Before scheduling
Begin with your actual audit timetable and scope.
Record the certification date, any surveillance or recertification dates, the current Statement of Applicability, last internal audit, overdue corrective actions and changes in business context. Do not work from the assumption that a certificate lasts forever without ongoing assessment.
The timetable below is an illustrative management cadence, not a mandatory set of monthly ISO clauses. Frequency should be chosen through your risk process, organisational requirements and the agreement with your certification body.
A working year
Twelve months of visible responsibility.
A useful calendar contains the review activity, evidence expected, responsible owner, completion date and any linked actions. The owner may be a technical control operator, risk manager, department head or outsourced ISMS coordinator depending on the activity.
| Period | Example focus | Resulting record |
|---|---|---|
| Month 1 | Confirm ISMS scope, calendar and action backlog | Programme plan and owner list |
| Month 2 | Review material asset and supplier changes | Updated risk/action register |
| Month 3 | Review control ownership and evidence gaps | Control-evidence status |
| Month 4 | Policy and access-review sampling | Review records and issues |
| Month 5 | Check awareness, training and incidents | Exceptions and improvement actions |
| Month 6 | Management review and objective trends | Minutes and decisions |
| Month 7 | Review critical supplier assurance | Supplier register update |
| Month 8 | Check changes, continuity and testing | Evidence and lessons learnt |
| Month 9 | Independent internal audit work as scheduled | Audit report and findings |
| Month 10 | Corrective actions and risk treatment | Closure evidence |
| Month 11 | External assessment preparation | Approved evidence pack |
| Month 12 | Leadership review and next-year planning | Programme adjustments and objectives |
Responsible owners
What should the ISMS coordinator actually do?
The coordinator tracks outstanding work, requests updates and maintains the register. Control owners implement their obligations; leaders make risk decisions; internal auditors provide independent assurance; and the accredited certification body performs its own assessment.
Review frequency is not fixed solely by a sample spreadsheet. An incident, major system change, new supplier or material legal obligation can trigger additional review. Maintain a record explaining why a control was assessed at the chosen interval.
Companion documents
Link each activity to evidence rather than prose.
Useful connections include the risk treatment plan, Statement of Applicability, internal audit programme, management review minutes, corrective-action log, objectives and recorded control results. Some will contain sensitive data: use protected client systems and share externally only with authorisation.
This calendar is educational, not an audit guarantee. It should be reviewed by a qualified practitioner for your organisation.
- Never upload sensitive audit packs into an open form
- Ensure records have version, owner and review date
- Keep an exception path for controls that fail
- Confirm the certification-body calendar directly
Rescue scenario
When the ISMS owner leaves eight weeks before surveillance.
An operations team discovers that its previous ISMS coordinator has left, the certification body visit is eight weeks away and no one can locate the last access review. The immediate step is to preserve existing evidence and map each missing activity to a current responsible person. Do not manufacture historical records.
In week one, confirm the audit's agreed scope and dates; weeks two and three establish the outstanding evidence inventory and action owners; subsequent weeks should prioritise controls actually sampled or materially changed, with regular leadership decisions. The calendar is a triage tool, not an assurance that all defects can be fixed within eight weeks.
Primary references and further reading
These public references inform the topic; they do not constitute an endorsement or review of our services.
Editorial content reviewed: 12 October 2026. Specialist technical review is required before applying this guidance to a real environment.Put this into practice