What is the difference between Stage 1 and Stage 2?
| Stage 1 | Stage 2 | |
|---|---|---|
| Core question | Is this organisation ready to be audited properly? | Does the management system work in practice? |
| Focus | Documentation, scope, risk process, readiness | Operating evidence, sampled controls, staff interviews |
| Typical length | 1–2 days, often partly remote | 2 days to over a week, depending on size and sites |
| Output | Readiness report with areas of concern | Findings, then the certification decision |
| Consequence of problems | Fix before Stage 2 can proceed | Major findings must be closed before certification |
What does Stage 1 examine?
- The ISMS scope, and whether it is coherent and defensible for your business
- The information security policy and supporting policy set
- Your risk methodology, risk assessment, treatment plan and Statement of Applicability, with a justification for every control included or excluded
- Evidence the system has begun operating: internal audit records, management review minutes, security objectives
- Your register of legal and contractual requirements, and readiness in each area the auditor will test at Stage 2
Expect questions alongside the document checks. An auditor who reads a beautifully formatted scope that excludes the service your customers buy will explore why, and the answer matters.
What does Stage 2 examine?
Stage 2 works from your Statement of Applicability as a map. For a sample of the controls you declared applicable, the auditor wants operating evidence: access review records with dates, joiner and leaver tickets, backup restore tests, supplier assessments, incident records, training logs.
They interview control owners directly. A control you marked as implemented that nobody can describe or evidence becomes a finding, and an excluded control whose justification does not survive questioning becomes one too.
Clauses 4 to 10 are tested the same way: leadership involvement, risk in practice, monitoring, internal audit quality and what you did about what it found.
How are audit findings graded?
| Finding | Meaning | Effect |
|---|---|---|
| Major nonconformity | A required process is absent or has broken down systemically. Examples: no risk methodology, an unjustified Statement of Applicability, no internal audit | Must be corrected and verified before certification is granted |
| Minor nonconformity | A single lapse inside a working system: one missed access review, one overdue policy review | Certificate can proceed; corrective plan agreed, closure checked at surveillance |
| Observation / opportunity for improvement | No requirement breached, but a weakness worth fixing | No obligation. Ignored observations have a habit of returning as nonconformities |
Corrective action means fixing the root cause. "We have now done the missed access review" leaves two questions unanswered: why it was missed, and what changed so it will not be missed again.
Auditors reject that response more often than any other.
Which findings do I see most, and how do you avoid them?
- Statement of Applicability gaps. Exclusions without justification, or the 2022 controls overlooked. Build the SoA from the risk assessment, and let templates support it.
- Risk methodology not applied as written. The register does not match the documented scoring. Use a method simple enough to follow every time.
- Internal audit that proves nothing. No programme, partial coverage, findings without follow-up. Audit the system as the external auditor will.
- Thin management review. Missing the required inputs, no decisions, no actions. Use an agenda drawn from the clause.
- Supplier evidence missing. Assess significant providers before go-live, and record it.
How do you prepare well for Stage 1 and Stage 2?
The reliable route is boring: finish the internal audit early enough to fix what it finds, and hold a real management review. Assemble evidence where it can be retrieved in minutes, and brief interviewees to describe what they actually do in their own words.
After certification the cycle continues with surveillance audits, and the habits that pass Stage 2 make those straightforward. My implementation guide sets out how to reach this point in good order.