Auditing an ISMS and building one are different jobs. Here you are the implementer standing up ISO/IEC 27001:2022 at a fictional mid-size company: putting the project in an order that works, sending back a scope statement that quietly excludes what customers rely on, reviewing Statement of Applicability rows against the risk treatment plan, and grading internal audit findings to decide whether the company is ready for its stage 2 certification audit.
You have been hired to take a payroll software company to ISO/IEC 27001:2022 certification. Put thirteen implementation steps in an order that works - scored only on the pairs whose order is genuinely required - then advise a CEO who wants both certification audits next month.
The draft scope statement reads well until you compare it with how the company actually works. Click the lines that would mislead a customer or fail a certification audit - an exclusion that removes what customers care about, a missing location, and interfaces nobody addressed - while leaving the sound lines alone.
Eight SoA rows from an analytics firm. Place each control in its 2022 Annex A theme and decide whether the entry would survive an audit - catching an exclusion justified by budget, an included control with no implementation status, and an exclusion the risk treatment plan contradicts.
Three weeks before stage 2, the internal audit report and management review minutes land on your desk. Grade seven findings as major nonconformity, minor nonconformity, opportunity for improvement or no finding, then decide whether the certification audit should go ahead.