What Auditors Check During the ISO 27001 Certification

The ISO 27001 has a standard document with a list of clauses that you will need to fulfill in order to pass your audit. Internal and external auditors will check this while undergoing the process. All of the requirements can be found under clause 9.2 of the ISO 27001 Standard.

We have a full checklist you can check out, but your ISO audit checklist should include the following:

• Scope of the ISMS
• Records of training and skills
• Risk assessment and risk treatment methodology
• Risk Treatment Plan
• Management review results
• Definition of security roles and responsibilities
• Inventory of assets
• Statement of Applicability
• Access control policy
• Operating procedures for IT management
• Incident management procedure
• Information security policy and objectives
• Business continuity procedures
• Internal audit programme and results

Common Mistakes and What Happens if You Fail

If you fail your audit, you risk having your certification status revoked until your organization is able to make changes and address any and all audit concerns. What you need to do is carry out an internal investigation and assessment to review the systems that your organization uses and implement the required changes within your ISMS to get it back on track.

Common mistakes that cause ISO 27001 audit failure include:

• Failure to adhere to the audit programming
• Over and under auditing sections of your system
• Incorrect/inappropriate auditing programmes
• Failure to act on alerts in a timely manner
• Lack of appropriate definitions within the audit

How Long Do Certification Audits Take?

The ISO 27001 audit is broken down into two phases, and it can take as long as six (6) months to complete. This is because the first phase requires an on-site inspection and a full audit of documentation so that any non-conformities can be fixed before the second phase. So long as these errors are fixed before the second phase, the full audit should go smoothly.

How Much Do ISO 27001 Certification Audits Cost?

ISO 27001 certification audit costs tend to vary according to the stage of auditing and the cost of implementation afterwards. This is a breakdown of the costs:

• Pre-audit preparations: $3-40,000
• Implementation costs: $1,000+ per year
• Certification audit costs: $10-50,000

Frequently Asked Questions