Audits & Certification
Understanding What a Major Nonconformity Really Means Let me be blunt: that sinking feeling when you receive a major nonconformity isn't the crisis your executive team thinks it is. In fifteen years of conducting Stage 2 audits, I've issued hundreds of major nonconformities to organizations that
Audits & Certification
The Dangerous Illusion of Paper Compliance Last year, I audited a financial services firm that had what appeared to be an immaculate Information Security Management System. Their documentation was pristine—beautifully formatted policies, comprehensive procedures, risk registers with perfectly calibrated scores. Their internal audit reports showed minor findings, all closed
Audits & Certification
1. Risk Assessment Methodology That Exists Only on Paper This is the single most common major nonconformity I raise, and it stems from a fundamental misunderstanding of Clause 6.1.2 requirements. Organizations create beautiful risk assessment methodologies—sometimes 30+ page documents with elaborate matrices, scoring systems, and workflows—then
Audits & Certification
Your Certificate Has an Expiration Date — Here's What Happens Next That ISO 27001 certificate hanging in your lobby isn't permanent. It expires every three years, and what happens during those three years determines whether recertification is a smooth process or a scramble to rebuild everything from
Audits & Certification
What Surveillance Audits Really Are Your ISO 27001 certificate lasts three years, but certification bodies don't just hand you a certificate and walk away. They come back to check on you—twice. These visits are called surveillance audits, and they happen at 12 and 24 months after your
Audits & Certification
The Reality Check: What Actually Happens in Stage 2 Stage 2 is where the theater ends and reality begins. I've walked into organizations that breezed through Stage 1 with beautiful documentation, only to watch them stumble spectacularly when I asked their receptionist what to do if someone tailgates
Audits & Certification
Three months ago, a manufacturing client called me in a panic. They'd spent six weeks choosing between certification bodies, comparing accreditation details and pricing models. Meanwhile, their biggest customer had just asked for their ISO 27001 certificate—and they didn't have one. The certification body decision
Audits & Certification
What Actually Happens During ISO 27001 Certification Your ISO 27001 certification isn't a single event—it's a two-stage process that can make or break your timeline and budget. I've seen companies prepare flawlessly for months, only to stumble because they misunderstood what auditors look
Audits & Certification
The Uncomfortable Truth About Internal Auditor Selection The internal audit program lives or dies based on the people you put in those seats. I've watched organizations burn through three audit cycles with zero meaningful findings because they staffed their program with whoever had the lightest workload that quarter.
Audits & Certification
Common Internal Audit Failures and How to Avoid Them I've reviewed thousands of internal audit reports over my career, and I'd estimate that roughly 70% of them are fundamentally worthless. Not because the auditors were incompetent—most weren't—but because organizations treat internal audits
Audits & Certification
Understanding What You're Actually Auditing Before diving into the checklist itself, let's address a fundamental misunderstanding I encounter constantly: internal audits aren't compliance checks against every single control. Clause 9.2 requires you to audit against "the organization's own requirements for
Audits & Certification
The Anatomy of Findings That Actually Drive Change After conducting hundreds of ISO 27001 internal audits, I've learned that finding problems is the easy part. Any competent auditor can walk through an organization and identify nonconformities. The real challenge—the one that separates auditors who drive genuine improvement