A policy and completed control spreadsheet are only part of the evidence. Assessment must connect selected controls to the organisation’s current risks and actual operation.

01

Build a retrievable control trail

Link a risk, treatment decision and applicable control to an owner and current record. Access approvals, leaver removal, restore tests, supplier reviews and incident handling should refer to the services in scope. Protect sensitive evidence while allowing the assessor appropriate access. A confidential classification should not become a reason to present no evidence.

02

Evaluate effectiveness rather than document count

A hypothetical restore test may complete technically but recover an obsolete file. Record success criteria, recovered version, time, observations and follow-up. Distinguish a tool dashboard from the management review of its findings. Track a failed control through cause, correction, corrective action and effectiveness review; closing a ticket is not proof that recurrence has been addressed.

03

Separate preparation from certification fees

Allow time for risk treatment, control implementation and operating records, internal assessment and management review. Audit planning depends on scope, workforce, complexity and sites under the applicable certification rules. Compare initial audit, surveillance, recertification, travel and additional assessment charges. Tool licences, remediation and consultancy are separate costs; no universal completion time follows from buying a template.

04

Verify the result and its limits

Match the certificate number, legal entity, activities, sites, edition and current status with the issuer’s official route and claimed accreditation scope. A limited service certificate cannot certify a whole software product or guarantee legal privacy compliance. ISO does not issue certificates. The independent certification decision belongs to the competent body, not the preparation consultant.

Sources and application limits

Examples describe possible checks, not a customer event or a security guarantee. Scope and actual control implementation must remain consistent as services change.