An ISO/IEC 27001 certification audit runs in two stages: a documentation review (stage 1), then an implementation audit (stage 2) during which the auditor verifies that the management system works as documented. Findings are classified as major nonconformities (a missing requirement or a systemic breakdown, which blocks the certificate until the correction is verified) and minor ones (an isolated lapse, which calls for a corrective action plan). The number of organisations going through this exercise grows every year: the ISO Survey counts around 96,700 valid ISO/IEC 27001 certificates worldwide at the end of 2024. This article draws on the nonconformity analyses published by accredited certification bodies to identify the areas where findings concentrate, and on the text of the standard to describe how to address them.
What the published data shows
Two certification bodies have published quantified analyses of their audits. DNV, covering more than 1,700 companies certified to ISO/IEC 27001 (2018 data, 2013 version of the standard), reports that 78% of audited companies had at least one finding and 40% at least one severe finding (major or minor nonconformity). Severe findings concentrate on risk assessment (clause 6.1.2) and risk treatment (clause 6.1.3), followed by user access rights review and asset inventory. Nearly 40% of companies also had findings on the former section A.12 (operations: systems management, backups, logging, technical vulnerabilities).
NQA, across its audit portfolio (also on the 2013 version), reports that internal audit (clause 9.2) generates more nonconformities than any other clause, and that clause 4 (context of the organisation) produces recurring gaps on two points: internal and external issues insufficiently defined, and a scope that is missing or incomplete.
These analyses cover the 2013 version; the structure of clauses 4 to 10 remained stable in the 2022 version, and the controls of the former section A.12 now sit among the technological controls of the revised Annex A. The areas of concentration therefore remain readable for a current audit, even if the percentages cannot be transposed as they are.
Area 1: risk assessment and treatment
This is the standard's central mechanism, and the first source of severe findings at DNV. Clause 6.1.2 requires a defined assessment process (acceptance criteria, repeatable method, identified risk owners) and clause 6.1.3 a treatment plan linked to the statement of applicability (SoA). The typical gaps follow from the requirements: an analysis done once and never revisited, risks without an owner, and above all a broken chain between the identified risks, the controls selected in the SoA and what is actually in place. Preparation means maintaining a living risk register and an SoA where every line is justified by a risk or a reasoned exclusion.
Area 2: internal audit and management review
Internal audit (clause 9.2) tops the list at NQA. The standard requires a planned audit programme, objective and impartial auditors, results reported to management and corrective actions followed up. For an SME the difficulty is structural: nobody in house is both competent and independent from the system being audited. The accepted solutions are a periodic external auditor or a peer arrangement, as long as objectivity is demonstrable. Management review (clause 9.3) follows the same evidence logic: the standard lists the expected inputs and outputs; a dated record that covers them, followed by actions, is sufficient.
Area 3: context and scope
The clause 4 gaps reported by NQA (poorly defined issues, missing or incomplete scope) are corrected upstream, because everything else depends on them: a vague scope makes the SoA and the risk assessment indefensible. The standard asks for documentation of internal and external issues (4.1), interested parties and their requirements (4.2) and the boundaries of the system with their interfaces (4.3). For a single-product SME, a few precise pages beat a generic chapter: what is in scope, what is not, and why.
Area 4: day-to-day operations
The concentration of findings on the former section A.12 at DNV points to the controls the organisation declares it applies daily: tested backups, logging and monitoring, change management, handling of technical vulnerabilities, periodic access rights review, an up-to-date asset inventory. The auditor samples execution evidence there (a dated restoration test, a traced access review); a procedure with no trace of application produces a nonconformity just like a missing procedure. This is the principle described in our article on the security policy: the gap is measured against what the organisation declared it does.
Preparing the audit from the assessment
These four areas match the real delta between a security baseline and a certifiable management system: SoA, risk treatment methodology, internal audit, management review. That is precisely the perimeter covered by Komplyo's ISO 27001 workspace: the derived then comprehensive readiness measures the gap clause by clause, the SoA exports from the computed coverage, and the delta questions (risk treatment, internal audit, management review) are asked once, articulated with the existing CSF assessment. To situate certification against the other targets, see ISO 27001 or SOC 2; the free diagnostic (23 questions, around 5 minutes) gives a first reading of the baseline.