ISO 27001 for IT managers 8: close findings and be ready for surveillance

Understand what needs to be closed

Start with the external or internal finding as written: criterion, evidence, gap and classification. Confirm the certification body's response deadline and acceptance process for external findings. Do not substitute a generic internet deadline for the one that applies to your assessment.

A correction deals with the immediate problem. Corrective action addresses its cause so it is less likely to recur. Effectiveness verification checks whether that action worked. All three can matter. Closing a ticket because the action owner says “done” does not establish the last step.

In the fictional Merefield example, an enabled CRM account remains after a contractor leaves. Disabling the account is a correction, subject to checking legitimate dependencies. Discovering why the CRM was omitted from the leaver process is the start of root-cause analysis. Revising the process and then checking subsequent cases are separate activities.

Investigate beyond the person who made the mistake

Ask how the work was triggered, what information was available, which decision was expected and what prevented detection. “Human error” is rarely enough to choose a durable remedy. If the process depended on a colleague remembering an unlisted SaaS application, another reminder email may not fix the design.

Check extent. Are other departed users affected? Do other applications sit outside the checklist? Was the contractor population missing from the source list? Record how you investigated the wider issue and any additional corrections. A finding based on a sample can reveal a larger population problem.

Avoid deciding the cause before looking at evidence. Interview the people involved, inspect the actual records and distinguish confirmed facts from hypotheses. Keep the investigation proportionate, but do not force a convenient explanation because the response deadline is approaching.

Write a corrective action that can be verified

Illustrative corrective-action record:
Finding: CRM removal not confirmed for selected leavers; one account still enabled.
Immediate correction: investigate affected access and remove unauthorised accounts.
Extent check: reconcile all leavers in the defined period with the service account lists.
Cause supported by evidence: cloud inventory changes did not update the leaver workflow.
Action: link service onboarding to the access-removal checklist; assign an owner and validation step.
Verification: review the next eligible leaver cases and test a newly added service path.
Closure decision: independent reviewer records result and any remaining gap.

This is an original example, not a completed record for your business. Replace it with actual evidence and dates. If no new leaver occurs before verification is due, use a labelled controlled test where appropriate and schedule an operational follow-up. Do not fabricate a real case or claim a simulation proves every future outcome.

For an external finding, submit the material in the requested format and confirm acceptance. Keep the original finding, your response, supporting evidence and the certification body's decision together. A response sent before the deadline is not automatically an accepted closure.

Measure whether the change survives ordinary work

Choose a verification method linked to the cause. If the issue was missing services, check that a new service enters the workflow. If it was late notifications, compare the notification and action times over suitable cases. If it was unclear ownership, confirm that the assigned person actually receives and completes the work.

Have someone sufficiently objective review the result. State the population, sample and limitations. If the fix fails, reopen the action and investigate rather than redefining success. Keep related risks and the SoA current where the implemented control has changed.

Prepare for ongoing certification

Certification is maintained through surveillance and recertification arrangements. NQA describes a three-year cycle with surveillance in the first two years and recertification in the third; confirm your own certification body's programme and deadlines. Do not treat a three-year certificate as permission to stop checking controls until its expiry date.

Put the recurring work into the same calendar that manages operations. Include risk reviews, internal audits, management reviews, objectives, supplier reviews and control checks at intervals appropriate to the system. Schedule according to your obligations and risk, not a claim that ISO prescribes one frequency for every activity.

Keep evidence current as part of the work. An audit folder rebuilt once a year encourages missing records and optimistic reconstruction. If a check is overdue, record it and make a decision; do not backdate its completion.

Report progress in business terms

Give management a short view of significant risk, overdue treatment, recurring failures and decisions needed. Show what improved and what remains uncertain. Avoid a single “ISO compliance percentage” that mixes policy drafts, technical deployment and verified operation into one reassuring number.

When customers request assurance, share the current certificate and scope through the approved route. Check UKAS-accredited claims using the appropriate verification service where relevant. Provide additional evidence only after considering confidentiality and the actual request; a full internal risk register need not become a public attachment.

Final exercise: hand the system to someone else

Ask an authorised colleague to find the current scope, one risk decision, one operating control, the last internal-audit result and an open corrective action. They should be able to identify owners and next steps without relying on your memory. Correct missing links and stale responsibilities.

You finish this series with a business-owned programme, traceable risk decisions, working evidence and a realistic audit response process. Keep improving the parts that make daily work safer and more reliable. The certificate is useful assurance; the maintained system is what helps the organisation keep its promises.

Check your understanding