This page is a worked example, not a client case study. It shows how my standard 12-day vISO maintenance plan runs for a typical small certified firm. The firm described is illustrative, drawn from the shape of enquiry I commonly receive. No client is named, and no audit outcome is claimed: certification decisions always sit with the independent certification body.
The firm in this example
- What it is: a UK software business selling to customers who ask for ISO 27001 certification in procurement.
- Scale: around 20 staff, single site, cloud-based systems.
- Position: already certified to ISO/IEC 27001:2022, with a surveillance audit due later in the year.
- Problem: the consultant who helped them certify has moved on, nobody internal has the time or the audit background to own the ISMS, and the system has started to drift: actions overdue, evidence patchy, and the next audit getting closer.
That continuity gap is the most common reason firms ask about this service. The knowledge of why the system was built the way it was has left with the previous consultant, and rebuilding it internally would take a senior person they do not have.
Month one: mobilisation
Mobilisation uses one day of the 12-day allocation.
- I review the existing ISMS documents, risk register, Statement of Applicability, previous internal and external audit reports, management reviews and certification dates.
- Where possible, I hold a one-hour handover with the previous consultant. Where required, an NDA is put in place before detailed documents are reviewed.
- I confirm which Annex A controls apply, and whether the 2.5 days allocated to auditing them is adequate for the firm's risk profile.
- The firm gets a scheduled governance and audit plan for the year: what happens, when, and who owns each item.
Management retains accountability throughout. Risk acceptance, treatment decisions, technical implementation and remediation stay with the firm. I coordinate the governance and audit activity.
The year, quarter by quarter
| When | What happens |
|---|---|
| Month 1 | Mobilisation review, handover where possible, governance and audit plan agreed |
| Months 2 to 3 | Risk review with owners, policy and Statement of Applicability updates, first actions tracked to closure |
| Months 3 to 5 | Annex A internal audits begin, spread across the year; findings reported with owners and dates |
| Month 6 | First management review of the year: performance, audit results, risks and actions, prepared, facilitated and documented |
| Months 7 to 9 | Remaining Annex A audits, independent Clauses 4 to 10 audit arranged and coordinated, supplier assurance and control monitoring |
| Month 10 | Second management review, corrective actions checked, surveillance readiness review |
| Audit month | External audit preparation and attendance; evidence coordinated; people the auditor will interview are briefed |
| After the audit | Corrective actions coordinated and tracked to closure, lessons folded into the next year's plan |
How the 12 days are used
| Activity | Days |
|---|---|
| Governance, documentation and policies | 1.5 |
| Risk assessment and treatment | 1.5 |
| Operational governance and control monitoring | 1.0 |
| Annex A internal audits and reporting | 2.5 |
| Management review preparation and reporting | 1.0 |
| External audit preparation and attendance | 1.5 |
| Independent Clauses 4 to 10 audit coordination and actions | 1.0 |
| Ongoing advice, meetings and improvement coordination | 2.0 |
| Total | 12.0 |
The allocation is indicative and moves by agreement. A firm with more applicable controls, more suppliers or a recertification year ahead would need more audit time, and we would agree that in advance as additional days at £850 plus VAT per day, or as a wider virtual CISO arrangement.
Why the internal audit is split
I audit the applicable Annex A controls. I do not audit my own governance work, so a separate independent audit of Clauses 4 to 10 is arranged and coordinated as part of the plan. That split preserves the impartiality Clause 9.2 requires, and both sets of findings feed the management reviews and the corrective-action tracker. My guide to ISO 27001 internal audit sets out the reasoning in full.
What the firm sees
- A governance calendar with named owners and dates
- An updated risk register and treatment plan
- Internal audit reports in the format a certification body expects
- Two documented management reviews meeting Clause 9.3
- A corrective-action tracker that is worked through the year, not rebuilt before the audit
- Preparation and support on the day of the external audit
What it costs this firm
£850 a month, £10,200 a year plus VAT, for 12 days. Initial term 12 months, extendable to 36 months by agreement, terminable by either party on one month's notice. Travel and expenses agreed in advance. Certification body fees are paid to the body directly and are not included, as with any ISO 27001 arrangement.
Is your situation similar?
If your certificate is live but the system behind it has no owner, this is the conversation to have.