The ISO 27001 Audit Process, Stage by Stage
An ISO 27001 audit verifies whether your Information Security Management System (ISMS) meets the standard, works in practice, and produces the evidence certification bodies expect. StartComply helps compliance teams organise documentation, map controls, and maintain an audit-ready evidence trail before Stage 1, Stage 2, surveillance, and recertification.
Trusted by 100+ organisations across Europe
ISO 27001:2022 
Audit-ready 
ISMS evidence 
Clause 9.2 What you need to know before an ISO 27001 audit
- ISO 27001 certification requires a two-stage external audit: Stage 1 reviews documentation and readiness, while Stage 2 verifies objective evidence and operational controls.
- Auditors check whether the ISMS described in policies is genuinely implemented through access reviews, incident records, supplier evidence, management reviews, and internal audit outputs.
- Major non-conformities block certification until closed with objective evidence. Minor non-conformities still need corrective action within an agreed timeframe.
- The certification cycle lasts three years and includes annual surveillance audits before a full recertification audit in year three.
- The strongest preparation method is continuous evidence collection, not a last-minute document scramble before the certification body arrives.
Last updated May 2026.
The ISO 27001 Audit Process, Stage by Stage
An ISO 27001 audit is a formal, evidence-based assessment of whether your Information Security Management System is designed correctly, implemented effectively, and improving over time. The auditor is not just reviewing policies. They are checking whether risk decisions, controls, ownership, and evidence match what your organisation claims.
The ISO 27001 audit process has two main certification stages. Stage 1 confirms documentation and readiness. Stage 2 tests implementation through interviews, sampling, and objective evidence. After certification, annual surveillance audits keep pressure on the ISMS, because certification is not a one-time event.
For compliance officers, CISOs, and risk managers, the practical goal is simple: know what the auditor will request before they request it, keep every artefact mapped to the relevant clause or Annex A control, and show a closed loop from risk assessment to treatment, review, and improvement.
Start with evidence, not polish. Auditors accept complete, dated, traceable records. They do not accept verbal assurances that a process probably happened.
ISO 27001 audits expose the gap between policy and practice.
A working ISMS with objective evidence
- Documented ISMS scope, policy, risk methodology, risk register, Statement of Applicability, and risk treatment plan
- Evidence that access reviews, incident handling, supplier oversight, and control monitoring happen on schedule
- Completed internal audit programme under Clause 9.2 before the certification body audit
- Management review records under Clause 9.3 with decisions, owners, and follow-up actions
- Corrective actions that show root cause, remediation, ownership, and closure evidence
Audit reality: ISO 27001:2022 certification depends on documented conformity and effective implementation across the ISMS scope.
Policies without proof, controls without cadence
- Statement of Applicability exclusions with no written rationale
- Risk registers that list risks but do not show treatment decisions or owners
- Access reviews, supplier assessments, or incident logs that do not match policy cadence
- Management reviews that record attendance but no actions, decisions, or improvement loop
- Evidence rebuilt manually from spreadsheets and email threads during audit week
The risk: a single gap may be minor, but repeated gaps across controls can become a major non-conformity.
What ISO 27001 Auditors Check
Stage 1 Documentation Readiness
Stage 1 confirms that the ISMS is designed correctly before deeper implementation testing begins. The auditor reviews whether mandatory documents are complete, coherent, approved, and aligned with the declared scope. For teams still defining the baseline, the ISO 27001 overview clarifies what the standard covers.
- ISMS scope and information security policy
- Risk assessment methodology and risk register
- Statement of Applicability with inclusion and exclusion rationale
- Risk treatment plan, objectives, and supporting procedures
Stage 2 Evidence Testing
Stage 2 tests whether the ISMS works in practice. Auditors interview staff, sample records, observe processes, and compare operational evidence against what policies say should happen. In EU environments, the same evidence trail can also support NIS2 compliance where cyber risk management and supply chain security controls overlap.
- Access logs, joiner-mover-leaver records, and access review outputs
- Training records, incident logs, and investigation follow-ups
- Supplier assessments, contracts, and monitoring evidence
- Internal audit reports and management review minutes
Non-Conformity Management
Findings are not just labels. They are tests of whether your organisation can understand root cause, assign ownership, remediate effectively, and prove closure with dated records.
- Major non-conformities requiring closure before certification
- Minor non-conformities requiring tracked corrective action
- Observations that signal weakness before formal failure
- Evidence of continual improvement across audit cycles
Surveillance and Recertification
Certification is maintained through a three-year cycle. Surveillance audits test targeted areas each year, while recertification reassesses the full ISMS before the next certificate is issued.
- Annual surveillance audits in years one and two
- Focused review of previous findings and organisational changes
- Full recertification audit in year three
- Evidence continuity between every audit event
How to Prepare for an ISO 27001 Audit in Five Steps
Confirm scope and mandatory documents Stage 1
Define the ISMS boundary, confirm assets and processes in scope, and make sure your mandatory documentation is approved, version-controlled, and easy for auditors to navigate.
Map controls to evidence Annex A
Tie every applicable Annex A control to owners, artefacts, dates, and review cadence. Annex A controls need more than policy references; they need proof that activities happened.
Run the internal audit first Clause 9.2
Complete the internal audit before the certification body audit. Record findings, root causes, corrective actions, owners, due dates, and closure evidence so the external auditor sees a functioning improvement loop.
Hold management review with outputs Clause 9.3
Use the management review to make real decisions on risks, incidents, objectives, supplier issues, performance, resources, and improvement. A meeting with no actions is a weak audit signal.
Plan the certification body audit CB audit
Choose an accredited certification body early, understand the audit plan, and budget for scope and complexity. Review certification cost factors before dates are locked.
ISO 27001 Audit Types Compared
Different ISO 27001 audits have different purposes. Treating them as interchangeable is where teams lose time and create unnecessary findings. Use the ISO 27001 compliance guide to connect audit activity with the wider ISMS obligations.
The audit outcome depends on whether your ISMS evidence is complete, current, and traceable to the requirements being tested.
Frequently Asked Questions About ISO 27001 Audits
How long does an ISO 27001 audit take from start to finish?
For a mid-sized organisation, the external certification audit process often takes two to four weeks from Stage 1 through certificate issue, excluding preparation. Stage 1 may take one to two days, while Stage 2 usually depends on ISMS scope, locations, and employee count. The bigger timeline is preparation: six to twelve months is more realistic for building, operating, and internally auditing the ISMS before the certification body engagement.
What documents do ISO 27001 auditors request during Stage 1?
Stage 1 focuses on documentation and readiness. Auditors normally review the ISMS scope, information security policy, risk assessment methodology, risk register, Statement of Applicability, risk treatment plan, information security objectives, and evidence of management approval. The Statement of Applicability receives especially close scrutiny because it explains every Annex A inclusion and exclusion.
What is the difference between a major and minor non-conformity?
A major non-conformity means a complete failure to meet a requirement, an absent mandatory process, or a pattern of smaller failures that points to systemic breakdown. It blocks certification until closed with objective evidence. A minor non-conformity is a partial or isolated failure. It does not usually block certification, but it still requires documented corrective action within the agreed timeframe.
How often do ISO 27001 surveillance audits happen?
Surveillance audits happen annually during the three-year certification cycle, usually in year one and year two after initial certification. The year-three audit is a full recertification audit, not a standard surveillance visit. Surveillance audits are targeted, but they still test previous findings, selected clauses, control evidence, and significant organisational changes. For framework comparison work before surveillance, use the ISO 27001 versus NIST guide. Audit readiness must continue between certification events.
Can an internal audit replace the external certification audit?
No. The internal audit required by Clause 9.2 is mandatory, but it does not replace the certification body audit. It is your organisation’s own independent check of ISMS conformity and effectiveness. The external certification audit is conducted by an accredited certification body and is the process that results in the certificate. For customer assurance comparisons, the ISO 27001 vs SOC 2 guide explains how the two audit models differ. A strong internal audit programme prepares you for certification, but it cannot grant it.
What happens if my organisation fails the ISO 27001 Stage 2 audit?
Failing Stage 2 normally means the certification body has raised one or more major non-conformities. The certificate is not issued until those findings are closed. You will need root cause analysis, a corrective action plan, assigned owners, and objective evidence of remediation. Organisations with current evidence libraries and completed internal audit actions are far less likely to face major Stage 2 findings.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
