ISO 27001 certification process exposes access review gaps

At a glance

What this is: This is a breakdown of the ISO 27001 certification process, with a clear finding that access review gaps often become the practical weak point in audit readiness and ongoing certification maintenance.

Why it matters: It matters because IAM and IGA teams are often asked to prove control effectiveness, not just describe it, and certification evidence fails when access reviews are slow, manual, or poorly scoped.

Context

ISO 27001 certification is not just a policy exercise. It depends on whether an organisation can scope its information security management system, map the right Annex A controls, and then prove those controls work through audit evidence that stands up under scrutiny.

For identity and access management teams, the pressure point is usually the access review process. If user entitlements, application access, and remediation records cannot be assembled cleanly for stage 1, stage 2, and recertification, the certification process becomes a governance problem rather than a documentation task.

Key questions

Q: What breaks when ISO 27001 user access reviews do not produce audit evidence?

A: The review stops being defensible. Auditors need to see who reviewed access, what changed, when it changed, and why the decision was made. If that trail is missing, the organisation may have performed the task but cannot prove control, which is enough to create certification and governance risk.

Q: Why does access governance matter during ISO 27001 audits?

A: Access governance matters because auditors are testing whether privilege decisions are documented, justified, and still accurate when the environment changes. If entitlements, exceptions, or supplier access are not traceable, the organisation may have controls on paper but not in practice. The result is weaker evidence for certification and a higher chance of remediation findings.

Q: How do security teams know whether their ISO 27001 controls are actually working?

A: They know by testing the controls before the external audit. Internal audits, evidence sampling, and control walkthroughs should show that access governance, risk treatment, and documentation all line up. If those checks fail, the issue is usually drift between policy and practice rather than a missing certificate.

Q: Should organisations treat recertification as part of access review governance?

A: Yes. Recertification depends on proving that the current access model still matches current business reality, not just the state of the organisation three years ago. Teams that fold certification evidence into their regular review cycle avoid rebuilding records under audit pressure and reduce the risk of finding gaps too late.

Technical breakdown

Why the statement of application becomes the control proof point

The statement of application, or SoA, is the record that ties selected Annex A controls to the ISMS scope. In practice, it is not just a list of controls. It is the audit trail that shows why controls were selected, how they map to risk, and where evidence should exist when auditors test effectiveness. If access review results, corrective actions, and ownership records do not align with the SoA, the control story breaks even when the technical work was done.

Practical implication: Treat the SoA as an evidence map, not a paperwork exercise.

Why stage 1 audit gaps often point to identity governance weaknesses

Stage 1 focuses on whether the ISMS meets mandatory requirements and whether the organisation can show prepared evidence. That makes access review quality a governance issue, not just an IAM task. If internal reviewers cannot separate review responsibility from remediation, or if findings are not recorded with enough precision, auditors will classify the outcome as a nonconformity. Major and minor findings differ in remediation depth, but both expose weak control ownership.

Practical implication: Separate review, remediation, and evidence ownership before the audit starts.

How recertification turns identity evidence into an operational discipline

ISO 27001 certification is valid for three years, but the article is clear that policies, structures, and practices change during that period. That means the organisation must keep proving that access controls still reflect current reality, not historic design. Recertification therefore behaves like a lifecycle test for identity governance: access must be reviewed, corrected, and re-evidenced continuously rather than only when the audit clock starts.

Practical implication: Build recertification into the access review cadence instead of treating it as a one-time project.

NHI Mgmt Group analysis

ISO 27001 certification exposes an access review governance gap, not just a compliance workload. The article shows that the certification process depends on whether access evidence can be produced in a form auditors trust. That makes identity review quality part of control effectiveness, not a back-office administrative task. Practitioners should treat certification readiness as an evidence management problem first and a documentation problem second.

Statement of application discipline is where many identity programmes become auditable or fail. The SoA is the point where selected controls, ISMS scope, and proof of implementation converge. If access governance data is scattered across teams or systems, the control story becomes fragile. The practitioner lesson is that identity evidence must be structured around audit traceability, not around convenience for operations.

Access reviews are the operational bridge between IAM activity and ISO 27001 assurance. The article makes clear that stage 1 and stage 2 both depend on whether access decisions, corrections, and exceptions can be demonstrated cleanly. That means review cadence, ownership, and evidence quality are as important as the control itself. For practitioners, the question is not whether access is reviewed, but whether the review can survive external challenge.

Certification maintenance turns identity governance into a lifecycle obligation. A three-year certificate is only meaningful if the access model keeps pace with changes in structure, policy, and application use. That is why recertification is not a separate compliance event but a recurring validation of entitlement accuracy. Teams should view this as a standing governance requirement rather than a periodic audit scramble.

Identity blast radius: the smaller the entitlement evidence gap, the easier it is to defend control effectiveness. When access review records are incomplete, the organisation cannot prove whether privilege was properly granted, reviewed, or corrected. That widens the audit blast radius beyond a single application and into the credibility of the ISMS itself. Practitioners should make review evidence as controllable as the access it describes.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
• Read next: IGA Buyer's Guide

What this signals

Access review evidence is becoming the control surface that certification programmes are judged on. Organisations that still manage reviews as ad hoc spreadsheets will struggle to produce the traceability ISO 27001 audits expect. The practical shift is toward structured evidence, reviewer accountability, and remediation records that survive recertification cycles.

ISO 27001 turns identity governance into a recurring assurance loop. Once the initial certificate is granted, the organisation must keep showing that access decisions, control scope, and corrective actions still match the current environment. That makes review cadence and record quality a standing programme concern, not a one-off certification task.

For practitioners

• Define the ISMS scope around access-critical data and applications List the systems and data types that must be covered by certification evidence, then align review ownership to those in-scope assets. This prevents access reviews from being fragmented across teams with no clear audit boundary.
• Map Annex A controls to a live statement of application Keep the SoA updated as controls are selected, implemented, or retired so auditors can see a direct line from risk to control to evidence. Link each access-related control to the records that prove it is operating.
• Separate review, remediation, and verification roles Assign different people or functions to identify access issues, correct them, and confirm the correction. This reduces conflict of interest and creates a cleaner evidence trail for internal review and external audit.
• Automate user access review evidence collection Centralise application entitlements, reviewer decisions, and remediation outcomes so stage 1 and stage 2 auditors can trace what was reviewed and what changed. Use automation to reduce manual evidence gaps and inconsistent records.
• Build recertification evidence into the annual review cycle Treat periodic access reviews as preparation for recertification, not as isolated tasks. Keep correction records, exception handling, and change history current so the three-year audit does not require a rebuild of the evidence set.

Key takeaways

• ISO 27001 certification exposes whether access review evidence is strong enough to prove that controls are operating, not just documented.
• The audit process makes the statement of application and entitlement records central to compliance because they connect scope, control selection, and proof.
• Teams that build recurring review and remediation evidence into the certification lifecycle are better positioned for both stage 2 audit and recertification.

Key terms

• Statement of Application: The statement of application is the formal record of which security controls an organisation has chosen to implement and why. In ISO 27001 work, it becomes the bridge between risk decisions, control scope, and audit evidence, which is why weak entries often expose governance gaps.
• Nonconformity: A nonconformity is a gap between a requirement and what the organisation actually does or can prove it does. In ISO 27001, nonconformities often arise when policies exist but supporting evidence, implementation, or remediation discipline is incomplete or inconsistent.
• Access review evidence: Access review evidence is the record that shows an entitlement was examined, assessed, and either retained or removed for a reason. Strong evidence includes the reviewer, the date, the decision, and any remediation path, which is what makes governance auditable rather than assumed.
• Information Security Management System: An information security management system is the operating structure an organisation uses to manage security policies, controls, responsibilities, and evidence. Under ISO 27001, it is the framework auditors assess, but its real strength depends on whether access, logging, and remediation work consistently in practice.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or governance programme, it is worth exploring.