Auditors interview staff, sample records and inspect systems against clauses 4 to 10 and the controls declared applicable in the Statement of Applicability. They need evidence that the system has actually run, so at least one internal audit and one management review are expected to have taken place first.
Findings are graded as major or minor nonconformities or opportunities for improvement. The certificate is recommended once major nonconformities are closed and the corrective action plans for minor ones are accepted. See Stage 1 audit.
Read more
Related terms
- Stage 1 audit
- A Stage 1 audit is the first part of an ISO 27001 certification audit, in which the certification body reviews the ISMS documentation and readiness for Stage 2.
- Major nonconformity
- A major nonconformity is an audit finding that a mandatory requirement is missing or has broken down, serious enough to block or suspend an ISO certificate.
- Minor nonconformity
- A minor nonconformity is an audit finding of a single lapse or partial gap against a requirement that does not undermine the management system as a whole.
- Certification body
- A certification body is the independent organization that audits a management system against an ISO standard and issues the certificate when it conforms.
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.