Switching ISO 27001 certification bodies mid-cycle

A transferred certificate does not start a new three-year cycle. Under the accredited transfer arrangement, the certification cycle continues from the previous cycle, so the next recertification and the annual audit requirement stay on the timeline the outgoing body already set. Your task before the transfer is to record exactly where you sit in that cycle: the date of the last recertification decision, the date of each surveillance audit completed so far, and the date by which the next audit is due in each calendar year.

ISO/IEC 17021-1 treats a management system certification cycle as three years, with at least one audit, either surveillance or recertification, in every calendar year. The new body therefore has to build its audit programme around dates that already exist, not around a fresh schedule it prefers. If your last surveillance audit was late in one year, the next audit must still fall within the calendar year the standard requires, and a new body that proposes a first visit in a later month may be creating a gap. Ask the new body to show, in writing, which calendar year each audit falls in and how that matches the cycle dates on your current certificate.

For later cycles, the European Accreditation FAQ 48.12 explains that the audit programme is developed for the full cycle after the recertification decision, because the new cycle begins with that decision. Ask the new body for the complete programme covering the remaining cycle, including the planned audit dates, the audit days and the scope covered at each visit. Confirm the exact dates in writing before the transfer is completed, and keep that letter with the pre-transfer review file so that any later dispute about timing can be settled from the record.

The most important independence rule for a transfer is that the new certification body cannot be the one that helped you build the system. Under ISO/IEC 27006-1, a certification body may not provide internal ISMS reviews to a client it certifies, and it must stay independent of whoever performs the client's internal ISMS audit. European Accreditation FAQ 49.4 confirms that the rule carries no two-year mitigation period, so a body that ran your internal audit cannot certify you after a waiting period. Before you sign with a new body, confirm in writing that it has not provided internal audit, gap assessment or consulting services to you in the period covered by the rule.

The rule matters most when an outside consultant or implementation partner is involved in your internal audit. If the same firm writes your Statement of Applicability, runs the internal audit and then recommends a certification body, the independence question sits with the people who prepared your evidence. Your internal auditor should be someone other than the person who built the controls being audited, and the certification body must be independent of whoever performs that internal audit. Ask the new body to confirm, before the pre-transfer review, which firms it has worked with on your ISMS and whether any of its staff have advised you directly.

DeployOpen prepares systems, controls and evidence for an assessment, and it can run security testing and support the internal audit work that your organization owns. It does not issue certificates and does not act as a certification body, so it cannot be the body that accepts your transfer or grants the continued cycle. Ask any implementation partner to state its role in writing, and ask the new certification body to list every party whose work it will rely on. Keeping those roles separate from the start protects the transfer and the certificate that follows it.

Most stalled transfers trace back to records the organization should have had ready before it contacted a new body. Under Global ACI-TECH-3-002, a certificate can only move if it is valid, accredited and has completed its required surveillance or recertification audits. Before approaching anyone, pull together the audit reports from every surveillance audit in the current cycle, the current Statement of Applicability with its revision history, and the management review and internal audit records that support them. A gap in any of these forces the new body to treat the client as a new applicant, which resets the timeline. Ask the current certification body to confirm in writing which audits are on its file and when each was completed.

Check accreditation yourself before you sign anything. A certificate that looks official may not be accredited, and the transfer route only applies to accredited certification. Search the certificate holder and certification body in IAF CertSearch and confirm the accreditation status and scope listed there. Then look at the scope statement on the certificate and compare it with the scope in your current Statement of Applicability. If the wording is vague, or the scope has changed since the last audit without a formal update, the new body must review it again, and that review is often where weeks are lost. Fix scope ambiguity with your current body before the transfer request, not during the pre-transfer review.

Overdue internal audits and management reviews are the least visible cause of delay and the easiest to prevent. A new body will ask for evidence that the internal audit programme and management review ran as planned in each year of the cycle, and it will test whether findings were closed. Build a dated calendar of these activities, confirm that each one happened with signed records, and note any open corrective actions and their status. If a record is missing, do not backdate it. Document the gap honestly and agree with the new body how it will be handled, since a clear account of an old lapse is far easier to assess than a file that looks reconstructed.