ISO/IEC 27001 Stage 1 and Stage 2 audits: what auditors check, day by day

Stage 1: the readiness review

ISO/IEC 17021-1, the standard to which certification bodies are accredited, requires two audit stages for initial certification; ISO/IEC 27006-1 adds ISMS-specific rules. For an ISMS, the Stage 1 objectives point to seven things the auditor will want to see.

• Scope: the statement, sites, cloud platforms and interfaces with clients, suppliers and group functions.
• Obligations and policy: identified legal, regulatory and contractual security requirements; an approved policy with measured objectives.
• Risk method: criteria for assessing and accepting risk, and a process whose repeated assessments give consistent, valid and comparable results (clause 6.1.2).
• Risk results: the register and a treatment plan approved by risk owners, residual risk accepted.
• Statement of Applicability: all 93 Annex A controls addressed, each decision justified, status matching the plan.
• Internal audit and management review: planned and performed, so bring reports and minutes, not a calendar.
• Conditions: premises, remote working and systems in scope, which shape how much of Stage 2 can be remote.

The conclusions record your readiness and any concerns that could become Stage 2 nonconformities. You are told beforehand which Stage 1 activities need a visit, the interval must allow for fixing concerns, and Stage 2 arrangements may change. The auditor records concerns, not remedies: a readiness review is not a gap analysis, Sterling's first engagement stage. See choosing an ISO/IEC 27001 certification body and the certification process guide.

What ISMS auditors look at first

After the opening meeting and a leadership interview, most ISMS auditors lay the risk register beside the Statement of Applicability before sampling any control. The ISMS is a chain from scope to risks, treatment, controls and records, and a weak early link undermines every later one. Expect four tests.

• Forwards: a high risk followed to its treatment, its controls and the records showing them at work.
• Backwards: a control marked implemented traced to the risk or requirement it answers.
• Sideways: exclusions compared with reality; a company that writes its own software will struggle to exclude secure development.
• Over time: the last risk assessment dated against significant changes since, because clause 8 requires reassessment at planned intervals and when significant changes are proposed or occur.

Leaders should be able to name the risks they accepted.

Stage 2: are the controls operating?

At Stage 2 the auditor judges whether the ISMS is implemented and effective. Under ISO/IEC 17021-1 that spans every requirement in scope, including performance against objectives, legal and contractual compliance, operational control, internal audit and management review. Annex E of ISO/IEC 27006-1 guides the review of implemented controls. In most ISMS audits, these areas draw the closest sampling.

Auditors work from samples, corroborated by interview, observation and records, as ISO/IEC 17021-1 requires. In an ISMS the population is usually a system export, such as users or changes, and good trails cross systems: HR record, identity provider, then each application. A completed access review shows implementation; revoked accounts show effectiveness. For several sites, the multi-site sampling rules in ISO/IEC 27006-1 decide whether sites may be sampled. Typical questions are in our audit questions guide.

Remote auditing of cloud environments

Cloud platforms are normally audited by screen share, and the 2024 edition of ISO/IEC 27006-1 was revised throughout for remote audits and organisations with few or no relevant physical sites. IAF MD 4, numbered TECH-3-003 under Global ACI, requires both sides to agree the technology before use, in line with information security and data protection measures; otherwise the auditor must use other methods. The audit plan shows how, and how far, it will be used. The same rules recognise a virtual site, an online working environment, but never for processes that need a physical place.

• You drive, the auditor chooses: your administrator shares the console and opens whatever the auditor names; prepared screenshots count for less.
• No standing access: auditors rarely need their own accounts; any agreed read-only access should be limited and removed afterwards.
• The provider's share: your certification body does not audit the provider's data centres; under A.5.23 it asks how you assessed the provider and which controls remain yours.

Physical controls at your offices are usually still seen in person.

A typical ISMS Stage 2, day by day

Audit days come from the certification body's calculation under ISO/IEC 27006-1 (scope, headcount, locations; see the cost guide). This illustration assumes three days, one auditor, one office and cloud platforms reviewed remotely; your real plan, naming the auditors, arrives in advance.

How findings are raised, and who decides

Each nonconformity names the requirement breached, states what is wrong, cites objective evidence and is discussed with you. Cause and remedy stay yours: the auditor may propose neither. A major nonconformity is one that affects the ISMS's capability to achieve its intended results; a minor one leaves it intact. A control your Statement of Applicability declares implemented but which is not operating is a nonconformity, so the finding usually names both the control and the requirement. Closure is covered in our nonconformities guide.

The closing meeting gives the conclusions and recommendation, reminds you the evidence was a sample and sets the deadline for your correction and corrective action plan. Competent people at the certification body with no part in the audit then decide, once corrections and corrective actions for every major nonconformity are reviewed, accepted and verified, and plans for minor ones accepted. A major still unverified six months after the final Stage 2 day means another Stage 2 before certification can be recommended. The decision opens a three-year cycle; see our surveillance and recertification guide.

ISO/IEC 27001 Stage 1 and Stage 2: questions buyers ask