Say a small company just earned an ISO 27001 accreditation. What happens if during one of the audits it is found that the company didn't follow the ISMS? Is there a certain warning process that company has to go through? I basically want to know if there are instances when an ISO 27001 accreditation gets retracted and how?
I could not find anything about this particular ISO 97001 on the ISO website or any other related sites. But I saw you placed a tag ISO 27000 and that you mentioned ISMS, so I suppose you are talking about ISO 27001 which is Information Security Management System.
Normally, with all ISO certification, once you are accredited the certificate, scheduled surveillance audits will have to take place. Should you have major deficiency, the auditor will give you a certain amount of time to take corrective actions. If, after the given time, you have not successfully implemented those corrective actions or adjusted your processes, a certificate revocation will/can be issued.
The main reason you implement the ISO 27001 is to cover business risks. If you see that you have the ISO 27001 but that you actually don't bother using the controls defined in the framework except when there's an audit, then you have a serious security mentality issue within your company. Also note that if there is a serious incident and it is shown that controls defined in the framework were not followed, you are not covered by the framework/certificate anymore.
Well, not all non conformities should be treated alike and this is why I think that the information security standard is subjective.
Speaking of the scenarios that may (not necessarily limited) apply here:
- a need improvement is raised rather than a non conformity and a follow-up surveillance audit (different than the yearly one) is required.
- a non conformity is given and the certification is taken away. In this case a full certification engagement need to take place in order to attain the certification again