--- title: "ISO 27001 Stage 1 vs Stage 2 Audits: What To Expect" description: "The difference between ISO 27001 Stage 1 and Stage 2 certification audits, what auditors examine at each, how nonconformities are graded and how to prepare." canonical: https://www.isosecurity.co.uk/resources/iso-27001-stage-1-stage-2-audit updated: 2026-11-10 --- # ISO 27001 Stage 1 vs Stage 2 audits: what to expect Stage 1 examines whether your Information Security Management System is properly designed, documented and ready, and Stage 2 examines whether it actually operates. Most organisations that struggle at Stage 2 were held back by gaps that Stage 1, or an honest internal audit, would have caught months earlier. ## What is the difference between Stage 1 and Stage 2? | | Stage 1 | Stage 2 | | ----------------------- | -------------------------------------------------- | ------------------------------------------------------ | | Core question | Is this organisation ready to be audited properly? | Does the management system work in practice? | | Focus | Documentation, scope, risk process, readiness | Operating evidence, sampled controls, staff interviews | | Typical length | 1–2 days, often partly remote | 2 days to over a week, depending on size and sites | | Output | Readiness report with areas of concern | Findings, then the certification decision | | Consequence of problems | Fix before Stage 2 can proceed | Major findings must be closed before certification | ## What does Stage 1 examine? - The ISMS scope, and whether it is coherent and defensible for your business - The information security policy and supporting policy set - Your risk methodology, risk assessment, treatment plan and Statement of Applicability, with a justification for every control included or excluded - Evidence the system has begun operating: internal audit records, management review minutes, security objectives - Your register of legal and contractual requirements, and readiness in each area the auditor will test at Stage 2 Expect questions alongside the document checks. An auditor who reads a beautifully formatted scope that excludes the service your customers buy will explore why, and the answer matters. ## What does Stage 2 examine? Stage 2 works from your Statement of Applicability as a map. For a sample of the controls you declared applicable, the auditor wants operating evidence: access review records with dates, joiner and leaver tickets, backup restore tests, supplier assessments, incident records, training logs. They interview control owners directly. A control you marked as implemented that nobody can describe or evidence becomes a finding, and an excluded control whose justification does not survive questioning becomes one too. Clauses 4 to 10 are tested the same way: leadership involvement, risk in practice, monitoring, internal audit quality and what you did about what it found. ## How are audit findings graded? | Finding | Meaning | Effect | | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | | Major nonconformity | A required process is absent or has broken down systemically. Examples: no risk methodology, an unjustified Statement of Applicability, no internal audit | Must be corrected and verified before certification is granted | | Minor nonconformity | A single lapse inside a working system: one missed access review, one overdue policy review | Certificate can proceed; corrective plan agreed, closure checked at surveillance | | Observation / opportunity for improvement | No requirement breached, but a weakness worth fixing | No obligation. Ignored observations have a habit of returning as nonconformities | Corrective action means fixing the root cause. "We have now done the missed access review" leaves two questions unanswered: why it was missed, and what changed so it will not be missed again. Auditors reject that response more often than any other. ## Which findings do I see most, and how do you avoid them? - **Statement of Applicability gaps.** Exclusions without justification, or the 2022 controls overlooked. Build the SoA from the risk assessment, and let templates support it. - **Risk methodology not applied as written.** The register does not match the documented scoring. Use a method simple enough to follow every time. - **Internal audit that proves nothing.** No programme, partial coverage, findings without follow-up. Audit the system as the external auditor will. - **Thin management review.** Missing the required inputs, no decisions, no actions. Use an agenda drawn from the clause. - **Supplier evidence missing.** Assess significant providers before go-live, and record it. ## How do you prepare well for Stage 1 and Stage 2? The reliable route is boring: finish the internal audit early enough to fix what it finds, and hold a real management review. Assemble evidence where it can be retrieved in minutes, and brief interviewees to describe what they actually do in their own words. After certification the cycle continues with [surveillance audits](/resources/iso-27001-surveillance-audit), and the habits that pass Stage 2 make those straightforward. My [implementation guide](/resources/iso-27001-implementation-guide) sets out how to reach this point in good order. ## Frequently asked questions about Stage 1 and Stage 2 audits ### What is the difference between Stage 1 and Stage 2? Stage 1 asks whether your management system is properly designed and documented: scope, policy, risk assessment and treatment, Statement of Applicability, internal audit and management review. Stage 2 asks whether it operates, sampling records, testing controls from your Statement of Applicability and interviewing the people who own them. ### How long must there be between Stage 1 and Stage 2? Usually four to eight weeks, enough to close any areas of concern from Stage 1 and for the certification body to plan the visit. Stage 2 normally has to happen within about six months of Stage 1 or the Stage 1 review may need to be repeated, and your certification body sets the exact rules in its audit plan. ### What happens if we get a major nonconformity at Stage 2? Certification waits until a major is closed: you analyse the root cause, implement corrective action and provide evidence, which the certification body verifies (sometimes with a short follow-up visit) commonly within 30 to 90 days. Minor nonconformities follow an agreed corrective action plan, with closure evidenced at the next surveillance audit. ### Can we fail Stage 1? Stage 1 ends with a readiness report, and any areas of concern must be resolved before Stage 2 can proceed. Fundamental gaps (no Statement of Applicability, no internal audit, no management review) delay the programme in practice. ## Contact Certification audit on the horizon? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.