Certification questions, answered

Are there sectors Complade does not serve?

Yes. At this time, Complade declines to offer services to organizations operating in the sectors excluded by its code of ethics, including where those activities are legal. Review the full list before applying. If your organization has several activities or you are unsure whether the policy applies, contact Complade to describe your activities before proceeding. A sector page does not confirm your eligibility.

What stands behind SCC accreditation?

The Standards Council of Canada (SCC) is a Government of Canada Crown corporation. Its accreditation assesses competence, impartiality and certification processes within a defined scope. Its management systems programme includes annual surveillance, periodic reassessment and witnessed audits under the programme requirements. International recognition arrangements also rely on peer evaluation of accreditation bodies. To assess a certificate, verify Complade’s current scope and status as well as the certificate’s own scope and status.

What are Complade’s corporation and business numbers?

Complade Inc. was federally incorporated on April 26, 2021. Its corporation number is 1296282-9 (federal registry ID 12962829). Its Business Number is 762703940 and its corporation income tax account is 762703940RC0001. The registered office is in Oshawa, Ontario. Its Ontario registry ID is 3292512, registered April 26, 2021. The supplied registry information lists both registrations as active; consult the official sources for current status. Corporate registration is separate from SCC (Standards Council of Canada) accreditation.

Is Complade an accredited ISO 27001 certification body?

Yes. Complade Inc. is accredited by the Standards Council of Canada (SCC) to provide ISO/IEC 27001 and CyberSecure Canada management-system certification. Accreditation means an independent accreditation body has evaluated Complade's competence, impartiality and certification processes. Verify the current status in the official SCC (Standards Council of Canada) directory and IAF CertSearch.

Who accredits Complade?

Complade is accredited by the Standards Council of Canada (SCC), Canada’s national accreditation body and a Government of Canada Crown corporation. International recognition arrangements formerly operated through the International Accreditation Forum transitioned to Global Accreditation Cooperation Incorporated on January 1, 2026. The organization seeking certification is certified by Complade; it is not accredited by Complade.

Is Complade a Canadian company?

Yes. Complade Inc. is a Canadian certification body headquartered at 2 Simcoe Street South, Suite 300, Oshawa, Ontario. Complade provides certification services across Canada in English and French, with remote ISO/IEC 27001 audits available to organizations worldwide subject to scope and audit feasibility.

Does Complade offer CyberSecure Canada certification?

Yes. Complade Inc. conducts accredited certification audits for the CyberSecure Canada standard for eligible small and medium-sized organizations. The Standards Council of Canada accredits Complade for this certification programme. Organizations can verify Complade in the official SCC (Standards Council of Canada) directory, review the certification process and apply through the Complade Audit Portal.

Does Complade only certify small companies?

No. Organizations of different sizes use Complade for independent assurance. ISO/IEC 27001 clients include the largest Canadian global aviation software company, headquartered in Saint John, New Brunswick; Ontario’s largest credit union; and Toronto’s largest independent medical laboratory services provider. CyberSecure Canada clients include Canada’s largest medical group purchasing organization, Alberta’s largest independent trucking company, and Canada’s largest museum technology services provider, based in Belleville, Ontario. More than 50% of Ontario community development organizations have been certified through Complade. IT (information technology) service providers in British Columbia, Alberta, Ontario, Quebec and New Brunswick also work with Complade. The audit plan and duration depend on each organization’s scope and complexity.

Are certificates issued by Complade internationally recognized?

Complade's Standards Council of Canada (SCC)-accredited ISO/IEC 27001 certifications benefit from the applicable multilateral recognition framework. On January 1, 2026, Global Accreditation Cooperation Incorporated assumed the operational roles previously held by IAF (International Accreditation Forum) and ILAC (International Laboratory Accreditation Cooperation) and established the Global ACI Multilateral Recognition Arrangement. Recognition depends on the certificate, Complade's accredited scope and the applicable signatory scope and transition arrangements. Clients and stakeholders should verify Complade and individual certification records using official sources.

What refund applies if SCC accreditation is rejected?

Complade will refund 100% of the certification fees paid to Complade for a valid ISO/IEC 27001 certificate issued within its accredited scope if it is rejected solely because SCC accreditation is not recognized in a country or economy covered by the applicable international recognition arrangement. Written evidence of the rejection is required. The policy sets out exclusions for certificate status, scope, other requirements and named certification bodies.

Is a Complade certificate as accredited and accepted as one issued by TÜV, BSI, SGS, PwC or KPMG?

Yes, when comparing valid ISO/IEC 27001 certificates issued within the applicable accredited scopes. Complade and every other certification body issuing accredited management-system certificates must be accredited by a competent accreditation body for the certification activities concerned. Complade is accredited by the Standards Council of Canada, Canada's national accreditation body, for ISO/IEC 27001 and CyberSecure Canada certification. In Canada, Complade, TÜV SÜD America and the specific SCC (Standards Council of Canada)-listed legal entities operating under major professional-services brands such as PwC and KPMG are assessed by SCC (Standards Council of Canada) under the same applicable management-systems accreditation programme and requirements. Other BSI, SGS or TÜV entities may instead be accredited by UKAS or another recognized national accreditation body. Within the relevant accredited and multilateral-recognition scopes, Complade's ISO/IEC 27001 certificates have the same accredited status and recognition; company size, price and brand awareness do not create a higher tier of accredited certificate. The exact legal entity, accredited scope and individual certificate should always be verified, and a separate contract or regulation may expressly require a named provider.

Why does Complade not have a heavy LinkedIn presence?

Complade prioritizes certification delivery, auditor competence, its client portal and publication of process, pricing and audit resources. Social-media activity is not evidence of accreditation or certification competence. Prospects should verify Complade through the official SCC (Standards Council of Canada) directory, IAF CertSearch, its published policies and its certificate registry.

Can Complade certify an organization outside Canada?

Yes. Complade accepts ISO/IEC 27001 applications from organizations outside Canada. Complade Inc. is the certification body issuing the certificate under its applicable Standards Council of Canada (SCC)-accredited scope. Audit language and remote delivery are confirmed according to scope, feasibility and team availability. Provide the legal entity, countries, sites and intended scope so Complade can confirm eligibility and any restrictions.

Does ISO 27001 require a fixed number of policies?

ISO/IEC 27001 requires documented information, including documents describing your system and records showing activities were carried out. The number of files or policies depends on how you organize them and what your ISMS needs. Information can be combined or kept in suitable tools, provided it is controlled and available. Prepare the information required by the standard and the additional information your organization needs. Use the portal evidence list and audit guide; a file count alone does not demonstrate conformity.

Can an employee conduct our ISO 27001 internal audit?

Yes, if they have the competence needed for the audit and can remain objective and impartial. Assess their knowledge of the ISMS, the activities being audited and audit methods. Assign work so people do not audit their own work, and address any conflicts of interest. A course can support competence, but attendance alone does not establish it. Small organizations can use an independent external internal auditor where needed. ISO/IEC 27001 requires the organization to complete its internal audit before the Stage 2 certification audit. Complade does not conduct its certification clients’ internal audits.

What records should we prepare for the internal audit?

Keep evidence of your internal audit programme and completed audits. The programme sets the frequency, responsibilities and reporting arrangements, taking account of the importance of processes and previous audit results. Each audit needs defined criteria and scope. Retain results and evidence that findings were reported to relevant management and followed up. A set of policies alone does not demonstrate an internal audit. ISO/IEC 27001 clause 9.2 covers internal audits; ISO 19011 provides guidance on audit methods.

What evidence is needed for management review?

Top management reviews the ISMS at planned intervals using the inputs required by ISO/IEC 27001 clause 9.3. These include audit and monitoring results, changes affecting the ISMS, risk assessment and treatment status, and opportunities for improvement. Keep a record of the review results, including decisions about improvements and any needed changes to the ISMS. The required inputs and outputs must be covered, but a separate meeting or a particular minutes template is not prescribed. A calendar invitation alone does not show what was reviewed or decided.

Can we apply while some audit evidence is still being prepared?

Yes. You can submit an application and describe your current readiness before every record is ready. Applying does not confirm readiness for certification. After scope review and signing the agreements, you can make Stage 1 evidence available through portal uploads, controlled auditor access or an available integration. The published target for initial review starts after the complete required submission and payment. Stage 1 assesses readiness for Stage 2, including internal audits and management review. Missing or ineffective activities may delay progression. Complade explains audit requirements and findings without providing implementation consulting.

How can we protect confidential information during the audit?

Review the mutual NDA and confidentiality terms before sharing evidence. Discuss sensitive records and access restrictions with your auditor before uploading or screen sharing. Evidence can include selected records, redacted copies or a controlled demonstration where these provide sufficient audit evidence. Do not upload passwords, private keys or access tokens. Auditors need enough evidence to support their conclusions; some records may contain personal or commercially sensitive information. Agree a suitable way to review it rather than assuming that all sensitive information can be excluded.

Can Complade confirm that our certification is in progress?

Yes. Once your engagement is confirmed and the formal certification process is underway, Complade issues a same-day attestation letter confirming that status. Creating an account or submitting an application alone does not establish that the certification process has formally started. The letter does not confirm conformity, replace a certificate or guarantee a successful certification decision. Your customer decides whether it meets their interim evidence requirements.

What is the timeline for ISO 27001 certification with Complade?

Across Complade customers, ISO/IEC 27001 certification takes about six weeks on average from application to certification. Some small organizations that are ready finish in less than two weeks; others take months and may still be implementing their ISMS. Timing depends on readiness, scope, team availability and resolution of findings. Certification follows an independent review and a positive decision.

Is there a minimum operating period before Stage 2?

Complade does not impose a fixed number of months that a management system must operate before Stage 2. The applicable requirements must be established and implemented for the defined scope, and sufficient evidence must be available for audit. For ISO/IEC 27001, this includes the internal audit and management review requirements. Stage 2 proceeds after the lead auditor concludes that the organization is ready to advance.

After we sign the agreement, when will the auditors start reviewing our submission?

Stage 1 begins immediately after the certification agreement is signed. Once all required documents are submitted, we carry out the Stage 1 review within one business day and provide the first draft report within two business days of the complete submission. Payment is due before the review, unless otherwise agreed. Stage 1 assesses readiness for Stage 2; clarifications or further evidence may be needed before it is complete.

How soon can Stage 2 be scheduled after Stage 1?

Stage 2 can start as soon as Stage 1 is deemed adequate and the lead auditor confirms readiness. Dates depend on the availability of the client and audit teams, usually within one to two weeks. There is no fixed waiting period.

What evidence does a cloud-based company need for CyberSecure Canada?

Prepare evidence against the applicable CAN/DGSI 104 requirements, including responsibilities, incident response, updates, protective software, secure configuration, authentication, employee awareness, backups, encryption, access controls, supplier arrangements and other applicable controls. Cloud hosting does not remove your own responsibilities. Provide the evidence requested in the portal and explain any exclusions. Planned penetration tests or privacy assessments should be coordinated with the audit schedule; a planned activity is not evidence that it has been completed.

What evidence should be ready before Stage 1 and Stage 2?

For ISO/IEC 27001 Stage 1, prepare the defined scope, information security policy, risk assessment and treatment approach, Statement of Applicability, objectives and relevant documented information, including internal audit and management review records. Stage 2 needs sufficient evidence that the system and applicable controls are implemented and effective, such as access reviews, incident records where applicable, training, monitoring and corrective actions. There is no universal minimum number of months, but blank templates are not evidence of completed activities. Readiness is assessed for the actual scope.

How can a company in British Columbia apply for ISO 27001 certification?

Apply through the Complade portal, as organizations elsewhere in Canada do. Describe the legal entity, activities, people, sites and proposed scope of your information security management system (ISMS). You can start a free, non-binding application while preparing. Remote delivery is subject to audit feasibility; your location alone does not determine whether an on-site visit is needed. The quotation confirms audit time, fees and delivery arrangements.

Is the audit price fixed after we sign the agreement?

The calculator provides a planning estimate. Complade reviews the application and confirms the scope, audit effort and fees in the written quotation and agreement before you sign. Those documents govern the agreed work. If your scope changes or additional verification is needed, the agreement determines how any extra work and charges are handled. Ask for confirmation before authorizing work outside the agreed scope. A small team can still have a complex environment, so include relevant outsourced activities and infrastructure in the application.

Why do published prices depend on using the portal?

Complade’s published prices rely on a streamlined process through our portal, with standard agreements and evidence submitted in one place. This keeps administrative overhead low and focuses fees on audit time, technical review and the certification decision. Required audit time, competence and impartiality remain unchanged. Requests for proposals (RFPs), custom contract negotiations and workflows managed manually by email fall outside published pricing. They require a separate quotation for the additional administration. As a planning indication, a custom process may cost around twice the published portal price; the actual fee depends on your requirements and is agreed before work begins. Use the portal process to benefit from published pricing.

What should I do if my quotation has expired?

Sign in to the Complade app and submit a new quotation request. Complade will review your current organization details and scope and provide an updated quotation for you to review.

What should I do if my quotation has expired?

Sign in to the Complade app and submit a new quotation request. Complade will review your current organization details and scope and provide an updated quotation for you to review.

How much does ISO 27001 certification cost for a small business in Canada?

Complade’s starting estimate is CAD $1,900 plus applicable taxes for 1 to 10 people in scope, under the published assumptions and for an audit in English. It covers Stage 1, Stage 2, audit reports, processing, the independent certification decision and certificate issuance when requirements are met. Stage 1 is not sold as a separate certification. Surveillance audits are additional; each annual ISO 27001 surveillance audit is estimated at 50% of the initial price for an unchanged scope. Travel, language and scope adjustments may apply. The application review and signed agreement confirm the fees.

How can I get an official certification quotation from Complade?

Start at app.complade.com and complete the initial application to receive an instant planning estimate. If your ISMS (information security management system) is ready or implementation is underway, continue with the detailed certification application by confirming the legal organization, requested certification, scope, in-scope personnel, activities, locations, audit language and delivery method. Complade reviews the completed scope and required audit time, then provides the official quotation and certification agreement through the portal. A complete, straightforward application can normally move from scope review to agreement and Stage 1 access within one business day. The online estimate is not the official quotation; the confirmed quotation and signed agreement are controlling.

What is included in the certification price?

The published initial-certification estimate covers the initial certification year: Stage 1, Stage 2, audit reports, processing, the certification decision and certificate issuance when requirements are met. It does not include later surveillance audits unless the official quotation expressly states otherwise. Applicable taxes, travel and accommodation for qualifying in-person audits are excluded. The base price assumes English; the calculator includes the surcharge for the selected audit language. The quotation and certification agreement are controlling for the confirmed scope.

Why can Complade’s ISO 27001 and CyberSecure Canada pricing be lower than other certification bodies?

Certification quotations can differ because the confirmed scope, audit effort, delivery arrangements and overhead can differ. Complade has invested in a portal and a standard process that keep administrative and operating costs low. Applications, agreements and evidence exchange are managed in one place, alongside audit planning and reports.

For ISO/IEC 27001, we determine audit time using the applicable ISO/IEC 27006-1 requirements. The calculation takes account of people in scope, complexity, sites and other relevant factors. The standard does not set certification fees or require every body to quote identical days for every organization. CyberSecure Canada follows its own applicable scheme requirements. Our pricing follows the work required for the confirmed scope.

Complade provides independent certification. We do not bundle implementation consulting or the sale of compliance software with certification. Our portal supports the certification process. Remote audits can reduce travel where suitable and permitted; audit language and delivery are confirmed during application review. Audits are available in English and French.

Complade is accredited by the Standards Council of Canada (SCC) within its published scope, which includes ISO/IEC 27001:2022 and CyberSecure Canada. SCC oversight includes annual surveillance and periodic reassessment of Complade. This is oversight of the certification body; your certification decision follows an independent review of your audit file. A lower fee does not change the applicable audit, competence or impartiality requirements.

For a Canadian organization with 35 people in scope, a non-complex environment meeting the published assumptions and an audit in English, the current ISO 27001 planning example is CAD 3,100 plus tax for initial certification. Each of the two annual surveillance audits is estimated at 50%, or CAD 1,550 plus tax, for an unchanged scope. Recertification is quoted separately. The quotation and agreement confirm the audit days, delivery arrangements and fees; the calculator is an estimate.

How much do surveillance audits cost?

Surveillance audits are priced separately from the initial certification unless the official quotation states otherwise. For ISO/IEC 27001, the planning estimate for each scheduled surveillance year is generally 50% of the initial certification price for the same confirmed scope. Scope changes, applicable programme requirements, taxes, travel and other stated exclusions may affect the final amount. The official quotation and contract clearly itemize the applicable fees.

How is the total cost of the three-year certification cycle calculated?

For ISO/IEC 27001, the three-year cycle includes initial certification and two annual surveillance audits. Recertification for the next cycle is quoted separately. CyberSecure Canada maintenance and renewal arrangements are confirmed in its agreement. Complade's online calculator provides a planning estimate, while the official quotation itemizes the fees that apply to the confirmed scope across the cycle. Changes in scope, headcount, sites, complexity or delivery requirements can change later audit time and cost.

When is payment required?

After accepting the official quotation, the client can sign the certification agreement and begin making Stage 1 evidence available as it becomes ready. Evidence can be uploaded to the portal, reviewed through controlled access or transferred through an available integration. Payment is required once the complete required evidence is available to the auditor and the audit is ready to begin, in accordance with the invoice and signed agreement.

Does completing the initial application commit us to purchasing certification?

The application and use of the portal are free. Applying does not commit you to purchasing certification. Complade reviews your scope, then provides the quotation, certification agreement and NDA (non-disclosure agreement) for review before you decide whether to sign. After signing, you meet your audit team and agree how to share evidence. Payment is due before the Stage 1 review, unless other terms are agreed.

How are recertification fees determined?

Recertification fees are determined when recertification is arranged, using Complade’s certification prices in effect at that time and the confirmed scope and required audit time. They are quoted separately from initial certification and surveillance fees. Recertification starts the next cycle. Its fee is not automatically set at the surveillance rate.

Which taxes, travel costs or additional audit charges could apply?

Published base estimates use Canadian dollars (CAD) in Canada and US dollars (USD) elsewhere, with the same numeric amounts, excluding taxes. The calculator converts the US dollar base to euros for European Union countries and British pounds for the United Kingdom, rounding each converted estimate down to the nearest 100. On-site travel and accommodation, changes to scope, additional sites or audit work beyond the agreed scope may affect the price. Ask the written quotation to identify corrective-action review allowances, any additional verification charges, certificate or registry fees, and how changes or annual price adjustments are handled. Do not assume a fixed annual increase or unlimited follow-up is included. The signed agreement governs the confirmed scope and charges.

Does small-team pricing apply to a SaaS (software as a service, software accessed online) or AI (artificial intelligence) company with contractors?

It may apply when the confirmed scope meets the published pricing assumptions. Include regular contractors and outsourced functions relevant to the scope, not just employees on payroll. A small headcount does not automatically mean low complexity. Multiple platforms, locations, cloud environments, sensitive data, integrations, delivery methods or language requirements may change the audit effort and estimate. Describe the full environment in the application.

What information is needed to prepare a formal certification quote?

Provide the legal entity and address, requested standard, proposed scope, services and products, people in scope including regular contractors, sites, cloud environments, outsourced activities, audit language and delivery preference. Include your readiness status, target dates, existing assurance reports and any restrictions on access to evidence. Complade reviews this information to establish audit effort; headcount alone does not determine the final quote. Detailed evidence is collected through the portal for Stage 1.

Can we receive a written quote before arranging a call?

Yes. Start with the published pricing and submit your scope through the portal, or send questions to Complade if you need clarification before applying. A call is not required to request written information. Ask for a breakdown of Stage 1 and Stage 2 audit time, planning, reporting, certification and registration fees, two surveillance audits, and recertification as a separate item. The official quotation and agreement confirm inclusions, exclusions and payment terms.

Do Complade customers receive a discount for adding another standard?

Yes. Complade customers receive 30% off the certification fees for each additional standard they add. The quotation shows the base fee and discount. Fees follow the audit hours actually required for the scope, with administrative overhead kept to a minimum through the portal and a streamlined process. The discount does not reduce required audit time. Taxes and travel are stated separately. Published calculator amounts cover a single ISO 27001 or CyberSecure Canada programme; email us for a quotation for additional standards.

Is ISO 27001 or CyberSecure Canada better for my organization?

ISO/IEC 27001 is an internationally used information security management-system standard and is often selected when customers, contracts or international markets require it. CyberSecure Canada is Canada's national baseline cybersecurity certification for small and medium organizations. The better fit depends on customer requirements, market, scope and security maturity; some organizations pursue both.

Can we obtain ISO 27001 and CyberSecure Canada certification together?

Yes. An organization may pursue both certifications. Complade reviews the intended scopes and audit requirements before confirming whether activities can be coordinated. Requirements and certification decisions remain specific to each standard.

Does ISO 27001 certification satisfy Government of Canada or Protected A requirements?

Not automatically. ISO/IEC 27001 certification and requirements such as ITSP.10.171 have different purposes and assessment criteria. A crosswalk, assessment or remediation plan can support preparation, but the contracting authority determines the requirements for a particular procurement. Check the tender’s required standard, scope, information classification and assessment conditions. Complade can audit the agreed ISO 27001 scope; certification does not guarantee government-contract eligibility.

Can the certification scope cover our SaaS (software as a service, software accessed online) platform or AI (artificial intelligence) services?

Yes, the proposed management-system scope can cover the design, development, hosting, operation and support of specified services, together with the relevant people, processes, locations and suppliers. Complade reviews the boundaries and dependencies before accepting the scope. ISO/IEC 27001 certifies the information security management system, not a product’s performance, AI (artificial intelligence) accuracy or legal compliance. Discuss comparable scope wording with the certification team; client audit information is not shared without authorization.

Does Complade offer a package combining Loi 25 preparation and CyberSecure Canada?

No. Complade provides independent CyberSecure Canada certification, not a package of privacy consulting, implementation and certification. Work on Quebec’s Law 25 and your cybersecurity controls may involve some of the same information, but a CyberSecure Canada certificate does not itself establish legal compliance. Keep legal advice and implementation support separate from the certification engagement.

What is the difference between Stage 1 and Stage 2?

Stage 1 reviews the management system's scope, documented information and readiness for the implementation audit. Stage 2 evaluates whether the management system and applicable controls are implemented and operating effectively in practice through interviews, records, sampling, observation and technical evidence.

What happens if the audit identifies a nonconformity?

The report records the requirement, evidence and finding. You provide correction, root-cause analysis and corrective action within the deadlines communicated. Major nonconformities require verification of correction and corrective action before certification. For minor nonconformities, review and acceptance of the plan for correction and corrective action are required before the decision, with appropriate follow-up. Classification depends on the impact on the system. A missing internal audit or management review must not be assumed to be minor. Additional verification may be needed; a full repeat audit is not automatically required. The certification decision remains independent.

How does Complade keep audits objective and consistent?

Complade uses defined audit criteria, evidence-based evaluation and controlled review methods. Conclusions are tied to applicable requirements and recorded evidence rather than personal auditor preferences. A qualified person independent of the audit delivery reviews the recommendation before the certification decision.

How many audit days are required, and how are they calculated?

Complade determines audit time using the applicable ISO/IEC 27006-1 requirements and the confirmed certification scope. Factors include the number of people in scope, activities, locations, outsourced functions, technical and cloud complexity, and other scope-specific conditions. Total audit time includes both Stage 1 and Stage 2; the scheduled Stage 2 meetings are only part of the total person-days. The lead auditor finalizes the detailed Stage 2 plan after completing Stage 1.

How is the lead auditor selected, and what qualifications do Complade auditors have?

Complade assigns the lead auditor and any audit-team members after confirming the scope and agreement. Selection considers competence for the certification standard and technical activities, audit language, location where relevant, availability and impartiality. Auditor competence is evaluated against applicable ISO/IEC 17021-1 and ISO/IEC 27006-1 requirements, and the Standards Council of Canada assesses Complade's accredited certification programme. The assigned team must also satisfy impartiality requirements, including the applicable restriction on prior ISMS (information security management system)-related relationships with the client. The exact team is introduced to the client after assignment. You can request relevant experience with SaaS (software as a service, software accessed online), cloud or AI (artificial intelligence) services and confirm the assigned auditor’s location and working hours. A Canadian certification body does not imply that every auditor is based in Canada.

Can I speak with a Complade lead auditor instead of a sales representative?

Yes. Prospective clients can book an introductory meeting with a Complade lead auditor to discuss the certification standard, intended scope, audit process, timing, delivery options and published pricing assumptions. Once an application and agreement are completed, the assigned lead auditor is introduced and audit-related meetings can be managed through the Complade portal. To protect impartiality, the auditor can explain requirements and the certification process but cannot design your management system, write policies, recommend specific controls or provide implementation consulting.

How do I book a meeting with my assigned lead auditor?

After you sign the certification agreement, Complade introduces your assigned lead auditor. The auditor is selected based on your certification scope and the expertise needed for the audit, along with language, availability and impartiality requirements. You can book a meeting using the auditor’s booking link or email the auditor directly. The auditor can explain requirements and audit findings, but cannot provide consulting or tell you how to implement the system.

How do I book a meeting with my assigned lead auditor?

After you sign the certification agreement, Complade introduces your assigned lead auditor. The auditor is selected based on your certification scope and the expertise needed for the audit, along with language, availability and impartiality requirements. You can book a meeting using the auditor’s booking link or email the auditor directly. The auditor can explain requirements and audit findings, but cannot provide consulting or tell you how to implement the system.

Do Azure, AWS (Amazon Web Services) or Google certifications, SOC 2 (System and Organization Controls 2) reports or penetration tests replace our certification audit?

No. A cloud provider’s certificate covers its stated scope, not automatically your organization or application. Relevant supplier certificates, SOC 2 (System and Organization Controls 2) reports, penetration tests and privacy assessments can support audit evidence when their scope, date and findings are applicable. Complade still evaluates your responsibilities, management system and controls. Existing assurance may inform planning but does not guarantee fewer audit days or certification. SOC 2 (System and Organization Controls 2) is an attestation report, not ISO 27001 certification.

Which CAN/DGSI 104 version should we use?

The latest published version is CAN/DGSI 104:2021 / Rev 2:2026. Obtain the official text from DGSI. Your quotation and audit plan identify the version and transition arrangements applicable to your engagement. Publication of a revision alone does not change an existing certificate’s status. Revision 1:2024 examples remain labelled as previous-version references.

Can we use Vanta or Maple GRC for our audit?

Vanta and Maple GRC integrations are available with client authorization. In Vanta, add Complade as your auditor and assign the relevant engagement. Maple GRC users can upload an exported audit package, grant auditor access or authorize an API integration. Drata, Sprinto, ServiceNow GRC and OneTrust integrations are in progress and coming soon. A GRC subscription is optional. Every sharing method is subject to the same audit criteria. Access to a tool or a successful evidence transfer does not establish conformity or guarantee certification.

Does Complade conduct our internal audit or provide consulting?

No. ISO/IEC 27001 requires your organization to complete an internal audit before the Stage 2 certification audit. Complade does not conduct your internal audit or provide consulting, implementation services, policy writing or tailored remediation advice. We offer general training and can explain the standard’s clause requirements and audit findings. Your organization remains responsible for implementing and maintaining its management system.

Does Complade conduct our internal audit or provide consulting?

No. ISO/IEC 27001 requires your organization to complete an internal audit before the Stage 2 certification audit. Complade does not conduct your internal audit or provide consulting, implementation services, policy writing or tailored remediation advice. We offer general training and can explain the standard’s clause requirements and audit findings. Your organization remains responsible for implementing and maintaining its management system.

Can Complade implement the standard, write our policies or provide templates?

No. Complade is an independent certification body and does not provide client-specific consulting, implementation, internal audits, policy writing or tailored templates. Complade offers general training and can explain clause requirements, the certification process, audit criteria and findings without prescribing how the organization must implement or correct its management system.

Does Complade offer a readiness discussion or gap-assessment consulting?

Complade can explain eligibility, the application, audit criteria, required evidence and timing before you apply. Stage 1 is part of certification and assesses readiness for Stage 2. Complade does not provide implementation consulting, write policies or conduct your internal audit. If you need tailored implementation or gap-remediation support, engage an independent provider and disclose that relationship in your application.

Can I sign the certification agreement as a PDF?

Yes. Open the agreement in the Complade app, choose More actions, then Print and Download to save a PDF. Sign the PDF and upload the signed copy to the app. You do not have to sign the agreement in the app.

Can I sign the certification agreement as a PDF?

Yes. Open the agreement in the Complade app, choose More actions, then Print and Download to save a PDF. Sign the PDF and upload the signed copy to the app. You do not have to sign the agreement in the app.

What can clients do in the Complade Audit Portal?

Clients can submit applications, review estimates, sign agreements, upload Stage 1 evidence, communicate with the audit team, plan Stage 2, assign interview participants, follow evaluated audit points, manage corrective actions, access reports and receive certification records in one system.

Can we send audit evidence by email?

No. Complade does not accept audit evidence by email. Upload it to the Complade Audit Portal, arrange controlled auditor access to your existing tool or document library, or authorize an available integration. Email can be used to coordinate access and ask questions.

Can the Complade Audit Portal import evidence from a GRC (governance, risk and compliance) tool?

Vanta and Maple GRC integrations are available with client authorization. In Vanta, add Complade as your auditor and assign the relevant engagement. Maple GRC users can upload an exported audit package, grant auditor access or authorize an API integration. Drata, Sprinto, ServiceNow GRC and OneTrust integrations are in progress and coming soon. A GRC subscription is optional. Every sharing method is subject to the same audit criteria. Access to a tool or a successful evidence transfer does not establish conformity or guarantee certification.

Can we use our own tools or AI (artificial intelligence) to prepare evidence without buying a GRC (governance, risk and compliance) subscription?

Yes. You can prepare and maintain evidence using your own tools, then upload it to the Complade Audit Portal or agree controlled auditor access to your document library. Purchasing a separate GRC (governance, risk and compliance) subscription is not a prerequisite. AI (artificial intelligence)-assisted documents are assessed against the same criteria as other evidence: they must accurately describe your organization, be reviewed and approved where required, and be supported by implementation records. Generic policies or AI (artificial intelligence)-generated text alone do not demonstrate that controls operate effectively. Your organization remains responsible for its management system.

Can the certification audit be conducted remotely?

Yes. Complade conducts remote audits and also offers hybrid or in-person delivery when appropriate. The delivery method is confirmed during application and audit planning based on the certification scope, activities, locations and ability to obtain sufficient audit evidence.

Can an ISO 27001 audit be conducted remotely in French in Canada?

Yes, subject to confirming remote audit feasibility and a suitable French-speaking audit team. Complade offers audits in English and French, including for organizations in Quebec. Specify the interview and report languages, preferred working hours and any bilingual needs in your application. Use the pricing calculator to see the language adjustment. Required audit time depends on scope and complexity, not simply on language or remote delivery.

What happens after the initial certificate is issued?

Certification is maintained through scheduled surveillance audits. For ISO/IEC 27001, surveillance audits occur during Years 1 and 2, followed by recertification before the next three-year cycle. Surveillance verifies that the management system remains implemented, maintained and effective. Surveillance follows a risk-based audit programme and sampling. A lower surveillance fee does not mean a random review of half the controls.

How can I verify or get a copy of an organization’s ISO 27001 certificate?

Search the Complade certification registry by organization name or certificate number. Check the standard, scope, status and validity dates, and follow the IAF CertSearch link where available. To obtain a copy of the certificate itself, request it from the certified organization. If you cannot find a record or need clarification, contact Complade with the organization name and certificate number. A copy should always be checked against the current registry status.

Can we display the certificate or certification mark on our website?

After certification is granted, use only the certificate and marks you are authorized to use, following the applicable usage guidelines. Claims must match the certified legal entity, standard, scope and current status. Do not imply that a management-system certificate certifies a product or guarantees security. SCC (Standards Council of Canada) and IAF (International Accreditation Forum) accreditation marks have separate restrictions; receiving a certificate does not grant unrestricted use. Update or remove claims when the scope or certification status changes.

How long is CyberSecure Canada certification valid, and what ongoing costs apply?

Use the validity dates on the issued certificate and the maintenance and renewal programme in your signed agreement. Do not assume that the ISO 27001 three-year cycle or its surveillance pricing also applies to CyberSecure Canada. Request a written breakdown of the initial assessment, any ongoing verification or annual charges, and renewal before accepting the quote. Maintain the applicable controls, notify Complade of relevant changes and arrange renewal before expiry.

What is the planned accreditation timeline for additional standards?

ISO/IEC 42001, ISO/IEC 27701 and ISO 9001 services are planned. Email certification.info@complade.com to discuss your scope and timing. Any proposed engagement will state its accreditation status before you commit. Complade is not currently SCC-accredited for ISO/IEC 42001, ISO/IEC 27701 or ISO 9001. Assessment of these additional programmes is planned as part of Complade’s annual accreditation audit with the Standards Council of Canada in Q2 2027, from April to June. Accreditation remains subject to SCC’s assessment and decision. Approval and its timing are not guaranteed. ISO 45001 and SOC 2 remain separate future plans. SOC 2 is an attestation service.

Can our internal audit and management review cover several standards?

Yes, where your organization has integrated the relevant systems and covers each standard’s requirements. The same organizational context and common governance can support information security, AI, privacy and quality management. One internal audit programme and a joint management review can be used if the necessary competence, inputs, results and decisions for every standard are covered. The scopes can differ and must be clear. Complade assesses the degree of integration and required audit effort before planning a combined certification audit. Your organization arranges its internal audits; Complade provides independent certification.

Does ISO 27701 certification prove GDPR, HIPAA or PHIPA compliance?

No. ISO/IEC 27701:2025 is a standalone privacy information management system standard. It can support a systematic approach to the privacy duties that apply to your activities and role, including GDPR, HIPAA or Ontario’s PHIPA where relevant. An ISO 27701 certificate is not by itself certification under GDPR Article 42, a US government-recognized HIPAA certification or a PHIPA approval. The organization remains responsible for legal compliance. ISO 27001 certification is not a prerequisite for the 2025 edition of ISO 27701.

Does Complade provide SOC 2 (System and Organization Controls 2) examinations?

Not currently. SOC 2 (System and Organization Controls 2) is part of Complade’s planned expansion into assurance services. It follows an attestation model and is separate from ISO management system certification. We will introduce it only when the required programme, competence, professional requirements and applicable approvals are established. Organizations requiring a SOC 2 (System and Organization Controls 2) report now should engage a qualified provider.

How do I apply to Complade’s Auditor-in-Training programme?

Complade accepts applications throughout the year. The Auditor-in-Training route is for professionals with technical experience and audit training who need supervised, evaluated external audit experience. Senior students and recent graduates can apply through the separate internship route. Send your CV and cover letter to join@complade.com, stating your preferred route, training, languages and availability. Admission depends on your background and available supervision; completing a course does not automatically qualify you to lead certification audits.

Can bilingual or freelance ISO 27001 auditors apply to Complade?

Yes. Experienced auditors can submit their qualifications, audit experience, languages and availability to join@complade.com. Review the current role requirements and evaluation process before applying. Complade assesses competence for the audit work before authorizing an auditor. State whether you are seeking employment or contract work; assignments depend on client scope, language, availability and impartiality. ISO 9001 is a planned service. Its SCC accreditation assessment is planned for Q2 2027; authorization to audit it depends on the required competence assessment.