An ISO 27001 certification audit usually runs in two stages. Stage 1 reviews your documented ISMS, and Stage 2 tests that controls operate and that your risk assessment, internal audit and management review actually happened. Prepare one evidence pack per stage, brief interviewees and treat each finding as a corrective action to close.
The ISO catalogue page returned HTTP 403 when we fetched it and the standard is paid. The stage structure below is the common pattern for ISO management system audits. Ask your certification body for their exact rules, durations and fees, which we do not state because we could not source them.
What does Stage 1 look at?
The auditor reviews documentation and readiness. Prepare:
- ISMS scope and information security policy.
- Risk assessment method, results and treatment plan.
- Statement of Applicability, with a reason for each excluded control.
- Objectives and how you measure them.
- Internal audit programme and the report, plus management review minutes. Both should exist before certification.
- Procedures for the Annex A controls you apply.
Outcome: findings about gaps in documentation and a view on readiness for Stage 2.
What does Stage 2 look at?
Evidence that things operate. Auditors sample across the ISMS, so assemble records for each applicable control:
- People: screening, signed terms, awareness and training records, leaver checklists.
- Access: joiner, mover and leaver tickets, periodic access reviews, privileged access lists.
- Assets and suppliers: asset inventory, supplier assessments and contract clauses, cloud service responsibilities.
- Technology: vulnerability scans and remediation tickets, patching, backups and restore tests, logging and monitoring, secure development and change records.
- Incidents: log of events, handling records, lessons learned.
- Continuity: plan and test results.
- Management: review minutes, decisions, resourcing, improvement actions.
Make sure the risk assessment is current and visibly drives your control choices.
How do you run the internal audit?
It must be done by someone who does not audit their own work. Cover every clause and the applicable Annex A controls, record findings, and track corrective actions to closure. An internal audit that finds nothing looks suspicious.
How do you handle interviews?
Interviewees should describe how things really work. Avoid recitals of policy. If an engineer says they do something different from the written rule, either the practice or the policy needs fixing before the auditor arrives. Keep one coordinator logging every request and answer.
What happens with findings?
Nonconformities need a documented cause, correction, corrective action and verification that it worked. Rewriting a policy to match a failure is weaker than fixing the failure. Your certification body will tell you how it classifies findings and what deadlines apply.
What comes after certification?
Surveillance audits follow, and the standard expects ongoing operation of the ISMS, including continual improvement, internal audits and management reviews. Ask your certification body how often they visit and how long the certificate lasts.
What to do
- Finish the SoA and risk treatment plan before booking Stage 1.
- Operate controls long enough that records exist, and ask your body how much history they expect.
- Complete the internal audit and management review first.
- Build evidence packs by theme with a link from each SoA row.
- Brief interviewees and appoint a coordinator.
- Log findings with root cause and track them to closure.
Quick check
Can I use my SOC 2 evidence for ISO 27001?
Much of the technical evidence overlaps, for example access reviews and change records. ISO 27001 also requires the management system pieces: scope, risk treatment, Statement of Applicability, internal audit and management review.
Who certifies me?
An independent certification body. Safeguard and other software tools can help you prepare, but they cannot certify you.
How Safeguard helps automate this
Stage 2 depends on recurring records, which are easy to miss while building the rest of the system. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits, saving time for other work. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps you prepare and keep evidence ready, and the certification body decides. Book a call to see it.
Sources
- ISO: ISO/IEC 27001 (HTTP 403 on fetch; standard is paid)
- Common ISO management system audit practice, not independently confirmed from a fetched primary page
Last reviewed: 18 October 2026.
