ISO 27001 Certification Audit – What the Auditor Checks at Stage 1 and Stage 2

Updated: 22 September 2026

What is an ISO 27001 certification audit and how does it work? An ISO 27001 certification audit is a two-stage process conducted by an accredited certification body, verifying that an organisation has implemented, maintains, and is continuously improving an ISMS (Information Security Management System) conformant with ISO/IEC 27001:2022.

Stage 1 is the documentation review – the auditor assesses whether the ISMS has been correctly designed: completeness of documentation, correctness of scope, and management commitment.
Stage 2 is effectiveness testing – the auditor verifies whether the ISMS actually functions in practice: interviews with staff, review of operational evidence, observation of processes. Only a successful Stage 2 leads to certificate issuance. The certificate is valid for 3 years, with annual surveillance audits required in years 1 and 2.

ISO 27001 audit Stage 1 and Stage 2 – at a glance:

1. Stage 1 may identify “areas of concern” requiring resolution before Stage 2 – plan at minimum 4 to 8 weeks between Stage 1 and Stage 2 to address findings
2. Stage 2 typically takes 2 to 5 auditor days for organisations of 100 to 500 staff – the auditor samples 5 to 10 interviews and reviews operational evidence covering the preceding 12 months
3. A major nonconformity (such as no risk assessment or no management review) blocks certificate issuance until resolved; a minor nonconformity does not block certification but must be corrected within an agreed timeframe after the certificate is issued
4. The most common blocking findings at Stage 1: an incomplete Statement of Applicability, no risk treatment plan, and no evidence that management review took place covering the required Clause 9.3 topics
5. Stage 2 reviews operational evidence covering 12 months – organisations that gather evidence only in the week before the audit do not have the required history, only the appearance of it
6. Patronusec, as an ISO 27001 implementation partner, conducts pre-audit assessments simulating key Stage 1 and Stage 2 questions – identifying gaps before the certification body sees them

---

---

What does the auditor examine at Stage 1, and which documents are mandatory?

Stage 1 is a “documentation and readiness review” – the auditor wants to understand how the ISMS has been designed and whether the organisation is ready to proceed to Stage 2. The absence of any document from the list below typically results in an area of concern or a minor nonconformity that delays progression to Stage 2.

The 10 mandatory documents for Stage 1:

Document	ISO 27001:2022 clause	Most common problem
ISMS Scope	Clause 4.3	Scope unclear or poorly justified
Information Security Policy	Clause 5.2	Approved but not communicated to all staff
Risk Assessment Methodology	Clause 6.1.2	Undocumented – exists only in the CISO’s head
Risk Register	Clause 6.1.2	Absent, or contains generalities without risk owners
Statement of Applicability (SoA)	Clause 6.1.3	No justification provided for excluded Annex A controls
Risk Treatment Plan	Clause 6.1.3	Absent, or has no deadlines or named owners
Information Security Objectives	Clause 6.2	No measurable security objectives defined
Management Review minutes	Clause 9.3	Management review has never taken place
Internal Audit report	Clause 9.2	Absent, or conducted without the required independence
Competence records	Clause 7.2	No documented evidence of security training for relevant roles

What the auditor does during Stage 1:

• Reviews documents (does not test their effectiveness – that is Stage 2)
• Checks that the SoA is logically connected to the risk register
• Confirms that management review covered the topics required by Clause 9.3
• Verifies that the ISMS scope is clearly defined and justified
• Identifies areas of concern to be addressed before Stage 2

Patronusec Insight: The most frequent cause of Stage 1 delays is a management review that either never happened or covered too narrow an agenda. ISO 27001:2022 Clause 9.3 requires management review to be conducted by “top management” – an owner, CEO, or designated board member. A meeting between the CISO and the IT manager does not meet this requirement. We recommend scheduling the first management review at least 6 to 8 weeks before Stage 1, with minutes documenting all required Clause 9.3 topics. In our ISO 27001 implementation engagements, we facilitate exactly these sessions with clients.

What does the auditor examine at Stage 2 – and how should you gather evidence?

Stage 2 is effectiveness testing – the auditor verifies that the ISMS actually operates as designed, not merely that it exists on paper.

Stage 2 verification methods:

Interviews with staff:
The auditor speaks with risk owners, IT administrators, security personnel, and – critically – randomly selected non-IT staff. Typical questions to a general employee: “What do you do when you receive a suspicious email?”, “Where do you report a security incident?”, “When did you last attend security training and what was it about?” Answers that contradict documented procedures are findings.

Review of operational evidence:
The auditor requests evidence that processes have been functioning for the preceding 12 months:

• Access review logs – not only the results but the history of regularity
• Vulnerability scan results from the past 3 months with documented remediation
• Sample incident reports with documentation of how each was handled
• Supplier agreements containing security clauses
• Training records – not merely attendance lists but evidence of effectiveness assessment

Observation:
For physical controls (locks, clean desk policy, shredding, entry monitoring), the auditor may conduct a physical walk-through or review logs from access control systems.

---

Not sure whether your ISMS documentation and 12-month operational evidence are ready for Stage 2?

Patronusec conducts pre-audit readiness assessments – simulating key Stage 1 and Stage 2 questions before the certification body arrives. The output is a prioritised gap list with a remediation plan.

Book a pre-audit readiness assessment

---

Which findings most commonly block ISO 27001 certification?

Major nonconformities (block certificate issuance):

1. No risk assessment, or a risk assessment not conducted in accordance with the documented methodology
2. SoA without justification for excluded Annex A controls
3. No management review, or management review that did not cover the required Clause 9.3 topics
4. No internal audit, or an internal audit conducted by a person without the required independence
5. No documented risk treatment plan for risks above the acceptance threshold
6. Controls declared as “implemented” in the SoA that are demonstrably not in place

Minor nonconformities (do not block; must be corrected post-certification):

• Policies approved but not communicated to all relevant personnel
• Asset inventory incomplete or out of date
• Absence of formal supplier agreements with security clauses for some third parties
• Access review logs showing a gap of more than 12 months

Observations (opportunities for improvement):

• Better integration of the risk register with change management processes
• Extending the training programme to cover specific high-risk roles more thoroughly

Patronusec Insight: The most costly mistake before Stage 2 is gathering operational evidence in the two weeks immediately before the audit. The auditor reviews evidence for the preceding 12 months – if access reviews were conducted one week before the audit, the incident log covers four weeks of history, and training records span the same period, the auditor sees an “audit-driven” programme rather than one that has been operating continuously. ISO 27001 auditors recognise this pattern immediately. In our ISO 27001 implementation engagements, we implement evidence-gathering processes from the very start of the project – not from the month before Stage 2.

How do you shorten the time from Stage 1 to certificate issuance?

Typical timeline from Stage 1 to certification: 3 to 5 months. This can be reduced to 2 to 3 months by:

Complete documentation before Stage 1: The fewer areas of concern identified at Stage 1, the shorter the gap before Stage 2 can take place. Organisations with complete documentation typically conclude Stage 1 with no blockers and schedule Stage 2 within 4 to 6 weeks.

Operational evidence gathered throughout the year: Stage 2 reviews 12 months of history. Organisations that begin gathering evidence at the start of the implementation project have it ready. Those that gather it in the week before Stage 2 do not have 12 months of history – they have the appearance of it.

Pre-audit assessment before Stage 1: An external review of documentation and sample interviews before the formal audit identifies problems and provides time to remediate them. The cost of a pre-assessment is typically recovered through a shorter assessment cycle.

FAQ – ISO 27001 Audit

---

ISO 27001 certification audit – free consultation

Patronusec supports organisations in preparing for ISO 27001 Stage 1 and Stage 2 – from documentation review and pre-audit assessment through to support during the formal certification audit.

In a free 30-minute consultation we will help you:

• Assess the completeness of your ISMS documentation and readiness for Stage 1
• Identify potential major nonconformities before the certification body identifies them
• Plan the Stage 1 to Stage 2 timeline including the required preparation gap
• Define how to systematically gather operational evidence across the 12 months preceding the audit

Free consultation | ISO 27001 implementation | vCISO – ISMS support | NIS2 | DORA