ISO 27001 certification is achieved through a two-stage audit by an accredited certification body. Stage 1 (a documentation review) typically happens 4–8 weeks before Stage 2 (the on-site assessment). Knowing exactly what auditors look for at each stage saves time and prevents costly findings.

Stage 1 Audit: What the Auditor Reviews

Stage 1 is primarily a desk review. The auditor will check that your ISMS documentation is complete and suitable. Key documents include:

  • ISMS Scope document (Clause 4.3) — clearly defining the boundaries of your management system.
  • Information Security Policy (Clause 5.2) — signed by top management.
  • Risk Assessment methodology and results (Clause 6.1.2).
  • Risk Treatment Plan (Clause 6.1.3) and Statement of Applicability (SoA).
  • Objectives for information security (Clause 6.2) — measurable and monitored.
  • Internal audit programme and results (Clause 9.2).
  • Management Review minutes (Clause 9.3).

Statement of Applicability (SoA)

The SoA is the single most important document in your ISO 27001 audit. It lists all 93 controls from Annex A, states whether each is applicable or excluded (with justification), and references the evidence of implementation. Auditors spend significant time on the SoA — every exclusion must be defensible.

Stage 2 Audit: What the Auditor Tests

Stage 2 involves sampling your controls in operation. The auditor will:

  • Interview key personnel (CISO, IT administrators, HR, legal).
  • Review evidence of control operation (access logs, patch records, training completions, vulnerability scan reports, supplier reviews).
  • Verify that your risk treatment decisions align with your implemented controls.
  • Confirm that nonconformities from Stage 1 have been remediated.

Common Stage 2 Findings

  • Risk assessment not updated when significant changes occurred (new systems, new products, staff restructuring).
  • Internal audit programme not completed on schedule, or covering only low-risk areas.
  • Management review minutes too generic — no evidence of specific decisions about risks, objectives, or resource allocation.
  • Supplier agreements lacking information security clauses (A.5.19–A.5.22).
  • Incident register not maintained or incidents not classified for information security relevance.

The Surveillance and Recertification Cycle

ISO 27001 certification is valid for three years, subject to annual surveillance audits. Surveillance audits focus on whether the ISMS is being maintained and improved. The most common finding at surveillance is stale documentation — policies not reviewed, risk assessments not updated, and objectives not measured.

Using a compliance platform that continuously tracks evidence, flags overdue reviews, and maintains an audit-ready evidence library dramatically reduces the effort of both initial certification and ongoing surveillance.