An initial ISO 27001 certification audit happens in two parts. Stage 1 asks whether your ISMS is designed and ready to be audited. Stage 2 asks whether it is working. Teams that treat stage 1 as a formality tend to learn its purpose when the auditor recommends delaying stage 2.
The two stages are not an ISO 27001 invention. They come from the rules certification bodies themselves are accredited against, which is why every accredited certification body runs them, and why the broad shape is the same whichever one you choose.
This article explains what each stage examines, how they differ, what happens in the gap between them, and how to prepare for each without doing the work twice.
Where the two stages come from
ISO/IEC 27001 sets requirements for your ISMS. It says nothing about how certification audits are run. That is the job of two other standards:
ISO/IEC 17021-1, which sets requirements for bodies that audit and certify management systems of any kind, including the two-stage initial audit.
ISO/IEC 27006, which adds requirements specific to bodies certifying information security management systems.
Accredited certification bodies are assessed against both. Your certification body's own procedures add detail on top, such as how it schedules the stages and how long it allows between them.
The two stages compared
| Stage 1 | Stage 2 | |
|---|---|---|
| Question it answers | Is the ISMS designed, documented, and ready to audit? | Is the ISMS implemented and effective? |
| Main focus | Documented information, scope, readiness | Operation of processes and controls, with evidence |
| Typical activities | Document review, discussion with key staff, scope confirmation | Interviews, observation, sampling of records across the scope |
| Key outputs | Stage 1 report, areas of concern, stage 2 plan | Audit report, any nonconformities, certification recommendation |
| What goes wrong | Missing core documents, unclear scope, no internal audit or management review yet | Records that do not support what the documents claim |
What stage 1 examines
ISO/IEC 17021-1 lists the objectives of stage 1. In plain terms, the auditor is there to:
Review your documented information for the ISMS
Evaluate site-specific conditions and talk to your staff, to judge whether you are ready for stage 2
Review your understanding of the standard's requirements, particularly your key processes, objectives, and operation of the ISMS
Gather what is needed to confirm the scope: processes, locations, and the legal and regulatory requirements that apply
Agree the details of stage 2, including resources and timing
Evaluate whether internal audits and management reviews are planned and performed, and whether the level of implementation shows you are ready
For an ISMS, the documented information under review usually includes the scope statement, the information security policy, the risk assessment and treatment method, the results of the risk assessment, the Statement of Applicability, the risk treatment plan, and records of internal audit and management review.
Certification bodies generally expect at least one internal audit and one management review covering the ISMS to have been completed before stage 2. Confirm the exact expectation with yours when you book.
What stage 1 produces
The auditor documents conclusions and identifies any areas of concern: issues that could be classified as nonconformities if they are still present at stage 2. A stage 1 report that lists several of them is not a failure. It is a to-do list delivered while there is still time to act on it.
If the gaps are serious enough, the auditor can recommend that stage 2 be postponed. That is the outcome to avoid, because it costs calendar time you may have promised a customer.
The gap between the stages
ISO/IEC 17021-1 does not set a fixed interval between stage 1 and stage 2. The certification body decides, taking into account the time you need to resolve the areas of concern. In practice, your certification body will have its own rule on the maximum gap, and if it is exceeded, stage 1 may need to be repeated. Ask about this before you schedule.
Use the gap deliberately:
Close every area of concern from the stage 1 report, and keep a record of what you changed
Confirm your control owners know they will be interviewed, and on what
Check that the evidence for each included control covers a meaningful period, not only the week before the audit
Run any recurring control that is due, such as an access review, so its record exists when the auditor samples
The first audit timeline shows how to place both stages in a realistic plan.
What stage 2 examines
Stage 2 evaluates implementation, including effectiveness. The auditor is testing whether what your documents describe is what your organization does.
Expect the auditor to cover:
Conformity with all requirements of ISO/IEC 27001, clauses 4 to 10
The controls in your Statement of Applicability, by sampling
Monitoring, measurement, and reporting against your information security objectives
How you meet legal, regulatory, and contractual requirements
Operational control of your processes
Internal audit and management review, as they actually ran
Top management's responsibility for policies and the ISMS
Most of this happens through interviews and sampled records. An auditor might ask an engineering lead to walk through how a production change is approved, then sample several changes from the period and check each one. The walkthrough article covers how that conversation usually runs.
The weakness stage 2 exposes most often is the gap between design and operation. A procedure says access is reviewed quarterly; the records show one review. A policy says suppliers are assessed before onboarding; the supplier list includes several with no assessment. These are not documentation problems. They are evidence that the ISMS is not yet running as written.
After stage 2
The audit team reports its findings and makes a recommendation. The certification decision is then made by people at the certification body who were not part of the audit team.
Any nonconformities must be addressed before certification. For major nonconformities, the certification body will need to review and verify your correction and corrective action. For minor ones, it will generally need to accept your plan. The details, and the difference between the two grades, are worth understanding before stage 2 rather than after it.
Once certified, you enter a three-year cycle with surveillance audits in the intervening years.
Preparing for each stage
Most preparation serves both stages. The difference is emphasis.
For stage 1
- Not done:
Scope statement, approved and consistent with what you sell
- Not done:
Information security policy, approved by top management
- Not done:
Risk method, risk assessment results, and risk treatment plan
- Not done:
Statement of Applicability with a justification on every line
- Not done:
At least one completed internal audit and management review, with records
- Not done:
A named person who can explain each of the above
For stage 2
- Not done:
Evidence for each included control, covering the period since implementation
- Not done:
Control owners briefed and available on the audit dates
- Not done:
Records of recurring activities, such as access reviews, training, and supplier assessments
- Not done:
Corrective action records for anything found in internal audit or stage 1
The first audit mistakes article covers the errors that most often turn a manageable stage 2 into a difficult one. For the standard itself, see the ISO 27001 framework page.
How TrustLynce helps
TrustLynce gives your certification auditor a single place for requests, documents, and findings through the auditor portal. Evidence collection gathers records on a schedule from your systems, timestamped and attributed, so stage 2 samples draw on records captured at the time rather than assembled before the audit.