The pattern repeats. A consultancy delivered a document set, the company achieved the certificate, and everyone moved on to the next thing. Then the person who owned it changed roles or left, the systems evolved, and the evidence stopped describing what the company actually does. Nobody decided to abandon ISO 27001; it simply stopped being operated. And now the surveillance audit is weeks away. If any of this sounds familiar, here is the order for getting through it.
How to tell your ISO project is stalled (not just "paused")
There is a difference between a paused project and a stalled one. It is stalled if several of these are true:
- The person who owned the ISMS has left, or no longer works on it.
- Evidence (access reviews, logs, training records) has not been generated in months.
- This cycle's internal audit has not been done, nor the management review.
- The systems have changed (new tools, new infrastructure) and the documentation does not reflect it.
- The risk assessment and statement of applicability describe a company that no longer exists.
With the surveillance audit close, it is a certificate at risk. Naming it precisely is the first step to fixing it.
What happens if you reach the surveillance audit like this
An ISO 27001 certificate is not a permanent stamp. It follows a three-year cycle: annual surveillance audits in years one and two, and a full recertification in year three. The surveillance audit does not re-examine everything, but it does check that the management system has continued to operate: that there is internal audit, management review, risk treatment and recent evidence. That distinction between a documented control and an operated one is exactly what a certification audit tests.
If the auditor finds the ISMS has stopped working, the result is nonconformities. A minor nonconformity is resolved with a corrective action plan and a deadline. A major nonconformity — or several — can lead to suspension of the certificate until it is closed. Withdrawal is less common, but suspension is problem enough: a suspended certificate is no use to the customer or tender that required it.
What can be salvaged and what has to be rebuilt
The good news is that a full rebuild is rarely needed. What usually survives: the scope of the ISMS, if the business has not changed radically; the statement of applicability, as a starting point to review rather than rewrite; and the base policies, even if they need updating.
What has usually expired: the evidence, which is the first thing to decay because it depends on continuous activity that stopped; the risk assessment, if the systems have changed; and the mandatory records of the cycle - internal audit, management review, corrective actions from the previous year.
The order of rebuilding when the audit is close
With the date looming, priority is set by what the auditor will check, not by what would be ideal:
- Close the mandatory records for the cycle: internal audit, management review and follow-up on the previous audit's nonconformities.
- Update the risk assessment and statement of applicability so they describe the current systems.
- Regenerate evidence for the highest-risk controls first: access, backups, vulnerability management.
- Document the system changes that happened during the stall.
One note of honesty: not everything can be rebuilt in a few weeks, and evidence cannot be manufactured backwards. An internal audit done yesterday does not prove the system worked six months ago. The defensible position is to arrive with the system operating again, a credible corrective action plan and traceability of what has been recovered. If the gap is too large for the date, it is better to speak to the certification body than to pretend.
Why projects stall (and how not to stall again)
The cause is almost never the quality of the original work. The delivery model is the problem: a certification project has a beginning and an end — documents delivered, certificate achieved — but an ISMS does not end on certificate day. Clauses 4 to 10 of the standard describe continuous activity, and that activity needs someone to operate it every month. When that someone is a single person with ten other priorities, the system stalls the moment they change focus. Neither the consultant nor the auditor is the problem: each did their part. The gap sits between the certificate and daily operation, and it is structural in any model that treats ISO as a project rather than a function. If it is not yet clear what separates a live system from a folder of documents, it helps to understand what an ISMS is and how it differs from having policies.
Restart without starting over
Restarting a stalled project is, above all, operating the ISMS again and doing it in the order the audit imposes. Qalea steps into exactly that gap: it assesses what can be salvaged and what has to be rebuilt, prioritises by what the auditor will check, and from there operates the system continuously so it does not stall again when the person of the moment changes. We do not promise rescue timelines that depend on the real state or on the certification body; the first step is an honest read of whether you make the date, and with what.
Tell us when your surveillance audit is and the state the system is in, and we will tell you what is realistic.
