Audits: questions and answers.
How a certification audit works and what to have in place before your auditor arrives.
How does an ISO 27001 certification audit work?
The initial audit has two stages. Stage 1 reviews your documentation and readiness; stage 2 tests whether the management system works in practice. After certification, surveillance audits follow in the next two years and a recertification audit in the third year.
What should be in place before an external audit?
A defined scope, a risk assessment and risk treatment plan, a statement of applicability, evidence per control, at least one internal audit and one management review, and follow-up of findings. The same set applies to ISO 42001, with the AI system impact assessment added.
What is a statement of applicability?
The statement of applicability (SoA) lists the Annex A controls, states whether each one is applicable, whether it is implemented and why. ISO 27001 and ISO 42001 both require one. In Basenorm the SoA follows from your choices per control.
Can our auditor work in Basenorm?
Yes. With the auditor role your auditor has read access to controls and evidence, and every action is recorded in the audit trail.
What is a nonconformity?
A nonconformity is a requirement that is not met. A major nonconformity means a requirement is not met at all or the management system fails on that point; it must be resolved before a certificate is issued or kept. A minor nonconformity is a partial or isolated shortcoming that you correct with a corrective action plan.
Book a demo
Your question not answered?
In a demo we answer your questions in the context of your own frameworks and scope.
- Where you stand with ISO 27001 and ISO 42001.
- Which frameworks apply to you.
- How Basenorm keeps your management system current.
Hosted in the Netherlands. Your data stays in the EU.