It covers the whole ISMS, like a Stage 2 audit, rather than the part a surveillance audit samples, and it also looks at how the system has performed over the full cycle. It has to be completed, with any major nonconformities closed, before the current certificate expires, or there is a gap in certification.
Most organizations book it a few months before expiry for that reason. The ISO 27001 guide covers the audit cycle.
Read more
Related terms
- Surveillance audit
- A surveillance audit is the yearly audit a certification body performs between ISO certification audits to confirm the management system is still maintained.
- Stage 2 audit
- A Stage 2 audit is the main part of ISO 27001 certification, in which the certification body tests that the ISMS is implemented and operating as documented.
- Certification body
- A certification body is the independent organization that audits a management system against an ISO standard and issues the certificate when it conforms.
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.