Table of Contents
What is ISO 27001 AuditTypes of ISO Audit
What is ISO 27001?
As a standard, ISO 27001 was developed by the International Organization for Standardization. It is the foundation of an organization’s Information Security Management System. It is divided into two sections: clauses (requirements) and annexe A controls (optionally used for reducing identified information security risks).
ISO 27001 Audit
An ISO audit will examine an organization’s Information Security Management System. This is to ensure that it meets the standards of ISO 27001 standard. The ISMS is a method for ensuring confidentiality, integrity, availability, and security of an organization. It’s based on identifying possible risks to an organization’s information through risk assessments and managing those risks through the implementation of security measures.
Types of ISO Audit
There are three main types of audits in quality control, depending on the relationship between an auditing party or subject.

1. Third-Party Audit: When a company decides to create a Quality Management System, a third-party audit is done. The QSM must meet a set of requirements. To ensure that the QSM succeeds, an outside organization is hired to perform an audit. These organizations are also known as certification bodies or entities. These organizations conduct audits to verify that the QMS meets the established standards.
Certification audit: There are two stages to the initial certification process.

Stage 1 Documentation review: An external auditor examines the ISO 27001 document that you have prepared, compares it with the ISO standard, then verifies compliance. The auditor will request that you examine all documentation for the ISMS.
Stage 2: Main audit: This stage includes an audit to verify that your ISMS conforms to ISO standards. The auditor will evaluate the effectiveness of preventive measures and mitigation measures, and review the activities from Stage 1 ISO 27001 audit in order to confirm that improvement requests have been addressed.
Maintenance or surveillance audit: These audits are required to maintain ISO 27001 certification. However, they are not as thorough as Stage 2 ISO 27001 assessments. The audit is usually performed after the second and third years of certification. The auditor follows the same procedure as Stage 2 ISO 27001 audit. This includes reviewing anomalies and corrective action, document updates, maintenance, performance, and other aspects.
Re-certification audit: A Recertification Audit is similar to Stage 2 ISO 27001 audit. It includes an assessment of any audit non-conformities and OFI (Opportunity for Improvement).
2. Second-Party Audit: An organization conducts a second-party audit to verify that vendors are adhering to the agreement’s terms. These requirements include exceptional control over these methods (such soldering or welding), traceability (knowing which features are in which products), quality standards, collected data, and a variety other things that may be of particular interest to the client. These audits can be done on-site by reviewing the procedures or the submitted documents of the supplier. Note that certification is not achieved by a second-party audit.
Many people believe that a second-party audit should not be performed after an organization is certified by ISO 9001. However, this is false. Even if you have been certified by a third-party auditor, clients may still want to perform a second-party inspection to verify your claims.