Surveillance Audits

Surveillance Audits

Surveillance audits are the annual checkups that keep your ISO 27001 certification valid. Understanding what auditors look for and how to prepare is crucial for success.

What is a Surveillance Audit?

A surveillance audit is an annual assessment conducted in Years 1 and 2 of your certification cycle to verify that your ISMS continues to operate effectively.

Key Characteristics

Audit Scope and Focus

What Gets Audited

Core ISMS Elements (Always):

• Management review meetings
• Internal audit program
• Corrective action status
• Risk assessment updates
• Document and record control

Sample of Annex A Controls:

• Auditors rotate through different controls each year
• Typically 30-50% of applicable controls tested
• Focus on high-risk or changed areas
• Previously identified weaknesses revisited

Changes Since Last Audit:

• New systems or processes
• Organizational changes
• Scope modifications
• Major incidents or breaches

The Surveillance Audit Process

Phase 1: Pre-Audit (1-2 Months Before)

Certification Body Actions:

• Send audit notification
• Request updated documentation
• Confirm scope and schedule
• Assign auditor(s)

Your Actions:

• Conduct internal audit
• Hold management review
• Close open findings from previous audit
• Prepare evidence folders
• Brief key personnel

Phase 2: Opening Meeting (30 Minutes)

Typical Agenda:

• Introductions and roles
• Audit scope confirmation
• Schedule review
• Logistics and access
• Questions and clarifications

What to Prepare:

• Conference room with privacy
• Wifi access for auditors
• Organization chart
• Contact list
• Recent management review minutes

Phase 3: Audit Execution (1-2 Days)

Day 1 Focus:

• Documentation review
• Management interviews
• Risk assessment examination
• Internal audit review
• Corrective action status

Day 2 Focus:

• Control testing and evidence review
• Staff interviews
• System demonstrations
• Site inspection (if applicable)
• Findings compilation

Phase 4: Closing Meeting (1 Hour)

Auditor Presents:

• Positive observations
• Non-conformities (if any)
• Opportunities for improvement
• Overall assessment
• Next steps

Your Response:

• Acknowledge findings
• Clarify any misunderstandings
• Commit to correction timeline
• Thank the audit team

Phase 5: Post-Audit (1-4 Weeks)

Immediate Actions:

• Debrief with internal team
• Begin corrective actions
• Document lessons learned

Formal Response:

• Submit corrective action plan
• Provide evidence of corrections
• Await certification body approval
• Certificate remains valid

What Auditors Look For

Evidence of Continuous Operation

Good Indicators:

• Regular management review meetings
• Completed internal audits
• Updated risk assessments
• Active corrective action logs
• Training records throughout the year

Red Flags:

• No activity between audits
• Last-minute document creation
• Inconsistent dates on records
• Staff unfamiliar with ISMS
• Policies never updated

Effectiveness of the ISMS

Auditors want to see that your ISMS actually works, not just that it exists on paper.

Questions They Ask:

• "How do you know this control is working?"
• "Show me evidence of this process in action."
• "What improvements have you made based on metrics?"
• "How do employees know their security responsibilities?"
• "What happened when [specific control] failed?"

Closure of Previous Findings

If your last audit had non-conformities or observations:

Auditors Will Verify:

• Root cause was identified
• Corrective actions were implemented
• Effectiveness of corrections
• Similar issues haven't recurred elsewhere

Be Prepared to Show:

• Original finding and cause analysis
• Corrective action taken
• Evidence of implementation
• Verification of effectiveness

Common Surveillance Audit Findings

1. Incomplete Internal Audits

Issue: Internal audit didn't cover all ISMS scope areas or all Annex A controls.

Prevention:

• Use a comprehensive checklist
• Rotate audit focus areas
• Cover all controls over audit program cycle
• Document reasons if areas excluded

2. Ineffective Management Review

Issue: Management review is just a formality with no real discussion or decisions.

Prevention:

• Include meaningful metrics and trends
• Discuss actual security incidents
• Make real decisions with actions assigned
• Show executive engagement

3. Stale Risk Assessment

Issue: Risk assessment hasn't been updated despite organizational changes.

Prevention:

• Schedule regular risk assessment reviews
• Trigger reviews for major changes
• Document why risks stayed the same (if applicable)
• Show trending of risk levels

4. Missing Records

Issue: Cannot find evidence of processes being followed.

Prevention:

• Implement systematic record-keeping
• Use tools to automate evidence collection
• Regular record completeness checks
• Clear retention and filing procedures

5. Awareness Gaps

Issue: Employees don't know about ISMS or their responsibilities.

Prevention:

• Regular security awareness training
• Onboarding includes ISMS introduction
• Visible security communications
• Test awareness periodically

Preparation Checklist

6-8 Weeks Before

• Schedule internal audit
• Review and update key documents
• Check all training records current
• Verify all previous findings closed
• Update risk assessment if needed

4-6 Weeks Before

• Conduct internal audit
• Hold management review meeting
• Address any gaps found internally
• Compile evidence folders
• Test system demonstrations

2-4 Weeks Before

• Brief all personnel who may be interviewed
• Confirm audit logistics with certification body
• Final document review
• Prepare workspace for auditors
• Review audit findings from last year

1 Week Before

• Final walkthrough of evidence
• Test any systems to be demonstrated
• Confirm attendee availability
• Print key documents (backup)
• Mental preparation and confidence building

Tips for Success

Do's

✓ Be honest and transparent - If something isn't working, acknowledge it ✓ Stay calm and professional - It's not personal, it's a process ✓ Ask for clarification - If you don't understand a question, ask ✓ Take notes - Document what's requested and discussed ✓ Show continuous improvement - Highlight what you've enhanced

Don'ts

✗ Don't bluff - If you don't know, say so and offer to find out ✗ Don't be defensive - Accept findings as opportunities ✗ Don't overshare - Answer questions directly and concisely ✗ Don't panic - Minor findings are normal and correctable ✗ Don't ignore observations - Even non-findings deserve attention

After the Audit

Corrective Actions

For any non-conformities:

1. Immediate correction - Fix the specific issue
2. Root cause analysis - Why did it happen?
3. Systemic correction - Prevent recurrence
4. Verification - Prove it's fixed
5. Documentation - Record everything

Continuous Improvement

Use the audit as fuel for improvement:

• What surprised the auditors (good or bad)?
• What was harder to demonstrate than expected?
• What processes could be streamlined?
• What documentation could be clearer?

Looking Forward

Each surveillance audit should be:

• Easier than the last - Your ISMS is maturing
• More confident - You know your system works
• Less stressful - Preparation is routine
• More valuable - External validation drives improvement

Next Lesson: Creating an annual ISMS calendar to stay on track.