Most organizations do not fail an ISO 27001 audit because their security is weak. They fail, or delay, because the evidence that their controls operate does not exist in a form an auditor can accept.
Get an ISO 27001 readiness review
ISMS
Statement of Applicability
Our job
When the auditor arrives, there is nothing left to discover.
Stage 1 audit
Documentation and readiness review. The auditor checks that the management system exists on paper and that its scope, risk assessment, Statement of Applicability and mandatory documents are coherent.
Stage 2 audit
Implementation audit. The auditor tests whether the system actually operates: whether risks were treated as decided, whether controls run and whether records exist.
Annual audits
Surveillance audits in years one and two confirm that the system keeps running after the certificate is issued, not only on audit day.
Renewal
A full recertification audit at the end of the three-year cycle. A system assembled for the certificate and abandoned afterwards becomes visible here.
Four themes — The 2022 revision restructured Annex A into four themes: organizational, people, physical and technological controls.
93 controls — Annex A now lists 93 controls instead of 114. Most were merged or regrouped rather than removed.
11 new controls — including threat intelligence, information security for cloud services, data masking, secure coding and monitoring activities.
Transition — The 2013 version has been retired. Certificates issued against it had to move to the 2022 edition by October 31, 2025.
Mapping, not rebuilding — If your ISMS was built against the 2013 structure, the controls largely persist. The Statement of Applicability and internal documentation need to be updated.
Where organizations actually lose time
Certification is rarely delayed by weak security. It is delayed by four avoidable mistakes in how the management system is built and evidenced.
01 Scope defined too widely: a scope that covers the whole company when only one product line needs certification multiplies the evidence you must produce.
02 The Statement of Applicability written last: it is the document that connects your risk assessment to the controls you selected and justifies every exclusion.
03 Evidence that was never collected: controls that run without leaving records are indistinguishable from controls that do not run.
04 Internal audit treated as a formality: internal audit and management review are mandatory clauses, and a superficial pass at them is one of the most common reasons Stage 2 goes badly.
What we do
Where you stand against ISO/IEC 27001:2022, mapped to what you already run, so we build on the controls that exist instead of replacing them.
Defining the certification scope around your commercial need, then a risk assessment that drives control selection rather than following it.
Policies, processes, roles and the Statement of Applicability, built so they can be operated by your team rather than by a consultant.
Running the system with you through at least one full cycle of the mandatory activities, so the records exist before the auditor asks.
Performed properly, with findings, because a real internal audit is what makes Stage 2 uneventful.
Preparing your people for the audit, being present during it, and handling findings through to closure.
ISO 27001: key questions
Who issues the ISO 27001 certificate?
An accredited certification body, independent of the organization that helped you implement the system. That independence is a requirement, not a formality: the same company cannot both build your ISMS and certify it.
We prepare you for that audit and support you during it. Where certification is the goal, we tell you at the start which body will be involved and what they will expect, so there are no surprises about who does what.
How long is an ISO 27001 certificate valid?
Three years. The certificate is issued after the Stage 2 audit, confirmed by surveillance audits in years one and two, and renewed through a recertification audit at the end of the cycle.
Our ISMS was built on ISO 27001:2013. Do we start again?
No. The work is mapping rather than rebuilding: the controls largely persist, but the Statement of Applicability and internal documentation need to reflect the 2022 structure of Annex A.
Why do organizations fail or delay certification?
Rarely because their security is weak. More often because the evidence that controls operate does not exist in a form an auditor can accept: scope defined too widely, a Statement of Applicability written last, records never collected, an internal audit treated as a formality.
Is ISO/IEC 27001 certification mandatory?
No. ISO/IEC 27001 is a voluntary international standard. In practice it is often required by customers, partners and tenders as proof that information security is managed systematically, and it helps show regulators that you take a risk-based approach to security.
How long does ISO/IEC 27001 certification take?
It depends on the scope and on how much of the management system already runs. The limiting factor is rarely documentation: before the Stage 2 audit the system has to operate long enough to produce evidence, including an internal audit and a management review. We give you a realistic timeline after the gap analysis.
How much does ISO/IEC 27001 certification cost?
It depends on the scope, the number of locations and people covered, and how mature your current controls are. The fee of the certification body is separate from implementation support. After the gap analysis we give you an estimate for our part of the work, so you can plan the budget before you commit.
What is a Statement of Applicability?
The document that lists the Annex A controls, states which ones apply to you and justifies every exclusion. It connects your risk assessment to the controls you selected, and it is one of the first documents an auditor reads.
Where to start?
Active Audit Agency provides extensive cybersecurity services for businesses, ensuring robust protection and compliance for organizations of various sizes.
You can copy our materials only after making sure that your services are safe.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.