Certify & attest
Industry programs
Run it for you
Penetration testing
OneAudit
Every framework, one audit, one timeline.SOC 2, ISO 27001, PCI DSS and pentesting run together, with evidence collected once.
How OneAudit worksGRSee has become a trusted advisor when it comes to all security and compliance issues.Eilon Reshef, CTO & Co-Founder, Gong
On 14 October 2026, GRSee and Secfix hosted ISO 27001 Audit Unplugged, a practical discussion about what teams should expect before, during, and after an ISO 27001 audit.
Amir Berkowitz, ISO 27001 Lead Auditor at GRSee Consulting, and Branko Džakula, Co-Founder & CISO at Secfix, covered audit readiness from both sides of the table: how organizations prepare, what auditors need to verify, and what happens when they find gaps.
The central idea was simple: An ISO 27001 audit should not feel like a black box.
That means checking whether control owners understand their responsibilities, processes are being followed, evidence reflects real operations, and the ISMS is maintained over time. The goal is not a perfect dashboard.
It is an ISMS that is genuinely being used.
Documentation matters, but it doesn’t always prove a control works.
A policy explains what should happen. A screenshot may show a point-in-time condition.
The auditor still needs enough evidence and context to understand whether the control operates as intended. That may include who performed the activity, when it happened, whether the process was followed, and whether the outcome matches what the organization says it does.
The question is not simply: “Do you have the document?”
It is: “Can you demonstrate that the process described in the document is actually happening?”
Not every issue found during an ISO 27001 audit has the same significance.
The webinar discussed three common categories:
A smooth ISO 27001 audit is rarely the result of a last-minute evidence push.
Readiness is easier when the ISMS has been operating over time, responsibilities are clear, reviews happen when they should, and evidence is created as part of normal operations.
That also matters after certification.
ISO 27001 does not end with the initial certification audit. Organizations must maintain and improve the ISMS through surveillance audits and future recertification.
The stronger the process, the less the organization has to reconstruct each time the auditor returns.
Most audit uncertainty becomes easier to manage when expectations are clear before the audit begins.
Teams should understand:
The goal isn’t to memorize the auditor’s questions.
It is to build an ISMS that can stand up to them.
Not necessarily.
A dashboard may show that tasks are complete and evidence has been uploaded, but an auditor also needs to understand whether the ISMS is operating in practice. That includes whether control owners understand their responsibilities, processes are being followed, and evidence reflects real activity.
The webinar covered the distinction between the two stages and what organizations should expect during each. At a high level, they are different parts of the certification audit process, each with a different focus.
The key takeaway was that teams should understand what the auditor is trying to verify at each stage, rather than treating the audit as a single event.
Sometimes they may support the audit, but they do not automatically prove that a control is working.
A policy explains how a process should operate. A screenshot may show a point-in-time condition. Auditors may still need additional context or evidence to understand whether the control is operating as intended.
A minor nonconformity is an issue that needs to be addressed but does not necessarily indicate a broader management system failure. A major nonconformity is more significant and may indicate a serious breakdown or absence of an important requirement.
The right response depends on the issue’s significance and what needs correcting.
An opportunity for improvement is an area where the organization could strengthen the ISMS even when there is no formal nonconformity. It is not the same as a failed requirement, but it can still help the organization improve how the ISMS operates.
No.
Certification is not the end of the process. Organizations must continue maintaining and improving the ISMS through surveillance audits and future recertification. The stronger the ISMS operates between audits, the less teams need to reconstruct when the auditor returns.
GRSee helps organizations prepare for and complete ISO 27001 audits with clearer expectations, practical guidance, and direct access to experienced auditors.
Whether you are preparing for your first ISO 27001 certification audit, approaching surveillance, or managing multiple frameworks, we help identify gaps early, clarify evidence requirements, and make the audit process more predictable.
4.9