When audit evidence is missing, certification stalls

Zusammenfassung

Most ISO 27001 certifications do not stall because a control is absent. They stall because the evidence that the control operates cannot be produced while the auditor is in the room. The nonconformities that recur across almost every audit cluster in four places: a risk assessment that no longer reflects the business, a Statement of Applicability that contradicts reality, a missing or non-independent internal audit, and a management review without the Clause 9.3 inputs. An auditor treats evidence nobody can locate the same way they treat evidence that was never created.

Welche Abweichungen stellen Auditoren am häufigsten fest?

Auditors see the same handful of patterns regardless of sector, headcount, or how polished the documentation looked at Stage 1. The dominant one is the gap between paper and practice. Stage 1 reads beautifully, the policy set is complete and professionally written, and then in Stage 2 an employee is asked about the acceptable use policy and answers that they are not familiar with it. If employees don't know a policy, it only exists on paper, and auditors notice that in the interviews. The most frequent ISO 27001 nonconformities almost all trace back to that same disconnect.

Lücken in der Risikobewertung und im Statement of Applicability

The risk register is one of the most revealing documents in the audit. Auditors look for evidence that it was worked on, not carried forward. A register completed two or three years ago, with the same entries copied into each annual review, tells the auditor that Clause 6.1.2 is being performed as a ritual. Auditors increasingly expect AI to appear in the risk register, and a register without any AI risk raises questions.

Dies ist kein Einzelfall. Laut einer Studie der britischen Regierung haben nur 30 % der britischen Unternehmen in den vergangenen 12 Monaten eine Bewertung ihrer Cybersicherheitsrisiken durchgeführt. Lediglich 15 % haben die Risiken ihrer direkten Lieferanten formell überprüft, während nur 6 % die gesamte Lieferkette berücksichtigt haben (Britisches Ministerium für Wissenschaft, Innovation und Technologie).

Im Statement of Applicability werden solche Schwachstellen sichtbar. Auditoren gleichen jede Entscheidung zur Risikobehandlung mit dem SoA ab und erwarten konkrete Begründungen. Ein häufiger Fehler besteht darin, den Fernzugriff als „nicht anwendbar“ einzustufen, weil das Unternehmen Cloud-Dienste nutzt. Die Verantwortung für einen sicheren Fernzugriff auf die Cloud liegt jedoch bei Ihrem Unternehmen. Ohne eine fundierte Begründung lässt sich ein solcher Ausschluss daher kaum rechtfertigen. Werden Kontrollen lediglich aus Bequemlichkeit statt auf Grundlage einer nachvollziehbaren Bewertung ausgeschlossen, führt dies häufig zu einer Abeweichung.

Internal audit and management review shortfalls

Clause 9.2 requires an internal audit program at planned intervals, and Clause 9.3 requires a management review with defined inputs. Both are regularly weak. The typical shortfalls are an internal audit that covered only the technical Annex A controls and skipped the clauses, an internal auditor who audited their own area, or a management review recorded as a calendar entry with no minutes and no documented decisions.

Neither can be reconstructed credibly after the fact, because both are dated. An auditor who sees a management review dated three days before the audit draws the obvious conclusion about leadership engagement.

Operative Kontrollen, bei denen Auditoren immer wieder Mängel feststellen

Neben dem Managementsystem treten Jahr für Jahr dieselben operativen Abweichungen auf:

• No documented supplier evaluation for critical vendors, and no annual re-review

• Zugriffsrechte werden laut Richtlinie vierteljährlich überprüft, tatsächlich jedoch nur einmal oder überhaupt nicht

• Unvollständige Abdeckung durch Security Awareness Training, insbesondere bei neuen Mitarbeitenden und externen Auftragnehmern

• Ein Asset-Inventar, das seit den letzten beiden Cloud-Migrationen nicht mehr aktualisiert wurde

• Ein Incident-Response-Prozess und ein Verfahren zur Wiederherstellung von Backups, die noch nie getestet wurden

Each is cheap to fix in advance and expensive to explain on the day. Organizations that build these into a routine calendar tend to pass the certification audit cleanly rather than negotiating corrective action plans afterward.

What makes companies actually fail the certification audit?

Grading matters more than volume. An opportunity for improvement is a recommendation and carries no obligation. A minor nonconformity is a single lapse in an otherwise functioning element; the certificate can still be issued once a corrective action plan is accepted. A major nonconformity is the absence or complete breakdown of a required element, and it blocks the certification decision until it is closed and verified.

Two patterns produce majors. The first is a required element missing entirely. No risk assessment at all. No internal audit ever conducted. If Stage 1 shows no internal audit and no management review, the auditor recommends not going to Stage 2 yet, which is a delay rather than a failure, and a far cheaper outcome than a blocked certificate.

The second is a systemic breakdown within one clause area: an accumulation of minors that collectively show the process does not function. How a gap is graded is the certification body's judgement: the same gap across every system in scope can become a major, while isolated gaps are usually minors. When one is raised, the response matters: handling a nonconformity correctly means root cause analysis, correction, corrective action, and verification evidence, not a line in a spreadsheet marked closed.

What evidence do auditors examine most closely during Stage 2, and how do you produce it on demand?

Stage 2 is a sampling exercise. The auditor picks a leaver and asks for the access removal record, picks an incident and asks for the post-incident review, picks a supplier and asks for the assessment. The constraint is time. Evidence that cannot be located while the auditor waits is treated as evidence that does not exist.

That is why the biggest practical hurdle in a Stage 2 audit is rarely control design. It is retrieval. Nearly 90% of surveyed security and compliance practitioners manually map or re-document at least some evidence across frameworks, and 50.7% say getting time and input from technical teams is their biggest audit preparation bottleneck (Pentest-Tools.com). The underlying cause is fragmentation: 63% of compliance survey respondents say the disaggregated nature of data across their organization makes compliance harder, while 64% report that compliance technology investments have improved visibility of risks (PwC).

Tooling choices reflect the problem. Nearly 60% of surveyed organizations still run enterprise risk management on word-processing files and spreadsheets, only 21% use a dedicated platform, and just 49% say risk awareness truly permeates the organization (The Institute of Internal Auditors). Secfix, the compliance automation platform, centralizes evidence so it is traceable, dated, and current, which removes the dependency on one person knowing where everything lives.

Selbstvertrauen ist nicht gleich Auditbereitschaft. 74 % der befragten Fachkräfte aus Großunternehmen sind überzeugt, dass ihre Organisation bereits heute ein AI-Compliance-Audit bestehen könnte (Schellman). Auditoren überprüfen diese Einschätzung, indem sie Nachweise mit konkretem Datum anfordern. Ob diese innerhalb weniger Minuten vorgelegt werden können, zeigt, wie gut das Unternehmen tatsächlich vorbereitet ist.

Die wichtigsten Erkenntnisse

• Rerun your risk assessment against this year's business, including AI systems, before you book Stage 2.

• Überprüfen Sie jede als „nicht anwendbar“ (N/A) gekennzeichnete Kontrolle in Ihrem Statement of Applicability und ersetzen Sie unbegründete Ausschlüsse durch schriftlich dokumentierte Begründungen.

• Schedule the internal audit (Clause 9.2) and the management review (Clause 9.3) early enough to close what they find before the certification audit, with an objective and impartial internal auditor.

• Nominate a second person who can retrieve any piece of evidence without asking the ISMS owner.

• Fragen Sie stichprobenartig Mitarbeitende nach den Inhalten Ihrer Richtlinien. Können sie diese nicht erklären, sollten Sie das Sicherheitsbewusstsein stärken, bevor der Auditor es überprüft.

Häufig gestellte Fragen

What percentage of companies fail the ISO 27001 audit?

Outright failure is uncommon. Most organizations leave Stage 2 with one or more minor nonconformities and receive the certificate once a corrective action plan is accepted. The more frequent setback is a delay: the auditor recommends postponing Stage 2, or a major nonconformity holds the certification decision until the certification body has verified that it is closed.

What is an opportunity for improvement versus a nonconformity?

An opportunity for improvement is advice. It identifies something that would strengthen the ISMS but breaches no requirement, and it has no effect on the certification decision. A nonconformity is a documented failure to meet a requirement of the standard or of your own documented process, graded minor or major, and it always requires a response.

How does a surveillance audit differ from the initial certification audit?

Surveillance audits run annually, are shorter than the initial audit and sample part of the system rather than all of it. Every visit must cover internal audits, management review, actions on previous nonconformities, complaints, changes, and use of the certification mark. Keeping dated records across the whole year is how you maintain ISO 27001 certification without reconstructing evidence each spring.