Six ISO 27001 Myths That Cost Candidates Marks

Six beliefs cause more wrong answers than any others: that ISO/IEC 27001 is an IT standard, that all 93 Annex A controls must be implemented, that certification proves an organisation will not be breached, that the audit team decides certification, that more documents mean a better ISMS, and that a nonconformity means the organisation has failed.

These are not straw men. Each is a reasonable-sounding position that a working professional can hold for years without being corrected, because in ordinary conversation nobody pushes on it. An examination pushes on it.

Definitions below are given in short form rather than reproduced, because the standards are copyright documents you buy. Clause references are to ISO/IEC 27001.

ISO 27001 myth 1: ISO/IEC 27001 is an IT standard

The most expensive misconception in the subject is that this is an IT standard. It is a management system standard that happens to be about information. Clauses 4 to 10 are the same management-system spine used by ISO 9001, ISO 14001 and ISO 45001 — context, leadership, planning, support, operation, performance evaluation, improvement — with the information-security-specific requirements layered on top at Clause 6, Clause 8 and Annex A. Information here includes paper, conversations, people, premises and suppliers, not only systems.

Why it costs marks. A candidate who believes this reaches for technical controls when the question is about a management system failure. Asked about an organisation whose leadership never attends management review, they look for a security gap. Asked about a supplier arrangement, they look for encryption.

The tell in a question. When a scenario describes people, paper, premises or suppliers and the plausible-looking answers are all technical, this is usually what is being tested.

ISO 27001 myth 2: all 93 Annex A controls must be implemented

Annex A is a normative annex containing 93 controls in four themes — organizational (37), people (8), physical (14) and technological (34). It is not a catalogue to implement in full, and it is not optional either. Controls are determined by the risk treatment; Clause 6.1.3 c) then requires them to be compared against Annex A to verify that no necessary control has been omitted, and the standard says in terms that the list is not exhaustive and that controls from other sources may be used. So every one of the 93 must be considered, and any excluded must be justified in the Statement of Applicability.

The myth reverses the direction of travel. Risk assessment first, controls determined by the treatment, Annex A used afterwards as the completeness cross-check. An organisation that started from the 93 and worked backwards usually has a risk assessment written to justify decisions already taken.

Why it costs marks. It produces the answer “raise a nonconformity because control A.8.24 is excluded”. An exclusion is not a nonconformity. An exclusion without a justification that holds up against the organisation’s risks is. The difference is the whole answer.

The mirror-image error. Believing the annex is optional. It is normative, every control must be considered, and each exclusion must be justified in the Statement of Applicability. “Not a shopping list” does not mean “ignore it”.

ISO 27001 myth 3: certification proves an organisation will not be breached

Certification is third-party attestation that an ISMS conforms to the standard. It rests on evidence sampled, at a point in time, within a defined scope. It is not a warranty of security and it never was. A certified organisation can be breached the following week without its certificate having been wrong.

What certification does say is worth being precise about: that a system for managing information security risk exists, was found to conform, and was found to be effectively implemented on the evidence seen.

The distinction that travels with it. Certification is not accreditation. Certification is granted to an organisation by a certification body. Accreditation is recognition — by an accreditation body — that the certification body is competent, impartial and operates consistently. Impartiality is the part people drop, and it is the part that makes a certificate mean anything. An organisation is certified; a certification body is accredited.

Why it costs marks. It produces answers in which an auditor withholds a recommendation because they personally judge the organisation insecure. An auditor reports conformity and effectiveness against criteria, on objective evidence. Their impression of the organisation’s overall security posture is not the criteria.

ISO 27001 myth 4: the audit team decides certification

It does not. The audit team recommends; the certification body decides, and the decision is taken by people not involved in the audit. That separation is a requirement on the certification body rather than a courtesy.

It has a practical consequence candidates miss: an audit team leader who tells a client at the closing meeting that they are certified has both got a fact wrong and pre-empted a decision that is not theirs. What the team can say is what it found and what it will recommend.

Why it costs marks. Scenario questions about closing meetings and reporting frequently offer an option in which the team grants, withholds or promises certification. It is always the wrong option.

ISO 27001 myth 5: more documents mean a better ISMS

A widespread belief, and the one that produces the most wasted effort in real organisations.

The standard asks for specific documented information — the scope, the policy, the risk assessment and treatment processes and results, the Statement of Applicability, objectives, competence evidence, monitoring results, internal audit and management review results, evidence of nonconformities and actions — plus whatever the organisation itself determines is necessary for the ISMS to be effective. That last requirement is a ceiling as well as a floor. Documentation nobody uses is not evidence of a working system.

Two auditing consequences follow. A thick manual is not a pass, and an auditor who reads documents rather than testing operation will miss everything. And a thin, used, current set of documents is not a finding — unless something the standard requires is missing, or the organisation’s own documented procedures are not being followed. The organisation’s own documents are part of the audit criteria, which is why writing more of them creates more ways to be nonconforming.

Why it costs marks. It produces findings written against a preferred level of documentation rather than against a requirement. An auditor who would have documented it differently has an opinion.

ISO 27001 myth 6: a nonconformity means the organisation has failed

It does not, and the belief distorts behaviour on both sides of an audit. Organisations argue findings that should be accepted; auditors soften findings they should raise, or inflate them to seem rigorous.

A nonconformity is the non-fulfilment of a requirement. Nothing more is claimed by it. What matters more than the finding is what happens next, and this is where the most-tested distinction in the subject lives.

Correction eliminates the detected nonconformity — the immediate fix. Corrective action eliminates the cause so the nonconformity does not recur or occur elsewhere.

Clause 10.2 is more precise than most summaries of it. When a nonconformity occurs the organisation must react to it — controlling and correcting it, and dealing with the consequences — and then evaluate the need for action to eliminate the causes so that it does not recur or occur elsewhere, by reviewing the nonconformity, determining its causes, and determining whether similar nonconformities exist or could occur. It must then implement any action needed, review the effectiveness of any corrective action taken, and make changes to the ISMS if necessary. Documented information is required on the nature of the nonconformity, the actions taken, and the results of any corrective action.

Read the second step again, because the common summary overstates it. What is mandatory is evaluating whether cause needs eliminating — not eliminating it in every case. An organisation that looked at a genuine one-off, concluded no further action was warranted and recorded that reasoning has conformed. So the finding to write against a correction-only response is not “no corrective action was taken”. It is “there is no evidence the need for corrective action was evaluated” — and the second version is the one that survives being argued with.

So an organisation that deletes the leaver’s account has made a correction. Whether it has met Clause 10.2 depends on whether anyone evaluated why the account survived the leaver — and whether the answer is recorded.

Why it costs marks. A response containing only a correction reads as complete, and candidates accept it. The right answer names what is missing: the evaluation of cause, and the evidence of it.

Two more ISO 27001 myths that cost marks, briefly

That an organisation may scope out whatever it likes. The organisation does determine the scope. But it must consider its internal and external issues, the requirements of interested parties, and the interfaces and dependencies between what it does and what other organisations do for it — and the scope must be available as documented information. What an auditor looks for is a scope narrowed artificially so the risky part of the business falls outside it. The mirror-image error, that any exclusion is a finding, is equally wrong.

That the most thorough-sounding answer is right. Scenario questions often offer an option that does more: raise a major nonconformity, escalate, stop the audit. It reads as diligent. The marks are on the answer the evidence in the scenario supports — usually to gather more objective evidence before grading. An IT manager says backups run nightly and nothing has ever been restored: the supported answer examines the procedure and the records, looks for evidence of a restore test, and raises a finding citing the requirement if there is none.

The pattern underneath all the ISO 27001 myths

Every finding, on any clause, needs three things: the requirement, the objective evidence, and the gap between them. Miss one and you have an opinion.

Every myth above fails the same test. Each substitutes something for the requirement or the evidence: a technical instinct, a checklist, a reputation, an assumption about who decides, a preference about documentation, or a display of thoroughness. Hold the requirement and the evidence apart, and ask what each of them actually establishes, and every one of these myths falls over.

Frequently asked questions about ISO 27001 myths

Where to go next: more ISO 27001 Lead Auditor exam preparation

What an information security management system actually is

ISO/IEC 27001 explained for auditors, not implementers

Confidentiality, integrity and availability in an audit

Threat, vulnerability, asset and control

For practice against scenario questions, the free 40-question mock exam is weighted to the published domain split, and the findings grading exercise attacks the myth that costs most.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.