ISO 27001 Stage 1 vs. Stage 2 Audit: What Businesses Need to Prepare

Your organization has spent months developing security policies, assessing risks, and implementing controls. The team thinks that everything is ready for ISO 27001 certification. Then the auditor generates a simple question: “Can you show me evidence that this security process is actually being followed?”

Suddenly, you notice that a policy document does not look quite enough. This is where many businesses find the difference between preparing for an ISO 27001 audit and being genuinely ready for one. Achieving ISO 27001 certification requires more than documenting security practices. Organizations must validate that their Information Security Management System (ISMS) is properly designed, implemented, monitored, and continuously improved. That’s why the ISO 27001 certification audit is divided into two important stages: Stage 1 and Stage 2.

Stage 1 focuses on your ISMS documentation and checks whether you’re ready for the next audit. Stage 2 looks at how your security processes work in practice and whether your company follows them. Knowing what to expect at each stage gives your team time to prepare, fix any gaps, and avoid delays in getting certified.

In this article, we’ll explain the differences between ISO 27001 Stage 1 and Stage 2 audits.

What Is an ISO 27001 Audit?

An ISO 27001 audit is a structured analysis of an organization’s ISMS against the requirements of ISO/IEC 27001. The purpose is to determine whether the organization has established an effective approach to protecting information through risk management, security controls, clearly defined responsibilities, and ongoing improvement.

ISO/IEC 27001 standard covers management system requirements in Clauses 4 through 10 and includes 93 reference controls in Annex A.

An audit examines areas such as:

• Information security policies and objectives
• Identification and treatment of security risks
• Access control and identity management
• Incident management and business continuity
• Employee security awareness
• Internal audits and management reviews
• Performance monitoring and corrective actions

For initial certification, an independent certification body conducts the assessment in two stages.

STAGE 1: Are you ready?

Evaluates ISMS documentation, scope, planning, and preparedness.

STAGE 2: Does it work?

Verifies implementation, operational evidence, and effectiveness.

Both stages are required for initial accredited ISO 27001 certification.

What Is an ISO 27001 Stage 1 Audit?

The ISO 27001 Stage 1 audit is the initial readiness assessment performed by the certification body. Its main objective is to understand whether the organization’s ISMS has been sufficiently established and whether the organization is prepared to proceed to Stage 2. At this stage, auditors primarily review documented information, discuss the ISMS with relevant personnel, evaluate site-specific conditions, and assess how well the organization understands ISO 27001 requirements.

What Do Auditors Check During Stage 1?

During the Stage 1 audit, auditors review your ISMS documents and check whether your company is ready for Stage 2. They mainly look at:

1. ISMS Scope: Which departments, locations, systems, and services are included in the certification.
2. Information Security Policy: Whether your company has an approved security policy that meets its business needs.
3. Risk Assessment: How your company identifies, assesses, and prioritizes security risks.
4. Risk Treatment Plan: What steps you have planned to manage risks and who is responsible for them.
5. Statement of Applicability (SoA): Which Annex A security controls apply to your business and why certain controls are excluded.
6. Security Objectives: What security goals your company has set and how it tracks progress.
7. Internal Audit and Management Review: Whether internal audits and management reviews have been completed and properly recorded.
8. Stage 2 Readiness: Whether your ISMS is sufficiently implemented and ready for a detailed audit.

Stage 1 isn’t simply a document-counting exercise. Auditors also consider whether the ISMS is mature enough to justify moving forward.

What Happens After Stage 1?

Following the assessment, the certification body provides documented conclusions about readiness and identifies areas of concern that may become nonconformities during Stage 2. The business then has an opportunity to address those concerns before the next audit.

Importantly, completing Stage 1 does not mean the organization has achieved ISO 27001 certification. It establishes whether the organization is sufficiently prepared for the next stage.

What Is an ISO 27001 Stage 2 Audit?

The ISO 27001 Stage 2 audit is the detailed evaluation of how effectively an organization’s ISMS has been implemented. If Stage 1 examines whether the required management system has been established, Stage 2 looks for proof that it operates as intended.

During Stage 2, auditors interview employees, observe operational practices, examine system configurations, and review records generated during routine business activities. The focus shifts from “What does your policy say?” to “Can you demonstrate that employees and systems follow this policy?”

What Do Auditors Check During Stage 2?

During the Stage 2 audit, auditors check whether your company follows its security policies and procedures. They review records, speak with employees, and look at how security controls work in day-to-day operations.

1. Security Controls: Auditors check whether the required security controls are in place and working. For example, they may ask for proof that multifactor authentication is enabled for admin accounts.
2. Access Management: They review how employees get access to systems, how permissions are updated, and whether accounts are disabled when someone leaves the company.
3. Security Incidents: Auditors look at how your company reports and handles security incidents. They may check incident reports, response records, and actions taken to prevent similar issues.
4. Employee Awareness: Auditors may ask how employees handle sensitive information, report phishing emails, and follow company security rules.
5. Vulnerability and Patch Management: Auditors review how your company finds security weaknesses, installs updates, and fixes identified issues.
6. Security Monitoring: They check whether your company tracks its security goals and regularly reviews how well its controls are working.
7. Continual Improvement: Auditors look at how your company fixes security gaps and check whether those fixes have worked.

What Is the Outcome of the Stage 2 Audit?

After the Stage 2 audit, auditors share their findings and highlight any areas that need improvement. If they find nonconformities, your company may need to take corrective action and provide evidence that the issues have been addressed.

Once the audit findings and required corrective actions have been reviewed, the certification body makes the final decision on ISO 27001 certification.

Completing Stage 2 does not automatically mean your company is certified. The certification body reviews the audit report and checks whether any nonconformities have been properly addressed. If all certification requirements are met, your company receives its ISO 27001 certificate. Once certified, your company must undergo regular surveillance audits to maintain its certification.

ISO 27001 Stage 1 vs. Stage 2 Audit: Key Differences

Although both stages assess the same management system, their purpose, depth, and expected evidence differ significantly.

Common Mistakes Businesses Make During ISO 27001 Audits

Even organizations with strong technical security can encounter certification difficulties if their ISMS is poorly coordinated.

What Happens If Your Organization Fails an ISO 27001 Audit?

Not every audit finding means certification has failed. Auditors may identify nonconformities that require action before a certification decision can be completed. Findings generally fall into two categories.

Minor nonconformity

A minor nonconformity indicates a specific weakness that does not, by itself, demonstrate a significant failure of the management system’s ability to achieve intended results. For example, your team may have completed a security review but forgotten to record the required approval.

In most cases, your company needs to identify what caused the issue and submit a plan to fix it. The certification body will review the proposed actions.

Major nonconformity

A major nonconformity indicates a more serious problem that affects the management system’s ability to achieve intended results or creates significant doubt about its effectiveness. For example, an organization may have failed to establish or implement a required risk assessment process.

Major nonconformities normally require implemented corrective actions and verification of effectiveness before initial certification can be granted. Certification decisions are made by the certification body, not simply by the auditor who conducted the assessment.

ISO 27001 Certification Process

Conclusion

ISO 27001 Stage 1 and Stage 2 audits differ mainly in what they assess. Stage 1 reviews your ISMS documents, risk assessments, and overall readiness. Stage 2 checks whether your company follows these processes and keeps proper records. To prepare for both audits, keep your documents up to date, review security controls regularly, and fix any gaps you find.

Getting ISO 27001 certified is important, but maintaining good security practices matters just as much. Regular reviews and improvements can help your business manage risks and keep sensitive information secure.

Build Your ISO 27001 Audit Expertise with InfosecTrain

Ready to move from ISO 27001 documentation to confident audit execution?

Understanding the standard is one thing. Knowing how to apply its requirements, evaluate security controls, collect reliable evidence, and prepare for certification audits requires practical knowledge. InfosecTrain offers instructor-led ISO 27001 training designed to help information security professionals develop their ISMS implementation and auditing skills.

• ISO 27001:2022 Lead Auditor Training: Develop skills in audit planning, conducting assessments, evaluating evidence, reporting nonconformities, and managing audit activities.
• ISO 27001:2022 Lead Implementer Training: Learn how to establish, implement, maintain, and improve an ISMS, including risk treatment, documentation, and certification audit preparation.

Strengthen your ISO 27001 knowledge and take the next step in your information security career.

TRAINING CALENDAR of Upcoming Batches For ISO 27001 Lead Auditor Training

TRAINING CALENDAR of Upcoming Batches For ISO 27001 Lead Implementer Training