Integrated management systems · Basic · 12 min lesson
Operation, evaluation and improvement - audits, certification and the medical-device link
ISO/IEC 27001:2022 with Amendment 1:2024 - clauses 8 to 10, certification audits, ISO/IEC 27002, ISO 13485 and IEC 81001-5-1
What you will learn
- Describe operational control, monitoring, internal audit and management review under clauses 8 and 9.
- Explain nonconformity handling and continual improvement under clause 10, and the stage 1 and stage 2 certification audits.
- Relate ISO/IEC 27001 to ISO/IEC 27002, ISO 13485, IEC 81001-5-1 and MDR Annex I sections 17.2 and 17.4.
Key takeaways
- Clause 8 runs the planned processes, controls change and outsourcing, and repeats risk assessment at planned intervals or on significant change.
- Clause 9 evaluates performance: monitoring, internal audit by objective and impartial auditors, and management review with decisions.
- Clause 10.2 requires root cause action and a review of effectiveness; clause 10.1 requires continual improvement.
- Certification has stage 1 (readiness) and stage 2 (effectiveness); the certificate lasts three years with annual surveillance; 2013 certificates ended 31 October 2025.
- ISO/IEC 27002 guides controls; ISO 13485 and IEC 81001-5-1 address device quality and product security, and MDR Annex I 17.2 and 17.4 set legal expectations.
Free practice question
Quillon Telehealth Software, a fictional startup, has a stage 2 certification audit in three weeks. It has never held a management review and its first internal audit is planned for the month after.
What is the best advice?
Hold an internal audit and a management review before stage 2, because the clauses require them and the certification body will ask for the records.
Correct. Clauses 9.2 and 9.3 require internal audit and management review, and the certification body needs evidence of both before stage 2.
Proceed: the certification body performs the first audits, so internal ones are optional.
Not quite. Clause 9.2 requires the organisation's own internal audits; the external audit does not replace them.
Delay the internal audit until after certification to avoid creating findings.
Not quite. Clause 9.2 audits exist to find and fix problems, and avoiding them risks a major nonconformity at stage 2.
Replace both with a letter from the CEO saying the system works.
Not quite. A statement is not an audit or review under clauses 9.2 and 9.3, which require evidence-based processes.
Key terms
- internal audit: A planned, evidence-based check by objective and impartial auditors of whether the ISMS conforms and is effective.
- management review: Planned review of the ISMS by top management, using defined inputs and producing decisions.
- corrective action: Action taken to eliminate the cause of a nonconformity so that it does not recur.
- stage 1 / stage 2: The two parts of an initial certification audit: readiness review, then implementation and effectiveness audit.
- IEC 81001-5-1: Standard for security activities across the life cycle of health software.
- surveillance audit: Yearly audit by the certification body between initial certification and recertification.
Official sources
- ISO/IEC 27001:2022 - Information security management systems
- ISO/IEC 27002:2022 - Information security controls
- IEC 81001-5-1:2021 - Health software and health IT systems: security, activities in the product life cycle
- How MDR regulates software (Annex I 17.2 and cybersecurity guidance)
- ISO 27001:2022 and ISO 27002:2022 explained, transition deadline (Secureframe)
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.