Overview
Domain 7 looks beyond a single audit to the programme and certification cycle. Its eleven knowledge statements cover follow-up, surveillance and recertification audits, conditions for modifying, extending, suspending or withdrawing certification, the PDCA cycle in audit programme management, resources, procedures and policies, auditor tools, audit records, continual improvement of the programme, first-, second- and third-party programmes, auditor competence, combined audits and the personal behavior of a professional auditor.
ISO 19011 clause 5 guides audit programme management and clause 7 auditor competence, while ISO/IEC 17021-1 clause 9.6 and ISO/IEC 27006-1 govern the three-year certification cycle. The domain applies whether you manage an internal audit programme under ISO/IEC 27001 clause 9.2 or work within a certification body's programme for many clients.
How it's tested
Questions place you as an audit programme manager or as a certification body auditor planning future audits. You choose the right audit type for a situation, the correct certification status action, how to staff a programme, or how to protect audit records. Many items hinge on timing rules and on who holds authority.
-
Cycle timing
You apply ISO/IEC 17021-1 rules, such as surveillance at least once per calendar year and the first surveillance within 12 months of the certification decision.
-
Status change
A scenario describes a client refusing surveillance or failing to fix major nonconformities and you choose between suspension, withdrawal or scope reduction.
-
Programme design
You decide how to set audit frequency, resources or auditor selection based on risk, objectives and competence under ISO 19011 clause 5.
A certified client informs its certification body that it has moved its data center to a new cloud provider. The question asks what the programme should do. Reason: a significant change can affect the ISMS's continued conformity, so the certification body may schedule a special audit or adjust the next surveillance to cover the change, rather than wait for recertification or suspend without evidence.
Knowledge statements 11
Official knowledge statements from the PECB outline, in outline order.
7.1 Requirements, steps and activities of follow-up, surveillance and recertification auditsAudits that maintain and renew certification.
- What it means
- Follow-up audits verify actions on nonconformities. Surveillance audits, held at least once per calendar year with the first within 12 months of the initial certification decision, check that the ISMS continues to conform. Recertification audits, before certificate expiry, evaluate continued conformity and effectiveness of the whole ISMS across the three-year cycle.
- What to understand
- Surveillance covers internal audits, management review, actions on previous nonconformities, complaints, effectiveness toward objectives, changes and use of marks, plus a sample of other areas. Recertification considers performance over the cycle. Short-notice or special audits may follow complaints or significant changes.
- How it shows up
- Questions ask the latest date for the first surveillance audit or what every surveillance audit must cover.
- Common confusion
- Thinking surveillance must repeat the full Stage 2 scope each year.
7.2 Conditions for modifying, extending, suspending or withdrawing an organization's certificationChanges to certification status.
- What it means
- Certification can be extended to new sites or processes after a successful extension audit, reduced in scope when parts persistently fail, suspended when the ISMS has persistently or seriously failed, when the client refuses surveillance or recertification, or at the client's request, and withdrawn when suspension issues are not resolved in time.
- What to understand
- During suspension the certification is temporarily invalid and the client must not promote it. Status changes are made by the certification body, publicly accessible as required, and follow its documented procedures.
- How it shows up
- A client misses its surveillance date and refuses to reschedule; the correct certification body action is suspension.
- Common confusion
- Withdrawing immediately when suspension is the defined first step.
7.3 Application of the PDCA cycle to managing an audit programmeISO 19011 clause 5 structure.
- What it means
- Plan: establish objectives, determine risks and opportunities, and establish the programme. Do: implement the programme. Check: monitor the programme. Act: review and improve the programme. ISO 19011 clause 5 follows this flow.
- What to understand
- Programme objectives come from the audit client's needs, such as certification, compliance or supplier assurance. Risks to the programme include insufficient resources, poor auditor selection and ineffective communication. The individual responsible for managing the programme reports to the audit client.
- How it shows up
- Questions ask which PDCA phase an activity belongs to, such as monitoring auditor performance under Check.
- Common confusion
- Mixing the audit programme PDCA with the auditee's ISMS PDCA.
7.4 Requirements, guidelines and best practices regarding audit resources, procedures and policiesEquipping and governing the audit programme.
- What it means
- Programme resources include competent auditors, time, travel, tools, technology for remote audits and access to information. Procedures define how audits are planned, conducted, reported and followed up. Policies cover impartiality, confidentiality and complaints.
- What to understand
- Audit time for ISMS certification follows ISO/IEC 27006-1, which bases duration on the number of persons in scope and complexity factors. Under-resourcing raises detection risk. For internal programmes, clause 9.2.2 requires defined frequency, methods, responsibilities, planning requirements and reporting.
- How it shows up
- A scenario shows a certification body cutting audit days below the 27006-1 calculation without justification; the answer identifies a resource problem.
- Common confusion
- Treating audit duration as a commercial negotiation only.
7.5 Types of tools used by professional auditorsTechniques and technology supporting audit work.
- What it means
- Tools include checklists, sampling plans, questionnaires, audit management software, data analytics tools, remote audit platforms, screen sharing, secure file exchange and computer-assisted audit techniques.
- What to understand
- Tools must be used securely, with agreement from the auditee, and must not compromise confidentiality or system integrity. Remote audit technology needs planning for connectivity, identity verification and recording permissions, as described in ISO 19011 Annex A.
- How it shows up
- Questions ask what to agree before using a remote audit tool, such as security of information and permission to record.
- Common confusion
- Assuming any tool is acceptable if it speeds up evidence collection.
7.6 Requirements, guidelines and best practices for managing audit recordsProtecting and retaining audit documentation.
- What it means
- Audit records include programme documents, plans, reports, working papers, nonconformity reports, corrective action records and auditor competence records. They must be protected for confidentiality, integrity and availability and retained per policy and legal requirements.
- What to understand
- ISO/IEC 17021-1 requires certification bodies to keep records for the current and previous cycle. Access is limited to authorized people. Disposal must be secure. Records support appeals, accreditation assessments and later audits.
- How it shows up
- A question asks how long working papers should be kept or who may access them.
- Common confusion
- Storing client evidence on personal devices without protection.
7.7 Application of continual improvement to managing an audit programmeReviewing and improving the programme.
- What it means
- The programme is reviewed to judge whether objectives were met, using inputs such as monitoring results, auditee feedback, auditor performance evaluations, complaints, changes in the audit client's needs and new audit methods.
- What to understand
- Improvement can change frequency, methods, auditor training or resources. Results are reported to the audit client. An audit programme that never changes despite repeated issues signals weak Check and Act phases.
- How it shows up
- Questions ask which input best shows a need to improve the programme, such as repeated complaints about inconsistent grading.
- Common confusion
- Treating the programme review as a review of the auditee's ISMS.
7.8 Particularities of implementing and managing a first-, second- or third-party audit programmeHow programme design changes with audit type.
- What it means
- First-party programmes serve management and clause 9.2, using internal or contracted auditors. Second-party programmes assess suppliers under contract terms and supplier risk. Third-party programmes run by certification bodies follow accreditation rules, three-year cycles and impartiality requirements.
- What to understand
- Internal programmes have flexible criteria and frequency based on risk but must ensure objectivity. Supplier programmes prioritize suppliers by information risk and contractual rights to audit. Certification programmes must cover the full scope over the cycle.
- How it shows up
- A scenario asks how a company should decide which suppliers to audit; the answer prioritizes by risk to information security.
- Common confusion
- Applying certification body rules, such as fixed cycles, to internal audit programmes.
7.9 The concept of competence and its application to auditorsKnowledge, skills and evaluation of auditors.
- What it means
- Competence is the ability to apply knowledge and skills to achieve intended results. ISO 19011 clause 7 covers generic knowledge of audit principles and methods and discipline-specific knowledge, while ISO/IEC 27006-1 adds ISMS-specific competence for certification auditors.
- What to understand
- Competence is determined, evaluated and maintained through education, work and audit experience, training and continual professional development. Programme managers select teams with the collective competence needed for each audit, adding technical experts where required.
- How it shows up
- Questions ask how to cover a competence gap on a team, such as adding a technical expert for operational technology.
- Common confusion
- Treating a training certificate alone as proof of competence.
7.10 Management of combined auditsAuditing more than one management system together.
- What it means
- A combined audit is conducted at a single auditee on two or more management systems together, such as ISO 9001 and ISO/IEC 27001. A joint audit is conducted at a single auditee by two or more auditing organizations.
- What to understand
- Combined audits need team competence for each standard, enough time to cover each set of requirements, and reporting that shows conformity for each standard. Audit time reductions for integration must be justified.
- How it shows up
- Questions ask the difference between combined and joint audits, or what must remain separate in a combined audit report.
- Common confusion
- Calling an audit by two certification bodies a combined audit.
7.11 Personal attributes and behaviors of a professional auditorThe behavior expected of auditors.
- What it means
- ISO 19011 lists desired behaviors: ethical, open-minded, diplomatic, observant, perceptive, versatile, tenacious, decisive, self-reliant, acting with fortitude, open to improvement, culturally sensitive and collaborative.
- What to understand
- Behavior is evaluated alongside knowledge and skills, for example through observation by programme managers or witness audits. An auditor who is tenacious keeps pursuing evidence, while one with fortitude acts responsibly even when unpopular.
- How it shows up
- A scenario describes an auditor who persists politely until evidence is obtained and asks which attribute this shows, which is tenacity.
- Common confusion
- Treating diplomacy as willingness to soften findings.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Certification cycle
Three years: initial audit, two surveillance audits, recertification.
- Remember
- First surveillance within 12 months of the certification decision.
- Tested as
- Timing questions.
- Trap
- Counting from the Stage 2 end date instead of the decision.
-
Surveillance audit
At least once per calendar year to confirm continued conformity.
- Remember
- Always covers internal audit, management review and prior nonconformities.
- Tested as
- Content and frequency questions.
- Trap
- Expecting full scope each time.
-
Suspension
Temporary invalidity of certification.
- Remember
- Triggers include serious failure, refusing surveillance or client request.
- Tested as
- Status change scenarios.
- Trap
- Choosing withdrawal first.
-
Withdrawal
Cancellation of certification.
- Remember
- Usually follows unresolved suspension.
- Tested as
- Status change scenarios.
- Trap
- Confusing it with scope reduction.
-
Audit programme
Arrangements for a set of audits over a time frame for a specific purpose.
- Remember
- Managed with PDCA under ISO 19011 clause 5.
- Tested as
- Programme design questions.
- Trap
- Confusing it with an audit plan.
-
Combined vs. joint audit
Several standards vs. several auditing organizations.
- Remember
- Combined audits still report per standard.
- Tested as
- Definition questions.
- Trap
- Swapping the terms.
-
Auditor competence
Ability to apply knowledge and skills.
- Remember
- Evaluated and maintained continually.
- Tested as
- Team selection questions.
- Trap
- Accepting qualifications without evaluation.
-
ISO/IEC 27006-1 audit time
Rules for ISMS audit duration.
- Remember
- Based on persons in scope and complexity.
- Tested as
- Resource questions.
- Trap
- Treating audit days as freely negotiable.
-
Audit records retention
Certification bodies keep records for the current and previous cycle.
- Remember
- Records are protected and access is controlled.
- Tested as
- Record management questions.
- Trap
- Keeping client evidence on unprotected personal devices.
-
Auditor behaviors
ISO 19011 list including tenacious, diplomatic and acting with fortitude.
- Remember
- Diplomacy never means softening findings.
- Tested as
- Behavior identification questions.
- Trap
- Confusing tenacity with aggressiveness.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Follow-up, surveillance, recertification and special audits
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Follow-up audit | Verifies actions on specific nonconformities | Narrow, triggered by findings | Treating it as routine annual work |
| Surveillance audit | Annual check of continued conformity | Partial scope with mandatory elements | Skipping internal audit and management review |
| Recertification audit | Full evaluation before certificate expiry | Considers performance over the cycle | Scheduling after expiry |
| Special audit | Short-notice or extension audit for complaints or changes | Triggered by events | Waiting for the next surveillance instead |
Suspension vs. withdrawal vs. scope reduction
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Suspension | Certification temporarily invalid | Reversible when issues are resolved | Client continuing to promote certification |
| Withdrawal | Certification cancelled | Final; new initial audit needed | Using it before suspension in ordinary cases |
| Scope reduction | Removing parts that persistently fail | Rest of certification remains valid | Confusing with voluntary scope change |
Combined audit vs. joint audit
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Combined audit | One auditee, two or more management system standards | One audit organization, several standards | Merging conformity statements across standards |
| Joint audit | One auditee, two or more auditing organizations | Several audit organizations cooperating | Calling it combined |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Immediate withdrawal
- What candidates pick
- Withdraw certification when the client misses surveillance.
- Why it looks right
- It seems firm and decisive.
- Why it's wrong
- Refusing or failing to allow surveillance is a suspension trigger; withdrawal follows if issues are not resolved in time.
Clue to watch for First occurrence with no prior suspension.
-
Full scope every year
- What candidates pick
- Plan each surveillance as a complete Stage 2.
- Why it looks right
- It seems more thorough.
- Why it's wrong
- Surveillance samples the scope with mandatory elements; full scope coverage happens across the cycle and at recertification.
Clue to watch for Question asks about surveillance planning.
-
Training equals competence
- What candidates pick
- Assign an auditor because they hold a lead auditor certificate.
- Why it looks right
- Certification is visible proof.
- Why it's wrong
- Competence must be evaluated for the specific audit, including sector knowledge and demonstrated behavior.
Clue to watch for Audit involves a specialized sector or technology.
-
Combined means fewer requirements
- What candidates pick
- Report one overall conformity statement for both standards.
- Why it looks right
- Integration seems efficient.
- Why it's wrong
- Each standard's requirements and conformity must be covered and reported, even in a combined audit.
Clue to watch for Audit covers ISO 9001 and ISO/IEC 27001 together.
-
Diplomatic means lenient
- What candidates pick
- Soften a finding to keep the relationship good.
- Why it looks right
- Diplomacy is a listed auditor behavior.
- Why it's wrong
- Diplomacy concerns tactful communication; fair presentation requires findings to reflect the evidence.
Clue to watch for Option changes the substance of a finding.
Answer framework
For a programme or cycle question, decide whose perspective applies and which rule set governs the timing or action.
- Identify the programme type: internal, supplier or certification body, since each has different rules for frequency and independence.
- For certification cycle questions, apply ISO/IEC 17021-1 timing: annual surveillance, first within 12 months of the decision, recertification before expiry.
- For status changes, match the trigger to the action: suspension for serious failure or refused audits, withdrawal if unresolved, scope reduction for persistent partial failure.
- For programme design, set objectives, consider risks and resources, then select auditors and teams by evaluated competence and impartiality.
- Check that records, tools and continual improvement inputs are handled securely and that each standard in a combined audit is fully covered.
Practice question
Want more like this? The ISO 27001 LA practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with the certification cycle because it produces the most rule-based questions. Draw a three-year timeline marking the certification decision, the first surveillance within 12 months, the second surveillance and recertification before expiry, then add triggers for special audits, suspension and withdrawal. Check each element against ISO/IEC 17021-1 clause 9.6 and keep the drawing with your exam materials.
Next, read ISO 19011 clause 5 and write the programme steps under Plan, Do, Check and Act. For each, add one example from an internal ISMS audit programme, such as using risk assessment results to set audit frequency. Then read clause 7 on competence and list the auditor behaviors with a one-line example of each, since behavior identification questions are quick marks.
Finally, practice distinctions that are easy to confuse: combined versus joint audits, suspension versus withdrawal, programme versus plan, and internal versus certification body programmes. Work through timed practice questions and use this domain as a full review, because its scenarios draw on the preparation, conduct and closing skills covered earlier.
FAQ
How much does Domain 7, Managing an ISO/IEC 27001 Audit Program, count on the exam?
The PECB handbook assigns 8 of the 80 questions, or 10%, to managing an audit programme.
How often are surveillance audits held?
At least once per calendar year, except in recertification years, with the first surveillance no later than 12 months after the initial certification decision.
When is a certificate suspended instead of withdrawn?
Suspension applies when the ISMS has persistently or seriously failed, when the client refuses surveillance or recertification audits, or when the client requests it. Withdrawal usually follows if the suspension is not resolved within the set time.
What is the difference between a combined and a joint audit?
A combined audit covers two or more management system standards at one auditee. A joint audit involves two or more auditing organizations auditing one auditee.
Does clause 9.2 require an audit programme?
Yes. ISO/IEC 27001:2022 clause 9.2.2 requires the organization to plan, establish, implement and maintain an audit programme including frequency, methods, responsibilities, planning requirements and reporting.
Which standard sets ISMS audit time for certification bodies?
ISO/IEC 27006-1 sets ISMS-specific requirements, including how audit duration is calculated from the number of persons in scope and complexity factors.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 7 knowledge
Test whether you can apply certification cycle timing, choose the right status change and design a risk-based audit programme under exam conditions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the ISO 27001 LA AI tutor Get any concept explained your way