ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An ISO 27001 certification transfer is the one move in the certification lifecycle most companies get wrong, because they assume switching auditors means starting over. It does not. A written international rule governs exactly how one certification body hands your certificate to another, what the receiving body may ask for, and when it is allowed to tell you that you are a brand new client. Know that rule and you can change certification bodies mid-cycle without losing your certificate, your original certification date, or your audit schedule.
Free gap assessment
Where do you actually stand against ISO 27001?
Score every management system clause and all 93 Annex A controls, free, and get a prioritised gap list back.
Run the free ISO 27001 gap assessment → or View premium report sample
The governing definition is narrow. A transfer of certification is the recognition of an existing and valid management system certification granted by one accredited certification body — the issuing certification body — by another accredited body, the accepting certification body, for the purpose of issuing its own certificate.
Three things follow. The certificate has to be alive at the moment of transfer: a transfer recognises something current, not something that lapsed last year. The accepting body issues its own certificate, so the old document is retired rather than re-stamped. And holding two certificates at once is not an ISO 27001 certification transfer — concurrent certification by more than one body falls outside the definition entirely and is explicitly discouraged. If you are shopping for a second opinion you are buying a second certification, with two full audit programmes to pay for.
The underlying requirement is short. Under ISO/IEC 17021-1:2015 clause 9.1.3.4, a body taking on a transferring client must take account of certification already granted and audits already performed by another body, and must obtain and retain sufficient evidence — reports, corrective action records — relating to any nonconformity. The mandatory document built on that clause carries all the operational detail.
This is the detail almost every competing page still has wrong. For years the operative document was IAF MD 2, the International Accreditation Forum’s mandatory document for the transfer of accredited certification of management systems, most recently IAF MD 2:2023.
The International Accreditation Forum ceased operations on 1 January 2026. Its role passed to the Global Accreditation Cooperation Incorporated, or Global ACI, which now manages the multilateral recognition arrangements that make accredited certificates portable across borders. The transfer document was reissued as Global ACI-TECH-3-002 (M), version 1.0, issued 10 July 2026 with an implementation date of 28 August 2026.
The good news for anyone mid-transfer: the document says it is based on IAF MD 2:2023 and that the text was reformatted “without any substantive change to the text.” The requirements are identical. What changed is the document number, the clause numbering inside section 2.2.4, and the references — eligibility now keys to a Global ACI Arrangement or Regional MLA signatory rather than an IAF one. So if a certification body quotes you “IAF MD 2” this year, the substance is still right; but if a consultant claims the rules for an ISO 27001 certification transfer tightened in 2026, they have not read the amendment table, which records one entry: initial issue of the Global ACI document.
Eligibility is a gate, not a negotiation. Three conditions decide whether an ISO 27001 certification transfer is even on the table.
The certificate must be accredited. Only certification covered by the accreditation of a Global ACI Arrangement or Regional MLA signatory, at level 3 and where applicable levels 4 and 5, is eligible. An unaccredited certificate cannot be transferred at all — the holder is treated as a new client, full stop. This is the most common reason a transfer collapses, and it is why the distinction between accredited and non-accredited ISO 27001 certification matters long before you think about switching bodies.
The certificate must be valid and not suspended. Certification known to be suspended shall not be accepted for transfer. A suspended certificate is temporarily invalid, and an ISO 27001 certification transfer is not a route around it — clear the suspension with the issuing body first, then move. For how suspension, withdrawal and expiry interact, see our guide to ISO 27001 certificate validity.
If your certification body collapsed, the clock is short. Where certification was granted by a body that has ceased trading, or whose accreditation has expired, been suspended or withdrawn, the transfer must be completed within six months or by the expiry of the certificate, whichever comes sooner. The accepting body must also notify the accreditation body under whose accreditation it intends to issue the certificate, before the transfer. Six months is not long to find a new body, get through a documentation review and reach a certification decision.
The accepting body must carry out a documented review of your existing certification before it can issue anything. By default that is a documentation review. A pre-transfer visit is added only where the documentation review shows it is needed — the example given in the rule is outstanding major nonconformities. That visit is explicitly not an audit, although whoever conducts it must hold the same competence required of an audit team for your scope.
Eight areas must be covered as a minimum, and the review and its findings must be fully documented:
| Check | What the accepting body is confirming | How it fails |
|---|---|---|
| Scope vs both bodies’ accreditation | Your certified scope sits inside the accredited scope of the issuing body and the accepting body | The new body is not accredited for your sector or standard |
| Issuing body’s scope vs its MLA scope | The old body’s accredited scope falls within its accreditation body’s MLA scope | The certificate was outside the recognition arrangement all along |
| Reason for the transfer | Why you are moving | Rarely fatal, but a move to dodge findings is visible here |
| Site validity | Every site wishing to transfer holds valid accredited certification | A site added without an audit, or dropped from the old certificate |
| Audit reports and open findings | Initial or most recent recertification report, the latest surveillance report, and the status of every outstanding nonconformity | Reports not made available, or a surveillance or recertification audit not completed on programme — either forces new-client treatment |
| Complaints | Complaints received about you and the action taken | Unresolved complaints feed the new body’s audit plan |
| Audit plan and programme inputs | Everything needed to build the remaining programme; the old body’s programme should be reviewed if available | No programme to inherit, so the plan is rebuilt from scratch |
| Regulatory engagement | Any current engagement with regulators relevant to your scope, on legal compliance | An open regulatory matter you did not disclose |
The fifth row is where most transfers are actually decided. Two triggers in that single requirement send you back to new-client status: the audit reports are not made available, or an audit your old programme called for was never completed. Both are knowable before you sign anything, which is why the paperwork request should come first and the contract second.
If the pre-transfer review finds no problems, your certification cycle is based on the previous cycle and the accepting body builds the audit programme for whatever remains of it. You do not restart a three-year clock. Transfer eight months after a recertification decision and the new body picks up the surveillance and recertification schedule from there.
Two consequences are worth planning around. First, the accepting body may quote your original initial certification date on the new certificate, with an indication that you were certified by a different body before a given date. A 2019 initial certification date is an asset in a vendor questionnaire, and you do not have to surrender it to change auditors. Note the wording: the body can do this, not must. Ask during the quote stage.
Second, the certification decision must be taken before any surveillance or recertification audit is initiated, so an ISO 27001 certification transfer cannot be bolted onto a surveillance visit as a convenience. The decision comes first and the audit programme runs after, and the decision follows the normal rules — including that the people making it are different from the people who carried out the pre-transfer review.
Before issuing anything the new body must also deal with your open findings: verify that corrections and corrective actions for all outstanding major nonconformities are implemented, and accept your correction plans for all outstanding minor ones. A minor finding needs an accepted plan; a major one needs verified, completed action. If you are unsure which of your findings is which, our guide to ISO 27001 nonconformities covers the distinction.
“Treated as a new client” is the outcome to design against. It means a full two-stage initial audit, a cycle that begins with the new certification decision, and the loss of your original certification date. Here is the honest comparison.
| Transfer accepted | Treated as a new client | |
|---|---|---|
| Assessment | Documentation review, plus a pre-transfer visit only if the review identifies a need | Full stage 1 and stage 2 initial audit |
| Certification cycle | Continues the previous cycle; the new body programmes the remainder | Starts fresh at the certification decision |
| Original certification date | Can be quoted on the new certificate | Not carried over |
| Open major nonconformities | Corrective action must be verified before issue | Handled inside the initial audit |
| Typical trigger | Valid accredited certificate, complete audit history, cooperative outgoing body | Unaccredited certificate, missing reports, an overdue surveillance or recertification audit, or review findings that block completion |
Beyond the eligibility failures already covered there is a catch-all: where the pre-transfer review identifies issues that prevent completion, the accepting body must treat you as a new client, must explain the justification to you, and must keep records of it. If a body tells you that you are starting over, you are entitled to the documented reason.
One piece of consumer protection is easy to miss. Bodies may run procedures more stringent than the minimum, but only provided a client organisation’s freedom to choose a certification body is not unduly or unfairly constrained. A policy that makes an ISO 27001 certification transfer practically impossible is not a legitimate house rule.
An ISO 27001 certification transfer depends on cooperation between the two bodies, and the rules say so. When requested, the issuing body shall provide the accepting body with all the documents and information the mandatory document requires. You have a part to play: the transferring client must authorise that release, so send the written authorisation early rather than waiting to be asked.
Two protections then apply. The issuing body must not suspend or withdraw your certification merely because you said you are leaving, as long as you still satisfy the requirements of certification. And if it withholds the requested information, or suspends or withdraws your certificate without cause, the accepting body and/or you must contact the accreditation body that accredits it — which is required to have a process for dealing with it, up to withdrawing the uncooperative body’s accreditation.
Where communication with the issuing body proves impossible, the accepting body must record the reasons and make every effort to obtain the information from other sources. A silent predecessor does not automatically kill an ISO 27001 certification transfer, but it does put the burden on you to produce your own copies of the audit reports. Keep them. Once the accepting body has issued your new certificate it must inform the issuing body, which is what formally closes the old relationship.
Preparation is almost entirely document retrieval, and it is best done before you talk to prospective bodies.
Choosing the receiving body deserves the same scrutiny as choosing the first — scope of accreditation, sector competence and auditor availability matter more than price. Our guide on how to choose an ISO 27001 certification body works as well for an ISO 27001 certification transfer as for a first certification, and the step-by-step ISO 27001 certification guide sets out the lifecycle this sits inside.
Yes — that is the normal case for an ISO 27001 certification transfer. If the pre-transfer review identifies no problems the cycle continues on the previous schedule and the accepting body programmes the audits for the remainder. The certification decision must be made before any surveillance or recertification audit is initiated.
Not necessarily. The accepting body is permitted to quote your original initial certification date on the new certificate, noting that you were certified by a different body before a given date. It is discretionary, so get it confirmed in writing before you commit.
No. Certification known to be suspended must not be accepted for transfer. Resolve the suspension with the issuing body and return the certificate to valid status first. A transfer is not an escape route from findings.
You can still transfer, but it must be completed within six months or by the certificate’s expiry date, whichever is sooner, and the accepting body must inform its accreditation body first. Move fast, and gather your own copies of the audit reports immediately — those records can become hard to obtain.
Normally yes, because the default assessment is a documentation review rather than a two-stage initial audit, and a pre-transfer visit is only added when the review identifies a need. The saving disappears the moment you fall into new-client treatment, which is why the eligibility checks are worth doing before you request quotes. For the wider cost picture, see our ISO 27001 certification cost breakdown.
No. The requirements of ISO/IEC 27001:2022 are unchanged by who audits you: 93 Annex A controls across four themes, a mandatory Statement of Applicability under clause 6.1.3, and the same clause 4 to 10 obligations. A transfer changes your auditor, not your management system. What it does change is the evidence your new auditor has seen, which is why a clean, current document set shortens the whole process.
Free ISO 27001 risk assessment
Which of your risks sit above your appetite line?
Set your own risk criteria, pick from 61 information security risk scenarios, rate likelihood and impact, and decide how to treat each one. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free risk assessment → or View premium report sample
That document set is what most companies scramble for during a transfer. Our ISO 27001 Toolkit provides 165 templates mapped to ISO/IEC 27001:2022 — policies, the Statement of Applicability, the risk register, internal audit and management review records, and the corrective action forms a pre-transfer review asks to see. It is $99 for the complete set, which is less than the time it takes to rebuild a missing audit trail under a six-month deadline.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026