ISO/IEC 27001 audit duration: how ISO/IEC 27006-1 sets audit time

Which document sets ISO/IEC 27001 audit duration?

ISO/IEC 27001 audit duration for accredited certification is set by ISO/IEC 27006-1:2024, Requirements for bodies providing audit and certification of information security management systems, Part 1. Audit time rules sit in Annex C (Annex B in the 2015 edition). IAF MD 5 does not apply to ISMS, although ISO/IEC 17021-1:2015 still governs the certification cycle and requires a documented, justified audit time for every client (clause 9.1.4).

The 2024 edition was published in March 2024. Under IAF MD 29:2024, accreditation bodies had to be ready to assess against it by 31 December 2024, use it for initial and extension assessments starting no later than 31 March 2025, and complete the transition, together with their certification bodies, by 31 March 2026. Check for later amendments before updating your procedure.

What changed in ISO/IEC 27006-1:2024 audit time?

The 2024 edition keeps the principle of a table of audit time by number of persons, adjusted by documented factors. What changed is mostly how the number is counted and how special cases are handled.

Who counts towards ISO/IEC 27001 audit duration?

Start with every person doing work under the organisation's control within the ISMS scope. That includes contractors, freelancers and outsourced staff working within the scope. For many technology clients this is the biggest source of error: headcount on the application form lists employees, while a large share of the development or operations work is done by contractors.

Ask for the number of persons in scope by role, site and employment type, and refresh it before each recertification. Part-time staff and shift patterns need the same attention as under MD 5, and your procedure should say how you convert them.

How does the identical activities reduction work?

Clause C.3.4 allows an effective number of personnel where persons perform certain identical activities. European co-operation for Accreditation (EA) guidance of September 2024 explains how it applies: the activities must be similar or repetitive, simple, and need limited skills, knowledge or education. The certification body must establish, justify and document the criteria and a risk analysis for each category, and still allocate enough time for a complete and effective audit.

The square root is applied to each category separately. EA's example has three categories of 49 persons (technicians, support staff and service desk). Each counts as √49 = 7, so the three categories count as 21 persons, and it is not acceptable to take the square root of all 147 together, which would give 12. EA puts the difference at about one audit day.

How is ISO/IEC 27001 audit duration set for multi-site clients?

Clause C.6 says total audit time for the on-site audit is calculated from the total number of persons doing work under the organisation's control, irrespective of their location. Summing separately calculated times for each site is an alternative only where that total is larger. When asked whether this conflicts with IAF MD 1, EA answered that ISO/IEC 27006-1 shall be applied, as stipulated in the scope of IAF MD 1.

The planning consequence: the number of sites no longer drives the total, but it still drives the booking. The total days have to be distributed across the sites that matter for information security risk, and every site day is a trip. For the sampling side, see IAF MD 1 multi-site sampling.

A worked example

1. Count everyone in scopeA software company has 60 developers (20 of them contractors), 49 service desk staff and 30 in management and support functions: 139 persons.
2. Test for identical activitiesThe service desk follows scripted, repetitive work needing limited skills. With documented criteria and risk analysis, it counts as √49 = 7. Development work is not simple or limited-skill, so all 60 count.
3. Find the effective number60 + 7 + 30 = 97 persons for reading the Annex C table.
4. Apply factors and recordAdjust for documented factors such as complexity and risk, record the justification and plan on-site and remote activities in the audit plan.

Leaving out the 20 contractors would have understated the count. That is the kind of error accreditation assessors find in client files.

How does ISO/IEC 27001 audit duration affect scheduling?

Once calculated, ISMS audit days behave like any other audit days. They sit inside the same ISO/IEC 17021-1 cycle, with surveillance at least once a calendar year and recertification before expiry. They need auditors competent in ISMS and in the client's technical area. Where ISO/IEC 27001 is audited together with ISO 9001 or others, each standard's time is calculated separately first under IAF MD 11 integrated audit time rules.

Remote work is more common in ISMS audits and the 2024 edition removed the separate approval step above 30% remote activity. Plan remote and on-site parts explicitly in the audit plan, since that decides which days need travel. See remote audits under IAF MD 4.

• ✓Procedure updated to ISO/IEC 27006-1:2024 Annex C
• ✓Persons in scope include contractors and outsourced staff
• ✓Identical activity categories documented with criteria and risk analysis
• ✓Square root applied per category, not to the whole headcount
• ✓Multi-site time based on total persons irrespective of location
• ✓Remote activities identified in the audit plan

ScheduleAI is audit scheduling software built for testing, inspection and certification (TIC) organisations, with a planner approving every plan.