ISO 27001 audit: every kind, who runs it and the rule behind it

“ISO 27001 audit” can mean three different things: the audits you run on yourself, the audits your customers run on you, and the audits a certification body runs to certify you. They have different rules, different people and different consequences. This page sets out every kind, with the clause that governs it, and links to the page that covers it in detail.

Every kind of ISO 27001 audit

Audits you run: internal audit

“The organization shall conduct internal audits at planned intervals to provide information on whether the [information security] management system: a) conforms to: the organization’s own requirements for its [information security] management system; the requirements of this document; b) is effectively implemented and maintained.” That is the harmonized-structure text ISO/IEC 27001 applies. “The organization shall plan, establish, implement and maintain (an) audit programme(s), including the frequency, methods, responsibilities, planning requirements and reporting.”

Objectivity

For each audit the organisation shall “select auditors and conduct audits to ensure objectivity and the impartiality of the audit process”. An internal audit can be done by staff or by an outside auditor you hire; what it cannot be is an audit of your own work that nobody else checks. Evidence of it must exist: “Documented information shall be available as evidence of the implementation of the audit programme(s) and the audit results.”

Who cannot do it for you

Your certification body. ISO/IEC 17021-1 bars it from providing internal audits to its certified clients, and doing so would stop it certifying you for two years. Detail on internal audit.

Audits your customers run: second-party audits

A customer auditing its supplier is not certifying anything; it is checking a contract. In UK data protection law there is one place this is a right rather than a favour. A processor's contract must say the processor “makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller” (UK GDPR Article 28(3)(h)).

Does a certificate replace a customer audit?

Not by law. Article 28 lets the controller audit or mandate an auditor. A current ISO/IEC 27001 certificate, with a scope covering the service, is evidence a customer can choose to accept instead — our reading; the choice is the customer's. How to check a certificate is on certificate verification.

Audits a certification body runs

“In the definitions which follow, the term “audit” has been used for simplicity to refer to third-party certification audit.” “Certification audits include initial, surveillance, re-certification audits, and can also include special audits.”

The three-year programme

“The audit programme for the initial certification shall include a two-stage initial audit, surveillance audits in the first and second years following the certification decision, and a recertification audit in the third year prior to expiration of certification.” And: “Surveillance audits shall be conducted at least once a calendar year, except in recertification years. The date of the first surveillance audit following initial certification shall not be more than 12 months from the certification decision date.”

Stage 1 and Stage 2

The initial audit is in two stages. “The purpose of stage 2 is to evaluate the implementation, including effectiveness, of the client’s management system. The stage 2 shall take place at the site(s) of the client.” Stage 1 decides whether you are ready for it. See Stage 1 and Stage 2.

Surveillance and recertification

Surveillance audits sample the system in the two years between; the recertification audit looks at it whole: “The purpose of the recertification audit is to confirm the continued conformity and effectiveness of the management system as a whole, and its continued relevance and applicability for the scope of certification.” See surveillance audits and recertification.

Special audits

Extending the scope

“The certification body shall, in response to an application for expanding the scope of a certification already granted, undertake a review of the application and determine any audit activities necessary to decide whether or not the extension may be granted. This may be conducted in conjunction with a surveillance audit.”

Short-notice and unannounced audits

“It may be necessary for the certification body to conduct audits of certified clients at short notice or unannounced to investigate complaints, or in response to changes, or as follow up on suspended clients.” A complaint about a certified supplier, or a significant change at the client, can therefore bring the auditor back between scheduled visits.

Joint, combined and integrated audits

ISO/IEC 17021-1's notes to the definition name three arrangements:

If you hold ISO 9001 or another management system standard alongside ISO 27001, the combined or integrated audit is where audit days can be saved. The rules are on integrated management systems.

How long certification audits take

Audit time starts from ISO/IEC 27006-1:2024 Table C.1, by the number of people doing work under the organisation's control, and is then adjusted. Four rows of it:

The full table and what those days cost are on the cost calculator.

On site or remote

““On-site” audits can include remote access to electronic site(s) that contain(s) information that is relevant to the audit of the management system.” Stage 2, though, “shall take place at the site(s) of the client”.

Where this fits

• Internal auditClause 9.2 in detail
• Stage 1 and Stage 2The initial certification audit
• Surveillance auditsYears one and two
• ISO 27001 checklistThe evidence each audit looks for

Common questions