How do we choose a certification body and agree our audit dates?

Start

We need to choose a certification body for ISO 27001

The pack selects and books the certification body in the controls phase and agrees the Stage 1 and Stage 2 dates then. The choice shapes the cost for three years and the date of the certificate, so it is worth doing deliberately.

• Then: Does a customer, tender or regulator say who may certify you?

Decision

Does a customer, tender or regulator say who may certify you?

The reason for certifying tells you who will read the certificate. If a contract or tender names a scheme, an accreditation or a form of wording for the scope, that decides the shortlist before price does. If you are not sure, answer yes and check.

• Yes, or not known: Write down what they require of the certificate and the body
• No: Shortlist bodies accredited for information security management

Step

Write down what they require of the certificate and the body

Record the requirement, such as accreditation, the way the scope must be worded and the date it is needed. A certificate from a body without recognised accreditation may not be accepted by the customers you are certifying for.

• Then: Shortlist bodies accredited for information security management

Step

Shortlist bodies accredited for information security management

Accreditation comes from a national accreditation body that is part of the international arrangement. Check in the accreditation body's own register that its accredited scope covers ISO/IEC 27001, in the current 2022 edition, and in the country where you will be audited. An accredited certificate normally shows the accreditation body's symbol. If a quote offers a certificate without it, ask why.

• Then: Has a shortlisted body, or a linked firm, advised or audited you?

Decision

Has a shortlisted body, or a linked firm, advised or audited you?

Accreditation rules treat consultancy or internal audits by a certification body or a linked firm as a significant threat to impartiality. The usual mitigation is a waiting period of about two years before it may certify the same system. If you are unsure of any link, answer yes and ask.

• No: Ask at least two bodies for quotes, by stage and by year
• Yes, or not known: Take it off the list and shortlist another

Step

Take it off the list and shortlist another

Do not try to argue the rule away. A body that is not impartial puts the certificate at risk, and an independent internal auditor or consultant can be a different firm. If the help ended long ago, ask the body in writing whether its waiting period has passed, and drop it unless it says so.

• Then: Shortlist bodies accredited for information security management (back to an earlier step)

Step

Ask at least two bodies for quotes, by stage and by year

Ask for the audit days per stage and per surveillance audit, not only the total, and check that the quote covers the three-year cycle including recertification. The pack's estimate for the first audits is 10 to 15 audit days for an organisation of 100 to 300 people. Its estimates are not quotes.

• Then: Is one quote far lower than the others for the same scope?

Decision

Is one quote far lower than the others for the same scope?

The pack says a lower quote with fewer audit days than other accredited bodies offer for the same scope is worth questioning. If you cannot explain the gap in days, answer yes.

• Yes, or not known: Ask why, and compare the scope and the audit days
• No: Compare on accreditation, experience and dates, then choose one body

Step

Ask why, and compare the scope and the audit days

Ask the body how it calculated the days from the people in scope, the sites and the complexity, and whether the scope in the quote matches yours. A short quote can cost more later if the body adds days or finds the audit was too thin.

• Then: Compare on accreditation, experience and dates, then choose one body

Step

Compare on accreditation, experience and dates, then choose one body

Weigh accreditation, experience with your sector, how it audits, the dates it can offer and what it provides after certification, not price alone. Speak to a reference from a similar organisation if you can. Record why you chose it, and keep the quotes.

• Then: Ask for dates with the lead time the body needs

Step

Ask for dates with the lead time the body needs

The pack's default lead time is 8 to 12 weeks, and the date you want may not be available. Book by the end of the controls phase. Ask the body what operating period it expects before Stage 2 and use that figure, never a shorter one. Ask whether the body accepts, at Stage 1, an approved internal audit programme with dated audits. The pack's own plan is to finish the audit and the management review before Stage 1.

• Then: Does the Stage 2 date leave the full operating period of records?

Decision

Does the Stage 2 date leave the full operating period of records?

The ISMS has to run for the operating period, 3 months by the pack's default, before Stage 2, so the date must come after that. Booking Stage 2 before the ISMS has run is a common mistake. If the controls will not have run long enough, answer no.

• Yes: Agree the gap between Stage 1 and Stage 2
• No, or not known: Move the Stage 2 date, not the operating period

Step

Move the Stage 2 date, not the operating period

Choose a later date. Rebooking now costs less than a Stage 2 that finds the records too thin. Moving the date is a deliberate decision for the sponsor and the body.

• Then: Agree the gap between Stage 1 and Stage 2

Step

Agree the gap between Stage 1 and Stage 2

The pack's default is 2 to 8 weeks, agreed with the body: long enough to close the concerns, short enough that Stage 1 is still current. Ask what happens if the gap runs long.

• Then: Read what the agreement says about the whole cycle

Step

Read what the agreement says about the whole cycle

Check surveillance, recertification, changes to scope, and what happens if an audit is missed. A certificate can be suspended, and later withdrawn, if surveillance audits are missed, so the budget must carry them.

• Then: Body chosen and dates booked: build them into the plan

Outcome

Body chosen and dates booked: build them into the plan

Put the dates in the plan and the readiness workbook, tell the sponsor, and keep the quotes and the impartiality answers as records.