What an ISO 27001 audit asks of you in practice

We are ISO/IEC 27001:2023 certified ourselves and go through the audit every year. That makes our advice more concrete than a summary of the standard: we know where it chafes, because it chafed for us too.

Auditors test reality, not your folder

The biggest misconception is that an audit is a document check. An auditor reads your policy and then goes to see whether it holds. If it says you patch monthly, they want to see that in the management system. If it says new staff get an introduction, they ask for the most recent example.

From that follows a practical rule: write down nothing you do not do. A shorter policy that holds produces fewer findings than an extensive policy you do not follow.

What is almost always probed

Four subjects come up in every audit, and they are exactly the ones that erode when nobody maintains them:

• Access management. Who has which permissions, and why? Administrator accounts get extra attention.
• Offboarding. Have the permissions of departed staff been revoked, and can you demonstrate that per person?
• Supplier management. Which parties touch your data, what agreements are in place, and who reviews them?
• Incidents. What happened, what did you do about it and what was improved structurally?

Let records come out of the work

What made the biggest difference for us: stop maintaining documents that sit beside the work. Our evidence comes from the ticketing system, the monitoring and the patch reports. On- and offboarding runs through a fixed checklist signed off per employee.

Then preparing for an audit is a matter of exporting, rather than a week of reconstructing files.

The management review is not a formality

On paper this is a periodic meeting. In practice it is the only place where someone with a mandate decides that a risk is accepted or addressed. Auditors see straight away whether it was a real discussion or a box-ticking exercise.

What helps: a fixed agenda with incidents, changes in risk, audit findings, and the question of whether the measures still fit what the organisation does.

What it delivers beyond the certificate

For us the effect is mainly operational: fewer surprises, faster onboarding of new engineers and a clearer story towards customers. And since NIS2 it has a second function: customers who have to assess their supply chain can make do with the certificate and a few questions.