ISO 27001 LA · Domain 6 of 7

ISO 27001 LA Domain 6: Closing an ISO/IEC 27001 Audit

How an ISMS audit ends: evaluating findings into conclusions, presenting them to top management, running the closing meeting, recommending certification and judging the auditee's corrective action plans.

Exam weight
8.75%
Official knowledge statements
6
Estimated questions estimate
~7
Suggested study time estimate
6–8 hrs

About 13 min read Reviewed October 2026

Overview

Domain 6 covers the end of an audit and its immediate follow-up. Its six knowledge statements are the evidence evaluation process for audit conclusions, how conclusions are presented, best practices for presenting them to the auditee's top management, the possible recommendations an auditor may issue in a certification audit, the closing meeting agenda, and best practices for evaluating action plans.

ISO 19011 clauses 6.4.9 and 6.4.10 describe determining conclusions and the closing meeting, while ISO/IEC 17021-1 clauses 9.4 and 9.5 cover the report, the treatment of nonconformities and the separation between the audit team's recommendation and the certification decision. A lead auditor must turn individual findings into an overall judgment that is fair, supported and clearly communicated.

How it's tested

Items describe the final day of an audit or the weeks after it. You decide how to grade a set of findings, what the team can recommend, what belongs in the closing meeting or report, and whether a corrective action plan is acceptable. Expect three plausible answers separated by who has authority and what the evidence supports.

  • Grade the finding

    A described gap must be graded as major nonconformity, minor nonconformity or opportunity for improvement based on its effect on the ISMS's ability to achieve intended results.

  • Who decides

    Options assign the certification decision to the lead auditor, the auditee or the certification body; only the last is correct under ISO/IEC 17021-1.

  • Action plan quality

    You judge whether a corrective action plan addresses correction, root cause, corrective action, responsibility, timing and effectiveness review.

Reasoning it through

At the end of Stage 2 the team finds that no internal audit has ever been performed, plus two late access reviews. A question asks the right recommendation. Reason: the missing internal audit means a required clause 9.2 process is absent, a major nonconformity, so certification cannot be recommended until correction and corrective action are verified. The late reviews are minor and need an accepted action plan.

Knowledge statements 6

Official knowledge statements from the PECB outline, in outline order.

6.1 Evidence evaluation process for preparing audit conclusionsCombining findings into an overall judgment.
What it means
Before the closing meeting, the audit team reviews all findings and other information against the audit objectives, agrees conclusions considering the uncertainty of sampling, agrees any follow-up, and confirms that the audit objectives were met.
What to understand
Conclusions address the extent of conformity with criteria, effective implementation and maintenance, the management review's ability to ensure suitability and effectiveness, and achievement of objectives. Findings are graded here: a major nonconformity affects the capability of the ISMS to achieve intended results, for example a required process missing or a systemic breakdown; a minor nonconformity does not.
How it shows up
A scenario lists several findings and asks which conclusion the team should reach about certification readiness.
Common confusion
Counting findings mechanically, for example assuming three minors automatically become a major, without considering their combined effect.
6.2 Presentation of audit conclusionsHow conclusions are expressed in reports and meetings.
What it means
Conclusions are presented clearly and factually, linked to objectives and supported by findings. The audit report records objectives, scope, client, team, dates, criteria, findings and evidence, conclusions, the extent of conformity, any unresolved divergent opinions and the sampling nature of the audit.
What to understand
ISO/IEC 17021-1 requires a written report for each audit, owned by the certification body. Fair presentation means positive findings and limitations appear too. The report should state whether audit objectives were achieved and give the team's recommendation.
How it shows up
Questions ask what must be included in the report, such as unresolved diverging opinions between the team and auditee.
Common confusion
Leaving disagreements out of the report to keep it clean.
6.3 Guidelines and best practices for presenting audit conclusions to top management of the auditeeCommunicating results to executives.
What it means
Top management needs a concise, business-focused picture: whether the ISMS meets requirements, the significant nonconformities and their impact, strengths found, the recommendation and what happens next.
What to understand
Presenters lead with conclusions, use evidence-based language, avoid jargon and blame, and are ready to explain the grading. They do not negotiate findings at this stage, though factual errors can still be corrected. Positive observations encourage engagement with improvement.
How it shows up
Questions ask which presentation approach is best, such as summarizing key conclusions and their business impact rather than reading every finding.
Common confusion
Presenting detailed technical findings to executives before giving the overall conclusion.
6.4 Possible recommendations an auditor may issue during a certification auditThe audit team's recommendation to the certification body.
What it means
Typical recommendations are: recommend certification; recommend certification conditional on acceptance of corrective action plans for minor nonconformities; or do not recommend certification until major nonconformities are corrected and verified, possibly through a follow-up audit. Similar options apply to surveillance and recertification.
What to understand
Under ISO/IEC 17021-1, corrections and corrective actions for major nonconformities must be reviewed, accepted and verified before granting certification; for minors, the certification body reviews and accepts the planned actions. The certification decision is made by persons not involved in the audit. If major nonconformities are not resolved within the certification body's time limit, often six months, Stage 2 may need repeating.
How it shows up
Questions ask what the lead auditor may tell the auditee at closing; the answer is the recommendation, not a certification decision.
Common confusion
Telling the auditee they are certified at the closing meeting.
6.5 Agenda of the closing meetingFormally ending the audit.
What it means
The closing meeting, chaired by the team leader, presents findings and conclusions so they are understood and acknowledged. Typical agenda items: thanks, a reminder of objectives, scope and sampling limits, findings and their grading, conclusions and recommendation, timelines for action plans, the reporting and appeals process, and confidentiality.
What to understand
Diverging opinions are discussed and, if possible, resolved; if not, they are recorded. Attendance is recorded. The auditee is told that sampling means other nonconformities may exist, and is informed of the possible consequences of not addressing major nonconformities.
How it shows up
Expect a question on what the team leader should do when the auditee disputes a major nonconformity at closing; discuss the evidence and record the disagreement if unresolved.
Common confusion
Treating the closing meeting as the place to collect missing evidence.
6.6 Guidelines and best practices for evaluating action plansAssessing the auditee's response to nonconformities.
What it means
After the audit, the auditee submits correction and corrective action plans. The auditor checks that each plan addresses the nonconformity, includes a credible root cause analysis, defines corrections and corrective actions, assigns responsibility and dates, and plans an effectiveness review.
What to understand
Plans for minor nonconformities are reviewed and accepted, with implementation verified at the next audit. Major nonconformities need evidence of implementation, sometimes through a follow-up visit. Auditors evaluate plans but do not write them, which would compromise impartiality.
How it shows up
A question shows a plan stating that staff were retrained, with no cause analysis; the auditor should not accept it as complete.
Common confusion
Accepting a correction alone as a sufficient corrective action.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Major nonconformity

    Affects the ISMS's capability to achieve intended results.

    Remember
    Correction and corrective action must be verified before certification.
    Tested as
    Grading questions.
    Trap
    Grading any single missing record as major.

  • Minor nonconformity

    Does not affect the ISMS's capability to achieve intended results.

    Remember
    Certification can proceed once the action plan is accepted.
    Tested as
    Grading and recommendation questions.
    Trap
    Ignoring patterns of minors that indicate a systemic problem.

  • Opportunity for improvement

    Observation where requirements are met but practice could be better.

    Remember
    Not a nonconformity; must not be consultancy.
    Tested as
    Grading questions with no breached requirement.
    Trap
    Prescribing a specific solution.

  • Audit conclusion

    Outcome of the audit after considering objectives and all findings.

    Remember
    Agreed by the team before the closing meeting.
    Tested as
    Conclusion and report questions.
    Trap
    Equating it with the list of findings.

  • Certification decision

    Made by the certification body after reviewing the audit.

    Remember
    Decision makers were not involved in the audit.
    Tested as
    Who decides questions.
    Trap
    Lead auditor granting certification.

  • Closing meeting

    Formal presentation of findings, conclusions and next steps.

    Remember
    Chaired by the team leader; disagreements recorded.
    Tested as
    Agenda and dispute questions.
    Trap
    Using it to gather new evidence.

  • Root cause analysis

    Identifying why a nonconformity occurred.

    Remember
    Required to determine corrective action under clause 10.2.
    Tested as
    Action plan acceptance questions.
    Trap
    Accepting human error as the root cause without deeper analysis.

  • Unresolved diverging opinions

    Disagreements between team and auditee not settled at closing.

    Remember
    Recorded in the report.
    Tested as
    Fair presentation questions.
    Trap
    Deleting them or forcing agreement.

  • Follow-up audit

    Additional visit to verify actions on major nonconformities.

    Remember
    Used when documentary evidence is not enough.
    Tested as
    Next step questions after majors.
    Trap
    Thinking all findings require a revisit.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Major nonconformity vs. minor nonconformity vs. opportunity for improvement

ConceptMeaningKey differenceCommon trap
Major nonconformity Failure affecting the ISMS's ability to achieve intended results Blocks certification until verified Using it for isolated slips
Minor nonconformity Requirement not met without affecting overall capability Accepted action plan allows certification Downgrading systemic failures
Opportunity for improvement Requirement met; enhancement possible No requirement breached Writing it as a required fix

Audit team recommendation vs. certification decision

ConceptMeaningKey differenceCommon trap
Recommendation Audit team's proposal based on findings and conclusions Made by the lead auditor and team Presenting it as final
Certification decision Grant, refuse, maintain, suspend or withdraw certification Made by certification body staff independent of the audit Thinking the auditee can appeal to the lead auditor

Correction vs. corrective action in action plans

ConceptMeaningKey differenceCommon trap
Correction Fixing the detected instance, such as disabling the leaver's account Immediate containment Accepted as the whole plan
Corrective action Removing the cause, such as automating HR-to-IT leaver notifications Prevents recurrence Missing the effectiveness review

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Lead auditor certifies

    What candidates pick
    Announce at closing that the organization is certified.
    Why it looks right
    The lead auditor knows the results best.
    Why it's wrong
    Under ISO/IEC 17021-1 the certification body decides through people not involved in the audit; the team only recommends.

    Clue to watch for Options mention granting or issuing the certificate.

  2. Count-based grading

    What candidates pick
    Upgrade to major because there are several minors.
    Why it looks right
    A rule of thumb feels objective.
    Why it's wrong
    Grading depends on effect on the ISMS's capability; only related minors showing a systemic failure justify a major.

    Clue to watch for The minors concern unrelated areas.

  3. Retraining as root cause fix

    What candidates pick
    Accept a plan saying staff were retrained.
    Why it looks right
    Training is a common response.
    Why it's wrong
    Without root cause analysis, retraining may not address why the process failed, so recurrence is likely.

    Clue to watch for Plan has no cause analysis or effectiveness check.

  4. Auditor writes the plan

    What candidates pick
    Draft the corrective actions for the auditee to speed closure.
    Why it looks right
    It helps the auditee meet the deadline.
    Why it's wrong
    Designing corrective actions is consultancy and threatens impartiality; the auditee owns its plans.

    Clue to watch for Option has the auditor drafting or implementing actions.

  5. New evidence at closing

    What candidates pick
    Withdraw a finding because the auditee produces a document at the closing meeting.
    Why it looks right
    New evidence seems to resolve the issue.
    Why it's wrong
    Late documents should be evaluated carefully; they may show correction after the fact rather than conformity during the audited period.

    Clue to watch for Document dated after the finding was raised.

Answer framework

For a closing question, separate the evidence, the grade, the recommendation and the decision, and assign each to the right party.

  1. Confirm that the findings are supported by verified evidence and stated against a specific requirement before discussing any grading.
  2. Grade each nonconformity by its effect on the ISMS's ability to achieve intended results, considering whether related findings show a systemic problem.
  3. Form the team's conclusion and recommendation together, remembering that the certification decision belongs to the certification body and to people who took no part in the audit.
  4. At the closing meeting, present conclusions, explain grading, agree timelines and record any diverging opinions that cannot be resolved.
  5. Evaluate action plans for correction, root cause, corrective action, responsibility, timing and effectiveness review, without writing them for the auditee.

Practice question

After Stage 2, an auditee submits a corrective action plan for a minor nonconformity on unreviewed firewall rules. The plan says the rules were reviewed last week and lists no further action. What should the auditor conclude about the plan?

Want more like this? The ISO 27001 LA practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Read ISO 19011 clauses 6.4.9, 6.4.10 and 6.5, then ISO/IEC 17021-1 clauses 9.4.5 to 9.5. Summarize on one card who does what: the team concludes and recommends, the certification body decides, the auditee owns corrections and corrective actions. Most authority questions in this domain are answered by that card.

Next, practice grading. Write fifteen short findings, such as one late access review, no risk owners named anywhere, a missing visitor log entry or no management review in two years, and grade each, writing one sentence on why. Compare grades with a study partner and discuss any disagreement, because the exam tests reasoning about impact rather than fixed lists.

Then evaluate five sample corrective action plans, including weak ones that say only retrained staff or fixed the issue. Check for correction, cause analysis, corrective action, owner, date and effectiveness review. Finally, rehearse a five-minute closing meeting summary for an imaginary audit, focusing on clear conclusions, grading explanations and next steps, then move to timed practice questions.

FAQ

How many questions are in Domain 6, Closing an ISO/IEC 27001 Audit?

PECB's handbook allots 7 of the 80 questions to this domain, 8.75% of the exam, making it the smallest domain.

Does the lead auditor grant certification?

No. The audit team makes a recommendation. Under ISO/IEC 17021-1, the certification body makes the decision through people who were not involved in the audit.

What is the difference between a major and a minor nonconformity?

A major nonconformity affects the ISMS's capability to achieve its intended results, such as a missing required process. A minor nonconformity is a failure to meet a requirement without that effect.

Can certification be granted with open minor nonconformities?

Yes, once the certification body has reviewed and accepted the auditee's correction and corrective action plan. Implementation is verified at the next audit.

What happens if the auditee disagrees with a finding at closing?

The team leader discusses the evidence and tries to resolve the disagreement. If it remains unresolved, the diverging opinions are recorded in the report, and the auditee can use the certification body's appeals process.

Are surveillance and recertification audits part of this domain?

In the current handbook they are listed under Domain 7, Managing an ISO/IEC 27001 Audit Program, while this domain focuses on concluding the audit and evaluating action plans.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 6 knowledge

Check whether you can grade nonconformities, form the right recommendation and judge a corrective action plan the way PECB expects.

Take the ISO 27001 LA practice test Check your ISO 27001 LA readiness

Keep going