How an audit runs
Four phases, in this order
- Readiness assessment
- Stage 1: preliminary review
- Stage 2: detailed evaluation
- Surveillance: ongoing review
Readiness assessment
Start your ISO journey with an optional readiness assessment: an objective review designed to gauge how prepared your organisation is to undergo an ISO audit. It evaluates your existing systems and practices against the requirements of the standards, and identifies any non-conformities present in your management system.
Stage 1: preliminary review
This preliminary phase reviews your existing Information Security Management System documentation and processes, to confirm you are ready for the more detailed Stage 2 audit. It assesses the scope of your ISMS, evaluates your policies and procedures against the in-scope standards, and identifies areas that need improvement.
Stage 2: detailed evaluation
The Stage 2 audit evaluates how effective your ISMS actually is. It is a comprehensive assessment of how well the system has been implemented and integrated into your operational processes. Auditors conduct detailed reviews and tests to confirm that the policies, controls and procedures established at Stage 1 are not only in place but are being followed.
Surveillance: ongoing review
The surveillance audit monitors your ongoing adherence to the in-scope standards. Conducted at annual intervals, it is an objective review of the sustained effectiveness of your management system, identifying areas for improvement and confirming continued alignment with the standards.
The certification lifecycle
What happens after the audit
Certification decision
A team of expert reviewers analyses the audit documents to confirm each certification aligns with our standards and regulatory guidelines. After each review we issue a concise audit report setting out the assessment, including a recommendation from the lead auditor.
Maintaining certification
Fortreum INTL maintains certification on the basis that the client continues to satisfy the requirements of the management system standard, through surveillance, recertification and special audit activities.
Suspending certification
Where clients significantly fail to meet requirements, skip audits or request suspension, we temporarily invalidate the certification until the issues are resolved. Unresolved issues lead to withdrawal of certification or a reduction in scope.
Scope expansion and reduction
Where required, we adjust the scope of a certification through a review process, evaluating changes to the client's system to either expand or reduce coverage in line with current standards and needs.
Why is ISO important?
ISO/IEC 27001 is more than a certification. It is evidence of an organisation's commitment to safeguarding its data assets. In an era where threats evolve continuously and a breach is costly in both money and reputation, ISO/IEC 27001 remains one of the few internationally recognised security frameworks.
Pursuing it means your organisation not only understands the value of information security but implements globally recognised practice to manage and reduce risk. Partners and customers recognise that dedication, which differentiates you from competitors and builds confidence in how you operate.
Why should my organisation care?
Ensuring the integrity and security of data is fundamental to sustaining trust, domestically and internationally. Pursuing ISO/IEC 27001 does not just underscore a commitment to information security — it is frequently a prerequisite for business across borders.
Prioritising the certification fortifies you against threats and signals to partners, stakeholders and customers that their data is held to a recognised standard.
Accreditation status
Our certification body is actively pursuing formal accreditation for the ISO/IEC 27001 standard. While we are in the process of obtaining formal accreditation, our certification body offers unaccredited ISO/IEC auditing services, adhering to the highest standards of the relevant frameworks.
Start with a gap assessment
Contact us to discuss your cyber and cloud business needs. We are happy to share our insights and work with you as your business evolves.