The Stage 1 audit is mostly a review of your documented ISMS to see whether you are ready. The Stage 2 audit tests whether the system actually operates and works in practice. Expect documents and design questions first, then interviews, records and sampled evidence second. Exact timing rules come from your certification body.
Stage 1: is the system ready to be audited
The auditor reads your scope, your information security policy, your risk assessment method and results, your Statement of Applicability and your plan for internal audit and management review. The goal is to find out whether a full audit would be a fair test.
Stage 1 often ends with a list of concerns rather than formal findings. Treat that list as free advice. Fixing a weak scope statement now is cheaper than defending it during Stage 2.
Stage 2: does it work in practice
Stage 2 looks for operating evidence. The auditor picks controls from your Statement of Applicability and asks to see records: who was onboarded and when, how a change was approved, what happened after an incident, what the internal audit found, what management decided.
Expect interviews with people who run the controls, not only the security lead. If the engineer who approves releases cannot describe the process the policy describes, that gap will show.
What to have ready for each stage
For Stage 1: the mandatory documents, a current risk register, the Statement of Applicability, and your scope boundaries in plain language.
For Stage 2: at least one completed internal audit, at least one management review with minutes, a few months of operating records for each control you rely on, and a log of corrective actions.
If you have not completed an internal audit or a management review before Stage 2, expect a finding. Both are clause requirements, not optional extras.
Timing between the stages
Certification bodies set their own rules about how far apart the two stages can be and what happens if the gap is too long. Ask yours in writing before you book. Do not assume a fixed number from a blog post, including this one.
Mistakes that cost time
Teams often treat Stage 1 as a formality and arrive with a thin risk assessment. The auditor then spends the time on questions you could have answered in advance, and Stage 2 starts with open concerns.
Another mistake is a scope statement that is too broad. If you list every office, product and subsidiary, you must show controls working in all of them. Start with the part that customers care about and widen it later at a surveillance visit if needed.
A third is poor interview preparation. Stage 2 interviews reach past the security lead to engineers, HR and facilities. Tell those people the audit date, share the part of the policy that concerns them, and ask them to describe what they really do.
A simple readiness test
Two weeks before Stage 1, ask someone outside the project to read your scope, risk method and Statement of Applicability and explain them back to you. If they cannot, an auditor will struggle too. Fix the unclear parts first.
Quick check
Can we skip Stage 1?
Not normally for an initial certification. Ask your certification body how it schedules the two stages.
Does Stage 1 need to be on site?
That depends on the certification body and your situation. Many offer remote options. Confirm with yours.
Safeguard's compliance and evidence automation can help collect the operating records Stage 2 samples. The platform does not replace the audit or the certification body.
Last reviewed: 19 October 2026.
