When audit evidence is missing, certification stalls

Summary

Most ISO 27001 certifications do not stall because a control is absent. They stall because the evidence that the control operates cannot be produced while the auditor is in the room. The nonconformities that recur across almost every audit cluster in four places: a risk assessment that no longer reflects the business, a Statement of Applicability that contradicts reality, a missing or non-independent internal audit, and a management review without the Clause 9.3 inputs. An auditor treats evidence nobody can locate the same way they treat evidence that was never created.

Which nonconformities do auditors write most often?

Auditors see the same handful of patterns regardless of sector, headcount, or how polished the documentation looked at Stage 1. The dominant one is the gap between paper and practice. Stage 1 reads beautifully, the policy set is complete and professionally written, and then in Stage 2 an employee is asked about the acceptable use policy and answers that they are not familiar with it. If employees don't know a policy, it only exists on paper, and auditors notice that in the interviews. The most frequent ISO 27001 nonconformities almost all trace back to that same disconnect.

Risk assessment and Statement of Applicability gaps

The risk register is one of the most revealing documents in the audit. Auditors look for evidence that it was worked on, not carried forward. A register completed two or three years ago, with the same entries copied into each annual review, tells the auditor that Clause 6.1.2 is being performed as a ritual. Auditors increasingly expect AI to appear in the risk register, and a register without any AI risk raises questions.

This is not a niche problem. The UK government's breaches survey found that only 30% of UK businesses carried out a cyber security risk assessment in the previous 12 months, and just 15% formally reviewed the risks posed by their immediate suppliers, with 6% looking at the wider supply chain (UK Department for Science, Innovation and Technology).

The Statement of Applicability is where that weakness becomes visible. Auditors trace each risk treatment decision back to the SoA and expect the justifications to be specific. A common wrong entry: marking remote access as not applicable because the organization is in the cloud. Secure remote access to the cloud is your responsibility, so marking it as not applicable rarely holds up without a strong justification. Exclusions that are convenient rather than reasoned are a reliable route to a nonconformity.

Internal audit and management review shortfalls

Clause 9.2 requires an internal audit program at planned intervals, and Clause 9.3 requires a management review with defined inputs. Both are regularly weak. The typical shortfalls are an internal audit that covered only the technical Annex A controls and skipped the clauses, an internal auditor who audited their own area, or a management review recorded as a calendar entry with no minutes and no documented decisions.

Neither can be reconstructed credibly after the fact, because both are dated. An auditor who sees a management review dated three days before the audit draws the obvious conclusion about leadership engagement.

Operational controls auditors flag repeatedly

Beyond the management system, the same operational nonconformities appear year after year:

• No documented supplier evaluation for critical vendors, and no annual re-review

• Access reviews described in policy at a quarterly cadence but performed once, or not at all

• Security awareness training with incomplete coverage, especially for new joiners and contractors

• An asset inventory that predates the last two cloud migrations

• An incident response process and a backup restore procedure that have never been tested

Each is cheap to fix in advance and expensive to explain on the day. Organizations that build these into a routine calendar tend to pass the certification audit cleanly rather than negotiating corrective action plans afterward.

What makes companies actually fail the certification audit?

Grading matters more than volume. An opportunity for improvement is a recommendation and carries no obligation. A minor nonconformity is a single lapse in an otherwise functioning element; the certificate can still be issued once a corrective action plan is accepted. A major nonconformity is the absence or complete breakdown of a required element, and it blocks the certification decision until it is closed and verified.

Two patterns produce majors. The first is a required element missing entirely. No risk assessment at all. No internal audit ever conducted. If Stage 1 shows no internal audit and no management review, the auditor recommends not going to Stage 2 yet, which is a delay rather than a failure, and a far cheaper outcome than a blocked certificate.

The second is a systemic breakdown within one clause area: an accumulation of minors that collectively show the process does not function. How a gap is graded is the certification body's judgement: the same gap across every system in scope can become a major, while isolated gaps are usually minors. When one is raised, the response matters: handling a nonconformity correctly means root cause analysis, correction, corrective action, and verification evidence, not a line in a spreadsheet marked closed.

What evidence do auditors examine most closely during Stage 2, and how do you produce it on demand?

Stage 2 is a sampling exercise. The auditor picks a leaver and asks for the access removal record, picks an incident and asks for the post-incident review, picks a supplier and asks for the assessment. The constraint is time. Evidence that cannot be located while the auditor waits is treated as evidence that does not exist.

That is why the biggest practical hurdle in a Stage 2 audit is rarely control design. It is retrieval. Nearly 90% of surveyed security and compliance practitioners manually map or re-document at least some evidence across frameworks, and 50.7% say getting time and input from technical teams is their biggest audit preparation bottleneck (Pentest-Tools.com). The underlying cause is fragmentation: 63% of compliance survey respondents say the disaggregated nature of data across their organization makes compliance harder, while 64% report that compliance technology investments have improved visibility of risks (PwC).

Tooling choices reflect the problem. Nearly 60% of surveyed organizations still run enterprise risk management on word-processing files and spreadsheets, only 21% use a dedicated platform, and just 49% say risk awareness truly permeates the organization (The Institute of Internal Auditors). Secfix, the compliance automation platform, centralizes evidence so it is traceable, dated, and current, which removes the dependency on one person knowing where everything lives.

Confidence is not the same as readiness. 74% of surveyed enterprise professionals believe their organization could pass an AI compliance audit today (Schellman). Auditors test that belief with a dated record request, and the answer arrives in minutes or it does not.

Key takeaways

• Rerun your risk assessment against this year's business, including AI systems, before you book Stage 2.

• Check every N/A in your Statement of Applicability and replace convenience exclusions with written justifications.

• Schedule the internal audit (Clause 9.2) and the management review (Clause 9.3) early enough to close what they find before the certification audit, with an objective and impartial internal auditor.

• Nominate a second person who can retrieve any piece of evidence without asking the ISMS owner.

• Ask employees at random what the policies say; if they cannot answer, fix awareness before the auditor tests it.

Frequently asked questions

What percentage of companies fail the ISO 27001 audit?

Outright failure is uncommon. Most organizations leave Stage 2 with one or more minor nonconformities and receive the certificate once a corrective action plan is accepted. The more frequent setback is a delay: the auditor recommends postponing Stage 2, or a major nonconformity holds the certification decision until the certification body has verified that it is closed.

What is an opportunity for improvement versus a nonconformity?

An opportunity for improvement is advice. It identifies something that would strengthen the ISMS but breaches no requirement, and it has no effect on the certification decision. A nonconformity is a documented failure to meet a requirement of the standard or of your own documented process, graded minor or major, and it always requires a response.

How does a surveillance audit differ from the initial certification audit?

Surveillance audits run annually, are shorter than the initial audit and sample part of the system rather than all of it. Every visit must cover internal audits, management review, actions on previous nonconformities, complaints, changes, and use of the certification mark. Keeping dated records across the whole year is how you maintain ISO 27001 certification without reconstructing evidence each spring.