Quarterly evals
Between audits, the client’s certified agent is re-tested each quarter against the same scope as the initial evals. Today the auditor is not involved in the quarterly rounds; auditor-led quarterly evals are in development alongside auditor-led evals. Results are added to the evaluation results in the report.Annual re-certification
Re-certification is substantially lighter than the initial audit: controls remain in place, and evidence locations, owners, and formats are already established. The client is certified against the latest version of the standard, receives guidance on what has changed since the last audit, and opts in to new controls.1
Choose the auditor
The client chooses their auditor, existing or new.
2
Confirm scoping
Scoping is confirmed and the Statement of Applicability updated to the latest version of the standard.
3
Re-run the evals
AIUC re-runs the technical evaluations.
4
Audit the controls
A full audit of controls by the auditor, following the fieldwork process.
5
Issue the updated report and certificate
The auditor issues the updated report with its recommendation and AIUC issues the new certificate.
Output. Quarterly results added to the report, and an updated report and certificate at re-certification.
Re-certification and maintenance
What re-certification requires and how standard versions apply.
Changelog
Every quarterly change documented with type, notes, and reasoning.
Next: Client kit
Client-facing assets for every phase.