An ISO 27001 audit is the independent check that decides whether you get certified. It is less frightening when you know the stages and what auditors look for. This guide explains each audit, from Stage 1 to surveillance, and how to prepare.
The Stage 1 ISO 27001 Audit
Stage 1 is a review of your documentation. The auditor checks that your ISMS is designed properly: scope, policy, risk assessment and Statement of Applicability. Gaps found here are fixed before Stage 2.
The Stage 2 Audit
Stage 2 checks that the ISMS operates in practice. The auditor interviews staff, reviews records and samples evidence for the controls you selected. If you pass, the certification body issues your certificate.
Surveillance Audits
Once certified, you have shorter audits each year to confirm the system is maintained. Recertification takes place every three years.
What Auditors Actually Look For
Auditors test whether practice matches paperwork. Expect questions to staff about policies, requests to show access reviews and evidence of incident handling. Our guide to ISO 27001 ISMS certification covers this in more detail.
How to Prepare
- Run an internal audit and fix the findings.
- Hold a management review and record decisions.
- Brief staff on what they may be asked.
- Check your evidence is easy to find.
A mock audit from our compliance and audit service is a safe rehearsal. See also our ISO 27001 service.
Frequently Asked Questions
What happens at an ISO 27001 audit?
The auditor reviews documentation at Stage 1 and tests whether the system works in practice at Stage 2.
How long does an ISO 27001 audit take?
It depends on the size and scope of the organisation. The certification body sets the number of audit days.
What if I fail?
The auditor records nonconformities. You fix them within the agreed time and the auditor verifies the corrections.
Can I do a practice audit?
Yes. An internal audit or a mock audit shows what an auditor would find.