ISO27001 auditors cannot raise non conformities based on their judgment, view, opinion, experience, or good/best/common practice.

One of the very popular ISO27001 myths is that ISO27001 certification auditors can raise a non conformities based on their judgment, view, opinion, experience, best practice, common practice, etc. They can’t. But for some reason that doesn’t stop them. I suppose that is because most auditees don’t know that the auditors are not allowed to do it.

Let us look at why this is the case.

First of all. What is a non conformity (NC). It is where:

1) You are not meeting a mandatory requirement in ISO27001 clauses 4 to 10. For example you have not assigned owners to all the risks, or

2) you are not meeting one of your own mandatory requirements. I.e. you have stated/documented that X must happen or be true and it is not. For example you say that all laptops must be encrypted but some are not.

Just a quick reminder that none of the Annex A controls are mandatory requirements of ISO27001 unless you can make them mandatory under rule 2 above. I.e. if you decide that one or more of them are necessary controls to manage one or more of your risks.

The rules about this are defined in ISO17021 (the rules for certification bodies/auditors). It also says that an auditor can only raise an NC if they have objective evidence to support it.

Objective evidence, is (from ISO):

“data supporting the existence or verity of something. Objective evidence can be obtained through observation, measurement, test, or by other means. Objective evidence for the purpose of audit generally consists of records, statements of fact or other information which are relevant to the audit criteria and verifiable.“.

I.e. facts, data, and verifiable.

If you think about this for a minute you will realise this is quite a high bar. It means that if (say) 100 equally diligent auditors audited the same thing?and selected the same samples for the audit they would raise the same NC. If that is demonstrably not the case then there is no NC.

Certification auditors do of course need to use their judgement to decide how to audit something and what samples to choose, etc. But they can’t use their judgement to decide if something is an NC.

Of course an auditor can raise an Opportunity for Improvement (OFI) about anything they like but an OFI is just a recommendation/consultancy and can be ignored if it is not considered by the organisation to add sufficient value.

A couple more related thoughts for you.

1) Auditors cannot raise NCs against controls. This is covered in this article. https://www.dhirubhai.net/pulse/why-you-should-never-get-major-minor-non-conformity-against-hall/

2) Auditors should not raise NCs about controls where you already know about the non conformity. See this article. https://www.dhirubhai.net/pulse/iso27001-auditor-should-raise-non-conformity-something-chris-hall/

I must admit I get tired of meeting certification auditors who do not understand this and seem to think that they can raise NCs without objective evidence or they try to sort of try to justify their NC with objective evidence that is clearly not. Sometimes they think just quoting the requirement in ISO27001 is sufficient objective evidence. It isn’t. They need to be able to prove it based on facts and data.

Chris

An index of all my articles is here?https://btrp.co.uk/Articles2

?