The Certification Audit

What is the main purpose of a Stage 1 certification audit?

• ATo issue the certificate if no nonconformities are found
• BTo confirm that all controls are effective
• CTo assess readiness and identify areas of concern before Stage 2✓
• DTo verify the results of the internal audit programme only

Answer: Stage 1 evaluates whether the ISMS is ready to be audited in depth: documentation, scope, risk assessment and the SoA. It produces areas of concern rather than a pass, and the certificate cannot be issued at this stage.

What does a Stage 2 audit assess?

• AThe suitability of the certification body’s own procedures
• BOnly the documented information
• CThe implementation and effectiveness of the ISMS in practice✓
• DThe organisation’s financial standing

Answer: Stage 2 evaluates implementation and effectiveness, gathering evidence that the ISMS is operating as documented. Stage 1 is where the documentation itself is examined.

Which audits take place between certification and recertification?

• AFollow-up audits
• BSurveillance audits✓
• CStage 1 audits
• DInternal audits only

Answer: Surveillance audits are conducted during the certification cycle to confirm the ISMS continues to conform. Internal audits also continue, but they are the organisation’s own and do not replace surveillance.

Which standard sets out requirements for bodies providing audit and certification of management systems?

• AISO 19011
• BISO/IEC 27006
• CISO/IEC 27001
• DISO/IEC 17021✓

Answer: ISO/IEC 17021 sets the requirements for bodies providing audit and certification of management systems - it accredits the certifiers. ISO/IEC 27006 adds ISMS-specific requirements on top of it.

Which standard provides guidelines for auditing management systems?

• AISO/IEC 27007
• BISO 19011✓
• CISO/IEC 27001
• DISO/IEC 17021

Answer: ISO 19011 gives guidelines for auditing management systems, including principles, programme management and auditor competence. ISO/IEC 17021 is the requirements standard for certification bodies rather than guidance for auditors.

A major nonconformity is raised at Stage 2. What is the usual consequence?

• ACertification is withheld until the nonconformity is resolved and verified✓
• BThe organisation is barred from reapplying for twelve months
• CThe audit restarts from Stage 1
• DThe certificate is issued with the nonconformity recorded as an observation on it

Answer: A major nonconformity blocks certification until corrective action is taken and verified, often by a follow-up visit. Minor nonconformities are typically handled through an agreed corrective action plan.

What distinguishes a major from a minor nonconformity?

• AA major relates to Annex A and a minor to the clauses
• BA major represents a systemic failure or absence of a required process✓
• CA major is any nonconformity repeated twice
• DA major is one raised by an external auditor rather than internally

Answer: A major nonconformity indicates a total breakdown or absence of a required process, or a failure that raises significant doubt about the ISMS. A minor is an isolated lapse in an otherwise functioning process.

Who is responsible for determining the audit criteria for a certification audit?

• AThe organisation being audited, which sets criteria for its own assessment
• BThe certification body, based on the standard and the agreed scope✓
• CThe accreditation body that assessed the certification body
• DThe lead implementer, as the person accountable for the ISMS

Answer: The certification body sets the audit criteria for its own audit against the standard and the agreed scope. The organisation sets criteria for its own internal audits under Clause 9.2.

How long does a certification cycle typically run before recertification?

• AFive years, with a mid-cycle surveillance audit
• BOne year, with the certificate reissued each time
• CTen years, with annual self-declaration in between
• DThree years, with surveillance audits in between✓

Answer: ISMS certification is normally issued for a three-year cycle with surveillance audits in between, followed by a recertification audit. The exact arrangement is set by the certification body under ISO/IEC 17021.

What should the organisation provide the auditor at Stage 1 above all else?

• AAdministrative access to every system within the technical environment
• BThe scope, risk assessment, risk treatment plan and Statement of Applicability✓
• CThe internal audit reports covering the previous three years of operation
• DA list of all staff, with the security clearance held against each name

Answer: Stage 1 concentrates on whether the ISMS is ready: the documented scope, the risk assessment and treatment plan, and the SoA are the core artefacts. System access and detailed evidence gathering belong to Stage 2.

An auditor asks where the organisation states why it excluded an Annex A control. Which document should be produced?

• AThe internal audit report
• BThe information security policy
• CThe Statement of Applicability✓
• DThe risk treatment plan

Answer: The SoA is the document that accounts for every Annex A control, including the justification for exclusions. It is usually the first document a certification auditor asks to see.

What is the relationship between accreditation and certification?

• AAn accreditation body assesses the certification body, which certifies the organisation✓
• BA certification body accredits the organisation directly against the standard
• CThey are alternative names for the same assessment, used interchangeably
• DAccreditation of the organisation replaces the need for it to be certified

Answer: Accreditation bodies assess certification bodies against ISO/IEC 17021 and the ISMS-specific requirements of ISO/IEC 27006. The certification body then audits and certifies the organisation.