ISO 27001 Stage 1 vs Stage 2 audit: what the auditor checks and what they accept

An ISO 27001 certification audit is two visits with different jobs. Stage 1 reads your documents to check the system is designed; Stage 2 tests whether it actually ran. Stage 2 samples records across a period, typically after around three months of operation. Most projects prepare hard for the first and get caught by the second.

This guide covers both stages, the evidence period, major and minor nonconformities, what auditors accept, what goes wrong, and what comes after.

	Stage 1	Stage 2
Question it answers	Is the system designed?	Did the system run?
Method	Document review: remote, on site or split	Sampling, interviews, end-to-end tracing
What they look at	Scope, SoA, risk assessment, policies, roles	Records across a period, Clause 9 and 10
History needed	Internal audit and management review exist as processes	Typically around three months of operation
Findings	Usually areas of concern, closed before Stage 2	Major or minor nonconformities, observations

What does the auditor check at Stage 1?

Stage 1 is a documentation review. The auditor establishes whether an ISMS exists on paper, whether it covers what ISO 27001 requires, and whether Stage 2 is worth scheduling.

What they ask for:

• The scope statement and the boundary, and whether it is defensible
• The Statement of Applicability, with a justification for every control included and every control excluded
• The risk assessment method and the risk assessment itself
• The policy set
• Evidence that the internal audit programme and management review exist as processes, not that they have run yet
• The roles, the responsibilities, and who in management owns this

What they are really checking is whether the documents describe one coherent system. The classic Stage 1 failure: a scope that says one thing, a risk assessment covering something wider, and an SoA excluding controls the scope obviously needs. If the boundary is not settled, the auditor cannot establish what to test in Stage 2, and everything stops there. That is why scope and the Statement of Applicability deserve more attention than the policy set.

Stage 1 findings are usually areas of concern rather than formal nonconformities, and you are expected to close them before Stage 2. Consultants are good at producing documents, so Stage 1 tends to go well. That is exactly why it is a poor predictor of Stage 2.

What does the auditor check at Stage 2?

Stage 2 is the real audit. The auditor is no longer reading what you wrote. They are testing whether it happened.

• Sampling. They pick controls and ask for evidence across a period. Not one access review, a sequence of them with dates. Not the backup policy, the last restore test and its result.
• Interviews. They ask the people named in your policies what they actually do. A policy written by somebody outside the business fails here, because the person named in it describes something different.
• Tracing. They follow one thread end to end: a risk in the register, its treatment, the control, the evidence that it ran, and the review that confirmed it works.
• Clause 9 and 10. Internal audit results, management review minutes, nonconformities raised, and corrective actions closed with root cause and effectiveness checks. This is where the sequencing in internal audit and management review pays off or does not.

How long does the ISMS need to run before Stage 2?

Typically around three months, because sampling needs a history to sample. That is calendar time and it cannot be bought, which is the constraint at the centre of how long ISO 27001 really takes.

What is the difference between a major and a minor nonconformity?

There are three outcomes, and they cost very different amounts.

Outcome	What it is	Blocks certification?	What you do
Major nonconformity	A required element is absent, or a control has broken down in a way that undermines the system	Yes	Remediate and provide evidence. Budget weeks, not days, and possibly another visit
Minor nonconformity	A single lapse in an otherwise working system	Not usually	Submit a corrective action plan, typically within a few weeks
Observation or opportunity for improvement	Not a nonconformity	No	No corrective action needed

A missing internal audit programme is major. So is a risk treatment plan with no owner anywhere. One access review missed in a year of them is minor, as is one supplier assessment not filed. A minor’s closure is verified at the next surveillance visit, or on paper before the certificate issues.

Teams routinely over-react to observations, spend effort closing them, and arrive at the next audit having treated advice as instruction.

The number of findings matters far less than their type. A Stage 2 with six minors and no majors is a good audit. One major and nothing else is a bad one.

What evidence do ISO 27001 auditors accept?

Three patterns come up repeatedly.

A control you have decided not to implement, if the decision is documented and justified. The SoA exists for this. What they do not accept is a control marked applicable, described in a policy, and not running.

Imperfect evidence generated at the time, over perfect evidence generated afterwards. A patch record with gaps you can explain beats a tidy retrospective spreadsheet. Auditors have seen a great many of those, and file metadata is not subtle.

“We know, it is in the register, here is the treatment and the date”. An open risk with an owner and a plan is a working management system. The same risk undocumented is a finding.

The instinct to hide problems is the wrong way round. Nonconformities your own internal audit found and closed are evidence the system works. That is the thing being certified.

Why do ISO 27001 certification audits go wrong?

In order of how often it turns up:

1. Evidence does not exist for the sampling window. Controls were designed, nothing recorded them running.
2. The scope was drawn badly and part of the work has to be redone.
3. Policies describe a company that does not exist. Interviews expose it in minutes.
4. Clause 9 is thin. Internal audit run too late, management review missing its mandatory inputs.
5. Corrective actions closed without root cause, or without checking the fix worked.

Every one of these is a preparation failure, not a security failure. None of them means the company is insecure. They mean the record does not support the claim.

What happens after the Stage 2 audit?

The auditor recommends certification, they do not grant it. The certification body’s own review and decision process follows, and the certificate is issued after that. Plan for that gap rather than promising a customer a certificate for the week after the audit.

The certificate then runs on a three-year cycle: surveillance in years two and three, recertification at the end. The costs of that cycle are in what ISO 27001 actually costs an SME.

To know what a Stage 2 would find before you book one, use a structured audit ahead of the programme. It produces the same ranked gap list, without the certificate on the line.

Does passing Stage 2 mean you are secure?

No. Stage 2 tests conformity, not security. That distinction is not pedantic, it is the whole gap.

The auditor samples whether a control operated as described. They do not test whether it works. A.8.8 asks you to manage technical vulnerabilities, and a monthly scan with a report satisfies it even if its critical findings are eight months old. A.8.15 asks for logging, and logs written to a disk nobody queries satisfy it. A.8.16 asks for monitoring activities, the widest gap of all: a documented procedure meets the control while nothing is actually watching.

A clean Stage 2 tells a customer that your management system runs. It was never designed to tell them whether you would notice an intrusion. That question is answered by tooling that produces findings continuously into the same evidence record, not by a better-prepared audit. The full argument is in the Annex A controls grouped for real work, which separates the controls that record work from the controls that are work.

Stage 1 and Stage 2 audit checklist

• Check that the scope, risk assessment and SoA describe the same system.
• Justify every control in the SoA, included or excluded.
• Close Stage 1 areas of concern before Stage 2.
• Start the evidence clock early: allow around three months of operation before Stage 2.
• Keep dated evidence generated at the time: access reviews, restore tests and their results.
• Ask the people named in your policies what they actually do, and fix the policies where the answers differ.
• Run the internal audit and management review in time, and close corrective actions with root cause and an effectiveness check.
• Do not promise a customer a certificate date before the certification body has decided.

Frequently asked questions