How do I recover from a failed ISO 27001 audit?

Everything hangs on the classification. A minor nonconformity is an isolated lapse — one unreviewed supplier, one stale record — and certification usually proceeds once the certification body accepts your corrective action plan, verified at the next surveillance visit. A major is systemic: an ISMS requirement missing, or a control failing wholesale. Majors block the certificate (or suspend an existing one) until corrective action is verified, commonly within about ninety days and sometimes via a follow-up visit.

Corrective action means root cause, not spot repair. The certification body wants to know why the management system allowed the failure and what changed structurally — with evidence. Closing the one expired access review while leaving the review process unowned will fail verification; fixing the cadence, the owner, and the record-keeping passes it.

Keep perspective: nonconformities at Stage 2 and surveillance are ordinary, the recovery loop is written into the certification scheme, and running it competently is itself evidence the ISMS works. Handled well, the whole cycle gets boring — CloudCover passed ISO 27001 with zero findings.

The recurring root causes are the same three everywhere: an ISMS that exists as documents rather than operations, a single overloaded owner, and no internal audit run before the external one arrives. Right-size the program to the company you actually are — ISO 27001 for startups covers that shape — and if the honest answer is that nobody has cycles to operate it, that’s the gap managed compliance services close.