External Audit ISO 27001

General Information 

ISO 27001 certifications are issued by accredited certification bodies. These organizations are authorized by accreditation bodies to perform certification audits and assess if a company’s Information Security Management System (ISMS) meets ISO/IEC 27001 standards. Compleye is not a certification body (referred to as “Audit Companies”), but we provide support through our platform and services. We are unable to issue certifications directly. 

To obtain certification, you will need to select and engage an Audit Company. The certification process spans over three years, and upon signing the contract, you will commit to a three-year agreement. 

External Audit Process 

The ISO 27001 audit process is structured as follows: 

Year 1: Two Stages of Audit: 

Stage 1: Eligibility Assessment 

• In this phase, the Audit Company evaluates if your organization is ready for certification. This involves introducing your business, discussing your scope and objectives, and reviewing how your ISMS is organized.
• The auditor will check if all mandatory areas (Chapters 4-10) are documented and implemented correctly. You will need to grant the auditor observer access to the Compleye Online environment, allowing them to review the documented evidence. 
• At the end of Stage 1, the auditor will confirm if you are ready to proceed to Stage 2. 

Stage 2: In-Depth Audit 

• The auditor will create a detailed agenda covering all topics for review. Your ISMS team members will be assigned to each relevant topic during the audit. 
• The auditor will request samples and check if your documented policies and procedures are effectively implemented. By the end of each audit day, a summary of non-conformities or improvement suggestions will be provided. 
• At the conclusion of Stage 2, the auditor will share preliminary results and begin drafting the final report. This report will undergo an internal review by the audit company before being finalized. 
• The final report, along with the certification documents, will be delivered to you within 2 to 8 weeks, depending on the audit company’s timeline. 

Year 2 & 3: Control Audits: 

• During these years, the auditor will return for control audits. These audits are less extensive than Year 1 but will still follow the final report from the previous year. 

• The auditor may revisit some topics and possibly explore new areas, depending on the scope and findings of previous audits. 

Selecting an Audit Company: 

When choosing an Audit Company, consider the following factors: 

• Customer Expectations: If your customers are already working with specific audit companies, it might be beneficial to align with them. 

• Location: If you have a physical office, selecting a local or regional audit company could be more cost-effective due to travel expenses. However, if you’re a fully online business, you can opt for an audit company experienced in remote audits and global operations. 

• Audit Approach: Some audit companies take a risk-based approach, focusing on your business’s specific risks and acting as supportive partners. Look for companies that align with your needs and business culture. 

• Comparison: Always obtain at least two quotes to compare the services and pricing of different audit companies. 

• Experience: Many audit companies work with independent contractors. Ask about the auditors’ experience with businesses similar to yours in terms of size and industry. Also, inquire about their audit focus, whether document-based or more technical. 

• Consistency of Auditor: An auditor can only work with your company for a maximum of three years. Some audit companies may rotate auditors annually, which may not be ideal. Ensure that the audit company has a clear approach regarding auditor rotation. 

Compleye works with DNV (https://www.dnv.nl/), chosen for their risk-based approach and flexibility. They provide auditors with experience in small-sized companies and an understanding of the agility required for our business. We also work with 3angles (https://3angles.nl/en/), another reputable audit company. 

Some International Audit Companies to consider: 

BSI, TUV, DNV, KPMG, Veritas, A-lign, Alcumus 

We recommend conducting a search for top audit companies in your country to find the best fit. 

Additional Tips for Working with Audit Companies 

Onboarding Process: Each audit company has its own onboarding process, typically starting with an intake form. The form is used to define the scope of the audit and help determine pricing and the proposal. 

Audit Time Requirements: The time required for the audit will depend on the size of your organization (i.e., number of employees) and the complexity of your IT infrastructure. 

Online Companies: If your company is fully online, inform the audit company early. This can reduce costs by eliminating the need for on-site visits. 

Pricing Estimates: 

• <25 FTE: €10-15K for 3 years 

• 25-50 FTE: €12-20K for 3 years 

• >50 FTE: €15-25K for 3 years (depending on the number of locations and IT infrastructure complexity) 

Start Early: Begin requesting quotes 3-5 months before your desired certification date, as audit companies may be busy during peak periods. 

Compleye Resources: In the Compleye Online Templates Section, you can find an “Audit Tips” document, which offers guidelines on how to prepare for (and avoid mistakes during) external audits.