For ISO 27001 the certification body runs the Stage 1 and Stage 2 audits, the yearly surveillance audits and the recertification audit, and it can suspend or withdraw a certificate. It is itself assessed by an accreditation body such as Swedac, UKAS, DAkkS or ANAB, which is what makes its certificates recognised across borders.
Buyers accept certificates from any accredited body, so the choice comes down to accreditation for ISO/IEC 27001, experience in your sector and auditor availability. See surveillance audit.
Read more
Related terms
- Accreditation body
- An accreditation body is the national authority that assesses certification bodies and authorises them to issue ISO management system certificates.
- International Accreditation Forum
- The International Accreditation Forum is the association of accreditation bodies whose mutual recognition makes accredited ISO certificates valid worldwide.
- Stage 1 audit
- A Stage 1 audit is the first part of an ISO 27001 certification audit, in which the certification body reviews the ISMS documentation and readiness for Stage 2.
- Stage 2 audit
- A Stage 2 audit is the main part of ISO 27001 certification, in which the certification body tests that the ISMS is implemented and operating as documented.
- Surveillance audit
- A surveillance audit is the yearly audit a certification body performs between ISO certification audits to confirm the management system is still maintained.