Can your ISO 27001 certification body also do your gap analysis?
A certification body that will certify your ISMS should not run your gap analysis, internal audit or consultancy for that same system. Any preliminary audit it offers is limited by impartiality rules, and it cannot design or fix the system it will later judge. The answer depends on the type of work, whether the body is related to a consultancy, and whether the work falls before stage 1, between stage 1 and stage 2, or after certification. The rules come from ISO/IEC 17021-1 and ISO/IEC 27006-1, which accredited bodies apply to all ISO 27001 clients, and the detail is set out in European Accreditation guidance such as European Accreditation FAQ 33.15 on consultancy and European Accreditation FAQ 49.4 on internal reviews.
Roles need to stay clear. Your organization owns its controls, its risk decisions and its Statement of Applicability. An implementation partner such as DeployOpen prepares systems, configurations and evidence inside your environment, and it does not issue audit reports or certificates. Only the independent certification body issues the certificate. Ask the body in writing whether it, or any organization related to it, offers consultancy, gap analysis, pre-audits or internal audits for your client. If the answer is yes, ask how it has separated those teams and whether it will still certify you. Under the two-year mitigation in ISO/IEC 17021-1, a related consultancy can be accepted only if the body does not certify that system for at least two years after the consultancy ends. For internal ISMS reviews under ISO/IEC 27006-1, there is no such waiting period, so the body cannot provide them to a client it certifies.
Timing matters too. A preliminary audit before stage 1 can be acceptable if impartiality is protected, but it cannot be used as the stage 1 audit, and European Accreditation FAQ 49.2 warns that repeated preliminary audits to check whether earlier problems were fixed can amount to helping develop the system. Auditors may point out opportunities for improvement during audits but must not recommend specific solutions. Before you sign, confirm the scope of any pre-audit, who performs it, and that your gap analysis and corrective actions come from your team or a separate partner.
Which work a certification body can and cannot do for the same client
This table compares five kinds of ISO 27001 work against the certification body that will certify the client, showing whether the body may do it, the impartiality reason and who should provide it instead. Read the rows as the boundary for the certifying body, then check the alternative column before you sign with a provider. The main takeaway is that a pre-audit before stage 1 has limits, and consultancy or internal audit by a related body rules out certification of that system for at least two years, while ISMS internal reviews are barred outright.
| Work type | Certification body may do it for a client it will certify? | Impartiality reason and alternative provider |
|---|---|---|
| Gap analysis | No, under the consultancy rule for related bodies | Finding gaps and advising on fixes is consultancy. Under ISO/IEC 17021-1 clause 5.2.7, a related consultancy is a significant threat, and the recognized mitigation is no certification of that system for at least two years after the consultancy ends. Use an independent consultant or implementation partner. |
| Pre-audit before stage 1 | Possibly, if impartiality is protected | European Accreditation FAQ 48.11 accepts a pre-audit before stage 1 but not between stage 1 and stage 2, and it cannot replace the stage 1 audit. Repeated preliminary checks of fixes risk helping build the system (FAQ 49.2). Ask whether the body offers one and how it manages impartiality. |
| Internal ISMS audit | No, with no two-year mitigation | Under ISO/IEC 27006-1 clause 5.2.2, the certifying body may not perform internal ISMS reviews for a client it certifies, and it must be independent of whoever performs the client's internal audit, including freelance auditors. Use a separate internal audit provider. |
| Ongoing consultancy and implementation support | No, under the consultancy rule for related bodies | Writing policies, building controls or configuring tools is implementation work. The two-year mitigation under clause 5.2.7 applies to related consultancy. Use an implementation partner or your own team, and keep the certifying body in a purely assessing role. |
| Improvement suggestions during audits | Yes, as observations only | Under clause 5.2.2 of ISO/IEC 27006-1, auditors may point out opportunities for improvement but may not recommend specific solutions. Expect findings and observations, then design fixes with your own team or a consultant. |
When a pre-audit is acceptable and when it becomes participation in building the system
A pre-audit by your certification body is acceptable as long as it does not help you build the system it will later certify. European Accreditation FAQ 48.11 records IAF Technical Committee consensus that a preliminary audit before stage 1 can be acceptable if impartiality is not compromised, but not between stage 1 and stage 2. A preliminary audit is also not an internal audit by definition, because an internal audit is a first-party audit run by or for the organization itself. Treat it as a readiness look from an outside party, not as a substitute for the internal audit your own team must perform and keep records of. A pre-audit also cannot be counted as your stage 1 audit. Stage 1 is a separate step with its own output, so a document review done in a pre-audit does not replace it.
The line is crossed when the body keeps coming back to check whether its earlier findings were fixed. European Accreditation FAQ 49.2 (March 2025) says repeated preliminary audits made to confirm that earlier problems were corrected amount to taking part in developing the management system, which threatens impartiality. Pointing out a gap is one thing, but a cycle of findings, fixes and re-checks by the same body turns the auditor into a design reviewer. Under the impartiality rules, auditors may point out opportunities for improvement without recommending specific solutions, so a pre-audit that returns with advice on how to fix each gap has already moved past that boundary.
Before you book anything, ask your certification body in writing what the pre-audit will check, which documents and records it will sample, who will perform it, and how many times it will repeat. Ask whether any re-check will be charged separately and whether the same people will also run stage 1 and stage 2. If the answers are vague, or the plan includes several rounds of review of corrective actions, ask how the body will document its impartiality assessment for that work. Your own consultant or internal team should carry out the gap remediation, so the record shows who designed the controls and who only tested them.
What auditors may and may not say during an ISO 27001 audit
Certification bodies work within fixed limits, and those limits shape what their auditors can tell you. The five cards below cover what an auditor may suggest, how findings are recorded and closed, and how the two audit stages fit together. Use them to decide who answers for each finding and what you should get in writing.
Improvement opportunities without solutions
Under clause 5.2.2 of ISO/IEC 27006-1, as cited in European Accreditation FAQ 49.4, an auditor may point out opportunities for improvement but may not recommend specific solutions. Treat every observation as a question for your own team. Your staff choose the fix, document the decision and show the change working. Ask for observations to be written down, because verbal comments are hard to track later. If an auditor proposes a tool or design, raise it with the body, since advice of that kind can bear on impartiality.
Nonconformities and corrective action
A nonconformity is a finding that a requirement is not met, and the organization owns the response. European Accreditation FAQ 36.14 explains how corrections and corrective actions are treated, so read it before your audit. Your team writes the root cause analysis and the corrective action plan. Ask the body what evidence it needs to close each finding and the date by which it expects to see it. Keep a findings register with a named owner and due date for every item, so the record shows your management working the problem.
Opening and closing meetings
In a two-stage audit, the opening and closing meetings frame the work, as set out in European Accreditation FAQ 32.6. Put the people who own each control in the room. The opening meeting confirms scope, the audit plan and who the auditor will speak with. The closing meeting is where findings are presented, so nothing should surprise you there. Ask the body in advance who may attend, and keep your own notes. Confirm whether your consultant may observe before the meeting, rather than assuming it.
Stage 1 output as a to-do list
Stage 1 is the documentation and readiness review, and European Accreditation FAQ 32.5 covers what its output should contain. Read the stage 1 report as your list of work before stage 2. Check whether it names areas of concern that could become nonconformities later, and whether it records points you must resolve before stage 2 starts. If the body finds gaps, ask for them in writing with the evidence it expects to see. A clean stage 1 does not show that your controls operate, because stage 2 tests that in practice.
Interval between stage 1 and stage 2
The time between stage 1 and stage 2 is set by the certification body and must meet the requirements of ISO/IEC 17021-1, as discussed in European Accreditation FAQ 49.3. Schedule stage 2 only after your fixes have produced evidence. A control changed recently may have few records, and auditors need records covering a period. Ask the body in writing what interval it applies, how it treats stage 1 findings, and whether a short follow-up review is possible or a full repeat is required. Confirm dates with your management team before you sign a schedule.
How to sequence gap analysis, internal audit and certification without conflicts
The sequence keeps advice, internal checking and certification decisions with different parties, so the certification body never designs or reviews the system it will later certify. Each phase ends with a named output that feeds the next.
Define scope and the ISMS boundary
Management decides which products, sites, systems and legal entities the ISMS covers, and writes the scope statement and the first set of policies. An implementation partner or consultant can draft the options, but top management owns the decision. The step is done when the scope is approved, documented and understood well enough to test against. Ask the partner to state in writing which parts of the scope they helped define.
Run the gap analysis with an independent adviser
An implementation partner or consultant compares your current practice against the clauses 4 to 10 requirements and the Annex A controls, then lists gaps and the evidence each one lacks. This is advice, so the adviser may recommend solutions and help build them. The output is a gap register with owners and priorities. Confirm that the adviser has no plan to become the certification body's related party, since that would affect later independence.
Build the ISMS and collect operating evidence
Your staff, with any help you choose, close the gaps: risk assessment, Statement of Applicability, procedures, controls and records. The organization runs the controls for long enough to produce real records, such as access reviews, incident logs and management review minutes. The output is a documented ISMS with operating evidence that the certification body can sample. Keep the adviser's deliverables separate from the certification body's files.
Conduct the internal audit through an independent provider
An internal audit is a first-party audit that checks the ISMS against the standard and your own procedures before the certification body arrives. Use internal auditors who did not build the controls, or an internal audit provider that is independent of the certification body and of anyone who helped implement the system. The output is an internal audit report with findings, and management records corrective actions for each nonconformity. Confirm that the provider is not the certification body or a related body.
Complete stage 1 with the certification body
The certification body reviews your documented ISMS, scope and readiness, usually on site or remotely, and reports where you may not be ready for stage 2. Its stage 1 output is a written report of readiness, which sets the points to address before the main audit. Ask whether a preliminary audit before stage 1 is offered, and remember that a preliminary audit cannot stand in for stage 1. The step closes when you have the stage 1 report and a plan for its findings.
Complete stage 2 and receive the decision
The certification body assesses whether the ISMS is implemented and operating as documented, using samples of evidence and interviews. Auditors may point out opportunities for improvement but should not recommend specific solutions. The output is a stage 2 report with any nonconformities, and certification is decided by the certification body's independent review. Track each nonconformity to closure within the timeframe the certification body sets.
Maintain the surveillance cycle
Under ISO/IEC 17021-1, the certification cycle lasts three years, and the certification body must carry out at least one audit, either surveillance or recertification, in every calendar year. Each surveillance audit produces a report and tests whether the ISMS still operates, including after changes to scope or controls. Keep internal audits and management review running between external audits. The cycle repeats with recertification at the end of the three years.
What changes by situation: existing consultant, existing certification body or switching
Many organizations already work with a consultant who did their gap analysis or built their ISMS, and then pick a certification body. The rule is about who the consultant is related to. If the consultant belongs to, or is owned by, the body that will certify you, the consultancy is treated as a significant threat to impartiality under ISO/IEC 17021-1, and the body must apply a mitigation before it can certify. A consultant with no link to the certification body raises no such issue from the consultancy alone.
- Check the link: Ask the consultant in writing whether it belongs to, shares ownership with, or is run by people who work for any certification body you are considering.
- Check the mitigation: If a link exists, the recognized mitigation is that the body does not certify that system for at least two years after the consultancy ends. Ask the body to show how it applies this.
- Check the individual: A freelance auditor who also consults for you is treated under the same independence logic, so ask who performs your internal audit as well.
- Keep the record: File the consultant's engagement letter, a statement of any relationship with your certification body, and the date the consultancy ended.
Before you sign, confirm the independence position in writing with both parties.
Some certification bodies offer gap analysis, pre-audits or readiness reviews alongside certification. Accredited bodies can run a preliminary audit before stage 1 when impartiality is not compromised. Between stage 1 and stage 2, or as repeated checks that show whether earlier problems were fixed, the activity moves toward helping build the system, which threatens impartiality. A body that designs or consults on your ISMS cannot then certify it. The consulting-style service is often the part that conflicts, not the certification itself.
- Ask what the service is: Get a written description of whether the activity is a preliminary audit, an internal audit or consultancy. An internal audit is a first-party audit, so a body's preliminary audit is not one by definition.
- Ask about timing: Confirm the pre-audit happens before stage 1, not between stage 1 and stage 2, and that it is not used as the stage 1 audit.
- Ask about repeats: Repeated preliminary audits to confirm your fixes may be treated as helping develop the system. Ask how the body limits this.
- Ask about internal audit: A certification body may not perform your internal ISMS reviews, and it must be independent of whoever does.
- Keep the record: Save the proposal, the scope of each preliminary audit, and the written independence assessment the body prepares.
If the body cannot answer these points clearly, consider a separate provider for the preparatory work.
Switching certification bodies during a three-year cycle is a formal transfer, not a fresh application. Global ACI-TECH-3-002 describes the process for transferring accredited certification of management systems, and it is the process reference to read with your current body and the receiving body. The receiving body needs evidence that your certificate is valid and that the audit history supports continuity. Its auditors also have to assess the impartiality of their own work with you, including any consultancy you received from either body.
- Confirm the certificate: Check the current certificate's status and scope in the IAF CertSearch database before starting a transfer conversation.
- Ask the receiving body about independence: Ask whether it or any related body has consulted for you, and what mitigation applies.
- Ask about open findings: Ask for a list of open nonconformities and corrective actions from your current body, and how the receiving body will treat them.
- Confirm the cycle: Ask how the transfer affects your surveillance and recertification dates, given the annual audit expectation in a certification cycle.
- Keep the record: Retain the transfer request, your latest audit reports, the closure evidence for findings, and the receiving body's written acceptance decision.
Confirm the transfer steps with both bodies, since each applies its own procedure.
Questions to ask your certification body before signing
A certification body can be independent of your gap analysis and still be too close to your system to certify it fairly. These six questions test whether the body, its related entities and its auditors keep consultancy, pre-audits and internal audit work separate from the certification decision, and whether its accreditation holds up.
Consultancy from the body or related entities
Ask whether the certification body, or any entity related to it, sells gap analysis, policy writing, risk assessment or remediation to you. Under ISO/IEC 17021-1, consultancy from a related body is a significant threat to impartiality, and the recognized mitigation is that the body does not certify that system for at least two years after the consultancy ends. Get the start and end dates of any past or current work in writing before you sign.
Documenting the separation
Ask how the body records and enforces the separation between its consultancy staff and its audit staff. A credible answer names the controls: separate personnel, a documented conflict-of-interest register, and a review step before the audit team is assigned. Ask for the procedure itself, not a verbal assurance, and confirm who signs off on the assignment.
Pre-audits and their number
Ask whether the body plans any preliminary audit before stage 1, and how many. A pre-audit before stage 1 can be acceptable if impartiality is protected, but it cannot replace stage 1, and repeated preliminary audits used to check your fixes can count as helping build the system. Ask for the planned count, the scope of each visit and what the body will do with the findings.
Independence of your internal audit
Ask who the body will use to perform your internal ISMS audit, and whether the body or anyone it employs or contracts has done that work for you. Under ISO/IEC 27006-1, the certification body may not provide internal ISMS reviews to a client it certifies, and this covers individual freelance auditors as well as firms. There is no two-year mitigation period for this rule, so confirm the answer in writing.
Applying ISO/IEC 27006-1:2024
Ask whether the body applies ISO/IEC 27006-1:2024 to your audit, and by when. IAF MD 29:2024 required accredited bodies to apply it to all clients by 31 March 2026, so an older approach to ISMS audits is a warning sign. Ask how the body's audit plan reflects the standard's competence and impartiality requirements for ISMS auditing.
Checking accreditation
Ask for the accreditation body and the accreditation scope that covers ISMS certification, then confirm both yourself. Search the certificate in the IAF CertSearch database, and check the accreditation body's status under Global ACI, which has assumed the roles of IAF and ILAC since 1 January 2026. A certificate you cannot find in the database is a question you must resolve before the audit, not after.
Questions buyers ask about certification bodies and gap analysis
Can the certification body that certifies us also run our gap analysis?
Generally no, at least not for the same ISMS. A certification body may review or audit your management system, but consultancy from a body related to it creates a significant threat to impartiality under ISO/IEC 17021-1 clause 5.2.7. The mitigation recognized by European Accreditation is that the body does not certify that system for at least two years after the consultancy ends. Gap analysis is usually work your own team or an independent implementation partner performs, so the certifying body stays free to audit it. Confirm with the body in writing whether any related entity has offered you consultancy before you sign.
What is the two-year rule for related consultancy in ISO 27001?
The two-year rule is the mitigation for consultancy-related impartiality risk in ISO/IEC 17021-1. If a body related to the certification body has consulted on your management system, that body should not certify the system for at least two years after the consultancy ends. European Accreditation's FAQ 33.15 describes this as a recognized mitigation, not a blanket permission. ISO/IEC 27006-1 is stricter for internal ISMS reviews: the certification body may not perform them for a client it certifies, and the two-year period does not apply. Ask the body how it records and manages any prior advisory work.
Can a pre-audit by the certification body replace stage 1?
No. A pre-audit is a preliminary check that can happen before stage 1 if impartiality is not compromised, according to European Accreditation FAQ 48.11. It cannot be used as the stage 1 audit, and no pre-audit is permitted between stage 1 and stage 2. Stage 1 still produces the formal review of documentation and readiness that the certification plan depends on. If you want an early look, ask the body what it will charge for a preliminary audit and whether that visit could later be counted in the certification cycle.
Can the certification body tell us how to fix problems it finds?
Auditors may point out opportunities for improvement, but they should not recommend specific solutions. Clause 5.2.2 of ISO/IEC 27006-1, as explained in European Accreditation FAQ 49.4, allows observations of this kind during audits. Repeated preliminary audits designed to check whether earlier problems were fixed count as helping develop the system, which threatens impartiality, according to FAQ 49.2. Expect findings to describe the gap and the requirement it fails. Your team or implementation partner decides and designs the fix, and you record the corrective action as the standard requires.
Who can perform our internal ISO 27001 audit?
Your internal audit can be done by your own staff or an outside provider, but not by the people or firm the certification body uses for the same client. ISO/IEC 27006-1 clause 5.2.2 requires the certification body to be independent of whoever performs your internal ISMS audit, including individual freelance auditors, and it carries no two-year mitigation. European Accreditation FAQ 48.11 notes that a certification body's preliminary audit is not an internal audit, since internal audit is first-party work. Choose the internal auditor before the certification body starts, and keep the audit records you produce.
What does the work need from our team, and what can an adviser take on?
Your team owns the management system: it must determine scope, approve the risk treatment decisions, set policy, and keep the evidence current. An implementation partner can prepare the documents, run the gap analysis, configure tools and help collect evidence, but it cannot sign off decisions on your behalf or issue the certificate. The certification body audits the result. Plan for your own staff to be available for interviews, evidence reviews and corrective actions throughout the audit. Ask any adviser in writing which of these tasks they will perform and which remain with you.
How do we check that a certification body and its adviser are independent?
Ask the certification body to confirm in writing that neither it nor any related entity has provided consultancy, internal audits or preliminary audits to your organization. Then check whether the adviser you plan to hire is linked to that body. For accredited certificates, ISO points to the IAF CertSearch database for checking. Global ACI now holds the roles previously held by the IAF and ILAC since 1 January 2026, so confirm current accreditation status with the accreditation body and the certification body directly.
Where DeployOpen fits when a certification body must stay separate
DeployOpen prepares the management system, and the certification body decides whether it conforms. DeployOpen plans, implements and prepares systems, controls and evidence for an ISMS inside your own cloud accounts, data centers or air-gapped networks. It does not issue audit reports or certificates, and it does not sign off conformity. Where the body that will certify you is also the party you want to run your gap analysis or pre-audit, DeployOpen's role is the preparation work, and the body's role is the independent judgment. Keeping those two roles apart is what protects the certificate.
Before scope is agreed, ask the certification body in writing which preparation activities it considers compatible with its impartiality obligations, and whether an implementation partner may configure logging, access controls, backups or evidence collection for the same ISMS it will audit. Ask for the answer to cover the specific tasks in your statement of work, not general consultancy. Record the reply in the engagement file so that the scope, the deliverables and the audit plan match what the body has accepted. This check takes place before any work starts, not after the first audit has been booked.
Plan for the separation in the statement of work. DeployOpen's written scope can name the systems it touches, the evidence it produces and the points where your own staff take over, such as owning the risk decisions, the Statement of Applicability and management review. Your internal team, not the implementer, should perform the internal ISMS audit if that audit is to stay independent. Confirm the arrangement with the certification body again if the scope changes mid-project. Nothing in this approach guarantees a certification outcome, because the result depends on what the auditors find in your environment.
How DeployOpen scopes, implements and prepares evidence for your audit
DeployOpen works on the implementation side of ISO 27001 readiness: preparing systems, controls and evidence inside your own infrastructure. We do not issue audit reports or certificates, and the certification body that will certify you must stay independent of the work we do, so the scope is written to keep those roles separate.
How we scope
- Agree a written, fixed scope that names the systems, sites and Annex A controls covered by the readiness work
- Record which activities belong to your team, which to DeployOpen and which to an independent certification body
- Confirm in writing whether any gap analysis or pre-audit is performed by a party outside the certification body
- Set deliverables and timelines in the scope document before any work starts, with a quote following from that scope
How we build
- Configure and harden the self-hosted open-source platforms that run the controls inside your cloud accounts or data centers
- Map each in-scope Annex A control to the system, owner and evidence source that will show it operating
- Test the controls against the written scope and document gaps for your management to decide and own
- Keep configuration, logs and records in a form your internal auditors and certification body can inspect
How we hand over
- Deliver the documentation, runbooks and evidence index so your staff can reproduce and explain each control
- Walk your team through the evidence set and the decisions made, so accountability stays with your management
- Confirm what remains open, who owns each item and what the certification body will ask to see
- Hand over administrative access and knowledge transfer so your team can run the platforms without us
How we support
- Offer ongoing support, upgrades and continuous testing through a retainer if your team wants help after handover
- Scope retainer work in writing with the same boundaries that applied to the readiness engagement
- Support follow-up questions raised during your internal audit or certification audit within the agreed scope
- Review changes to the ISMS and platforms periodically so evidence stays current between certification cycles
