? How do they request access? |
How many audit days does an ISO 27001 audit take?
The number of audit days depends on your number of employees and is determined according to guidance from the International Accreditation Forum (IAF) . The numbers below are indicative and apply to stage 1 and stage 2 together. Your certification body makes the precise estimate.
| Number of employees | Audit days (stage 1 + 2, indicative) |
|---|---|
| 1 to 10 | 2 to 3 days |
| 11 to 25 | 3 to 4 days |
| 26 to 45 | 4 to 5 days |
| 46 to 65 | 5 to 6 days |
| 66 to 85 | 6 to 7 days |
| 86 to 125 | 7 to 8 days |
For what an audit day costs and how that feeds into the total price, see costs and timeline.
Possible outcomes of the ISO 27001 audit
After the audit, you receive a report with the findings. Findings are categorised by different levels of severity.
Conformity means that you meet the requirement. This is the desired result.
An observation or point of attention is a finding that is not a nonconformity, but is an improvement point. The auditor has noticed something that could be better, but it still meets the standard. You are not required to act on it, but it is wise to take observations seriously.
A minor nonconformity means that you do not fully meet a requirement, but the shortcoming does not fundamentally undermine the effectiveness of the ISMS. You usually get 90 days to correct the nonconformity and provide evidence to the certification body. Minor nonconformities do not block certification immediately.
A major nonconformity is a serious shortcoming that puts the effectiveness of the ISMS at risk. For example: no risk assessment carried out, no internal audit done, or fundamental controls missing. A major nonconformity blocks certification until it has been resolved and verified, which may require an extra audit visit.
How do you prepare for an ISO 27001 audit?
Good preparation reduces stress and increases the chance of a positive result. Start weeks ahead, not days.
Weeks before
Carry out a thorough internal audit that covers all parts of your ISMS. Resolve any nonconformities you find and document the corrective actions. If the management review has not taken place recently, hold one; the agenda and decision list show what this looks like.
Check that all required documentation is complete and up to date. Is the risk assessment recent enough? Has the SoA been updated if there have been changes? Are all procedures up to date?
Gather the evidence you need: training records, audit logs, incident reports, change records. Make sure you can quickly find what the auditor asks for.
Days before
Inform employees that an audit is coming. Explain the purpose and what they can expect. Reassure them: it is not an exam in which they are personally assessed.
Arrange practical matters: a room for the auditor to work in, access to systems that need to be reviewed, and the availability of key people for interviews.
Go through your documentation once more and make sure everything is organised and easy to find. The auditor has limited time; searching for documents is wasted time.
During the audit
Be honest and open. If something is not perfect, it is better to admit it than to hide it. Auditors value honesty and will judge more harshly if they feel things are being withheld.
Give concrete answers with examples. Not: “Yes, we do incident management.” But: “Yes, here is our incident register, and here you can see the three incidents we have had this month and how they were handled.”
Take notes of findings and feedback. This helps you start working on improvements after the audit.
What if you fail the ISO 27001 audit?
Not passing the audit is disappointing, but it is not a disaster. It means there is work to do, but that work is usually manageable.
For a major nonconformity, first analyse what went wrong. Was it a problem with the implementation, with the documentation, or with understanding the standard? Create an action plan to correct the nonconformity and carry it out. Provide evidence to the certification body and plan a re-audit of the problem areas.
Most organisations that do not pass succeed at the re-audit. It requires extra time and money, but it is not a final verdict on your organisation.
The annual ISO 27001 surveillance audit
After certification, the auditor returns every year for a surveillance audit. This audit is shorter than the initial audit, usually about half the time.
The surveillance audit does not check the whole ISMS, but a selection of parts. The auditor looks at what has changed since the last audit, the status of any earlier findings, and specific parts of the standard on a rotating basis.
Prepare for surveillance audits as if they were the initial audit. Too many organisations let the ISMS slip after certification and are then surprised by problems at the surveillance audit.
How do you choose a certification body for ISO 27001?
Not all certification bodies are the same. Choose carefully.
Accreditation
Choose a body that is accredited by the Dutch Accreditation Council (RvA) or a comparable national accreditation body. Accreditation means that the body itself has been checked for quality and independence. Many clients do not recognise a certificate from a body that is not accredited.
Experience and specialisation
Some bodies have more experience in certain sectors. An auditor who knows your sector understands the specific risks and can ask more relevant questions. Ask about the body’s experience in your industry.
Costs and approach
Compare quotes, but do not look only at price. A cheap audit that is not thorough enough has little value. Ask about the body’s approach: how they communicate, how flexible they are with scheduling, and how they handle findings.
Well-known certification bodies in the Netherlands
Certification bodies active in the Netherlands for ISO 27001 include Kiwa , BSI , TÜV , DNV , Bureau Veritas , and LRQA . Each has its own character and approach.
The mandatory internal audit for ISO 27001
Alongside the external audit, you must also carry out internal audits. This is a requirement of the standard and a valuable practice for finding problems early.
Who carries out the internal audit?
The internal auditor must be independent of what is being audited. You may not audit your own work. For smaller organisations, this often means bringing in an external party or having employees from different departments audit each other.
The auditor must know the standard and know how to audit. Training in internal auditing is advisable for anyone who wants to do this in-house.
How often?
The standard does not say exactly how often, but you must audit all parts of your ISMS regularly. Most organisations complete a full cycle every year, either all at once or spread across the year.
Plan the internal audit well before the external audit, so you have time to resolve findings.
What do you record?
Document the audit plan, the audit report with findings, the corrective actions taken, and the evidence that the actions are effective.
Working on this further
Prepare the conversations with your team using the ISO 27001 audit questions and evidence matrix. It shows, per topic, which question you can expect and how to link a policy to evidence from practice.
More information
- Step-by-step plan: from zero to certificate
- Internal audit: how to plan and carry out the internal audit
- Awareness and training: what the auditor checks on security awareness
- Requirements of the standard: what does ISO 27001 require?
- Frequently asked questions: answers to practical questions
- ISO 9001 audit: compare with the quality standard audit