ISO 27001:2022 After the Transition: What Auditors Expect
The transition period for ISO 27001:2013 certificates ended on 31 October 2025. Here is what certification audits now focus on, and how to show your ISMS really runs.
In this article
The transition period for organisations certified to ISO/IEC 27001:2013 ended on 31 October 2025. Certified organisations now work to the 2022 edition. For most teams, the conversation has moved from "what changed" to "what will the auditor look for this year".
That shift matters. During the transition, auditors often focused on whether you had updated your documents. Now they expect the updated system to be working. This article explains where audits typically focus after the transition and how to prepare evidence that stands up.
1. From documents to operation
The 2022 edition reorganised Annex A into 93 controls in four themes and added 11 new controls. Most organisations updated their Statement of Applicability and policies during the transition. The question auditors now ask is simpler and harder: can you show that the controls you selected actually operate?
That means evidence over time, not just a well-written policy. A configuration management policy needs records of approved baselines and checks against them. A monitoring activities control needs alerts, reviews and follow-up actions. A secure coding control needs code review records or tool results.
Expect auditors to sample. They may pick a few controls from your Statement of Applicability and ask to see records from different months. If evidence exists only for the weeks before the audit, that pattern is easy to spot.
Auditors also look at how the system responds to change. If you moved to a new cloud provider, launched a product or reorganised teams during the year, they will ask how the risk assessment, the Statement of Applicability and the controls were updated. A system that only changes on audit day is a warning sign.
2. What auditors typically look at now
Every certification body has its own style, and you should check what your own auditor has told you. In general, though, post-transition audits tend to look closely at the areas below.
| Area | What the auditor usually wants to see |
|---|---|
| Statement of Applicability | Every one of the 93 controls addressed, with clear reasons for inclusion or exclusion. |
| The new controls | Evidence that the selected new controls run in practice, not only a policy. |
| Risk assessment | A current risk assessment that drives the choice of controls. |
| Internal audit | An internal audit programme that covered the updated system. |
| Management review | Decisions and actions from leadership, based on real results. |
| Cloud and suppliers | How cloud services and key suppliers are controlled and reviewed. |
The pattern is consistent. Auditors want to trace a line from risk to control to evidence to improvement. Where that line breaks, you usually get a finding.
Exclusions need a reason too. If you exclude a control, explain why the risk does not apply to you, rather than simply saying that the control is not relevant.
3. Prepare evidence that stands up
Start with your Statement of Applicability. For each included control, write down the evidence you would show and how often it is produced. This becomes your evidence calendar. Some evidence is continuous, such as logs and tickets. Some is periodic, such as access reviews, supplier reviews and backup tests.
Next, focus on the new controls that you included. They are often the least mature, because teams wrote the policy during the transition but have not yet built the habit. Threat intelligence, configuration management, data leakage prevention and monitoring activities are common examples where policy and practice drift apart.
Use your internal audit well. Ask the internal auditor to test the controls the way an external auditor would, with samples from different periods. Treat the findings as useful information rather than a judgement, and close them with clear actions and owners.
Look back at findings from earlier audits as well. Auditors normally check that previous nonconformities were closed properly, with a root cause and an action that worked. A finding that returns year after year suggests the fix treated the symptom rather than the cause.
Finally, prepare your people. Auditors interview control owners, not only the compliance lead. Make sure each owner can explain what the control does, how they run it and where the records are. Short briefings before the audit usually help more than long documents.
If you are planning your first surveillance audit on the 2022 edition, our ISO 27001 consulting team can help you build an evidence calendar, and our GRC tool automation service can help you collect the records automatically. Feel free to reach out if a second opinion would help.