Two surveillance cycles with zero nonconformities: how Kata Software maintained ISO 9001, ISO 27001, and SOC 1 in 2025 and 2026

Kata Software, a SaaS platform serving financial institutions across Latin America, maintained across two consecutive surveillance audit cycles (2025 and 2026) the validity of the certificates issued in 2024 — valid until 2027 — for its Integrated Management System in ISO 9001:2015 and ISO 27001:2022, with compliance to ISO 27017 and ISO 27018, and obtained a favourable SOC 1 Type 2 report covering its two production platforms. Both cycles closed with the certification body's recommendation to maintain certification, with zero nonconformities.

The result in one table

The challenge

Maintaining a certification is harder than obtaining it. After the initial audit, the system depends on dozens of people continuing to operate the controls every day while the company changes: new clients, staff turnover, restructures, new products.

On top of that, the organisation had to sustain three frameworks in parallel (ISO 9001, ISO 27001, and SOC 1) without duplicating effort or evidence — and to do it in a year when its internal structure changed.

What we did

1. One integrated system, not three. The ISO 9001 and ISO 27001 requirements were operated as a single management system, with one internal audit programme, one management review, and one corrective action mechanism. That let a single piece of evidence serve several frameworks.

2. Internal audit with certified auditors. In July 2025, the internal audit team obtained auditor certification (including a Lead Auditor in ISO 27001:2022 under ISO 19011 and ISO 9001:2015). In 2025, finance, operations and support, and people were audited internally. The cycle repeated in July–August 2026, with Rogelio Barajas González as Lead Auditor, ahead of the certification body's visit.

3. A system that finds its own findings. The 2026 internal audit identified nonconformities of its own, including an access revocation control and the formalisation of root cause analysis, and each opened its own corrective action record with a cause analysis. One of them (operational control planning) had been flagged as an opportunity for improvement a year earlier, and the system escalated it correctly. By the time the certification body arrived, the trail of how those findings were addressed already existed.

That internal audit was deliberately demanding. The 2026 programme left 34 active internal findings (14 nonconformities, 14 opportunities for improvement, and 6 observations), raised by the organisation itself rather than the certification body, with an explicit goal: mature the system and recover the "high" effectiveness level it had reached in 2025. It is the difference between a system that waits for an outsider to point out what is failing and one that looks for it first.

4. Change and access governance as living evidence. The SOC 1 Type 2 report confirmed that the controls over changes, access, and operations were designed and operated effectively during the period, with specific observations on how to define exceptions for urgent changes and how to evidence post-implementation review. Those observations became procedure improvement actions.

5. Top management involvement. In its 2026 report, the certification body acknowledged the commitment of top management and the staff interviewed, the team's specialisation, the fulfilment of the system's objectives, and good communication around addressing and improving findings.

Results

Zero nonconformities across two consecutive surveillance cycles, with a recommendation to maintain certification in both.

Year 1 (2025): a single finding, an opportunity for improvement on the criteria for declaring a contingency and activating the recovery plan. Effectiveness of the system, the internal audit, and the management review rated as high. Strengths noted: staff competence, communication, process improvement, staff allocation, and investment in technology infrastructure.

Year 2 (2026): maturity observations on strengthening stakeholder identification, updating the roles matrix, periodically reviewing objectives, and documenting the ISO 27017 and ISO 27018 references in the audit programme in more detail. None affected the certification. Audit objectives were met, including in remote mode, and there were no client complaints.

SOC 1 Type 2: a favourable report on the production platforms for the January–October 2025 period, useful for clients' financial auditors.

What we learned

The year-2 observations aren't a step backwards — they're the sign of a system taking itself seriously. As a system matures, the certification body stops asking whether the control exists and starts asking whether it is current and being updated. That is why the shift from "opportunity for improvement" to "observation" usually calls for more documentation discipline, not more controls.

A lower rating isn't an alarm if you have a plan. In 2026 the body rated the system's effectiveness as "medium" against "high" in 2025. The response was an internal plan of 34 findings with root causes and owners, aimed at returning to the high level at the next assessment.

Auditing yourself first changes the outcome. The internal findings arrived with their root cause and corrective action before the certification body ever saw them.

A certification is maintained in the months without an audit. What sustains a system between visits is routine: management review, findings follow-up, and keeping documentation current.

What's next

The next recertification audit is planned for October 2027, and a new edition of ISO 9001 (published in September 2026) is already here with a stronger emphasis on leadership, quality culture, and ethical behaviour. Preparing for that transition in good time is part of keeping the system alive.

Note on sources

Published with Kata Software's authorisation. Rogelio Barajas González was Director of Operations there until July 2026 and now works with them as an independent consultant through Barajas Advisory. Client and individual names are omitted for confidentiality. The figures come from audit reports by independent bodies (NYCE for ISO 9001 and ISO 27001; SOC 1 Type 2 report for the Kata Mobile and Kata Engine platforms).