ISO 27001 stage 1 and stage 2 audits explained

What happens in ISO 27001 stage 1 and stage 2 audits?

The initial ISO 27001 certification audit is one audit run in two stages by an accredited certification body. Stage 1 checks documentation and readiness, and stage 2 tests whether the management system is implemented and working in practice. Only the certification body can issue the certificate, and it does so only after stage 2 is complete and its certification decision is made. Your job before the audit is to make sure the evidence exists and that the certification body receives it in a form it can test. The interval between the two stages is the main thing that sets your timeline. Under ISO/IEC 17021-1, the certification body must allow time between stage 1 and stage 2 so you can resolve the concerns it found, and European Accreditation FAQ 49.3 sets no fixed maximum. The certification body decides whether the stage 1 result is still valid, and it is more likely to reassess after significant changes. Stage 1 can also record areas of concern that might become nonconformities in stage 2. The number of those concerns, the size of your scope and the people in it, and how mature your Statement of Applicability and risk treatment plan are will all shape how long that gap needs to be. Confirm early how your certification body will schedule each stage, what it expects to see in stage 1, and how it will time-box corrections to any major nonconformities. DeployOpen prepares systems, controls and evidence for assessment, but it does not audit, attest or certify. Those decisions belong to the independent certification body you choose, and the ISO certification page is a useful starting point for understanding who issues certificates.

How the initial audit moves from stage 1 to certificate

The initial ISO 27001 audit is one audit in two stages, and each step produces a written output that sets up the next: a plan, a readiness conclusion, closed corrections and a certification recommendation. The certification body makes the decision, not the organization or its implementation partner.

Agree the stage 1 plan with the certification body
The certification body and the organization agree how stage 1 will run, which documents will be reviewed and who will be interviewed. ISO/IEC 17021-1 does not require a formal audit plan for stage 1, but European Accreditation guidance (FAQ 32.4) says a plan still has to exist, and it can be informal, such as an email or a call. Done means the organization holds a written or recorded plan that names the scope, the documents and the people involved.
Run the stage 1 readiness review
The auditor reviews the documented ISMS against the requirements of clauses 4 to 10 and the Statement of Applicability, and checks whether the organization is ready for a detailed test. The stage 1 audit opens with its own opening meeting, because its objectives differ from stage 2. Done means the auditor has reviewed the core documents and noted where the ISMS is not yet ready.
Receive the documented stage 1 conclusions
The certification body must record its stage 1 conclusions on whether the organization is ready for stage 2 and communicate them to the client. Under clause 9.3.1.2.3 of ISO/IEC 17021-1, the report must include any areas of concern that could become a nonconformity during stage 2. Done means the organization holds the written stage 1 report with a clear list of concerns to resolve.
Resolve stage 1 concerns during the interval
Clause 9.3.1.2.4 of ISO/IEC 17021-1 requires an interval between the two stages so the client can resolve the concerns raised. The sources set no maximum length. The certification body decides whether the stage 1 result is still valid, and this judgment is more demanding after significant changes to the ISMS or its scope. Done means the organization has acted on each concern and has evidence to show the auditor.
Agree the stage 2 plan and run the stage 2 audit
The certification body confirms a stage 2 audit plan, either as a separate plan or within an overall initial audit plan reviewed after stage 1, as European Accreditation FAQ 32.4 describes. Stage 2 has its own opening meeting and tests whether the ISMS is implemented and operating, through interviews, sampled records and observed controls. Done means the auditor has tested the controls and recorded findings as conformities or nonconformities.
Close nonconformities with verified corrective action
Each nonconformity needs a documented correction and corrective action, which the certification body verifies. Under ISO/IEC 17021-1, major nonconformities from the initial audit must be verified as closed within 6 months after the last day of stage 2, or another stage 2 is required before certification can be recommended. Done means the certification body has accepted the corrective action evidence for every major nonconformity.
Hold the closing meeting and receive the recommendation
The formal closing meeting takes place at the end of stage 2 and states the audit findings and the certification body's recommendation. The recommendation is an output of the certification body's own review, and it does not guarantee a certificate. Done means the organization has a documented recommendation, and the certificate is issued only after the certification body's independent decision.

What stage 1 checks before the certification body commits to stage 2

Stage 1 is a documentation and readiness review, not a test of whether controls work in practice. The certification body uses it to decide whether the ISMS is described well enough to audit in stage 2, and it records any concerns that could become nonconformities. The cards below cover the checks an auditor runs in parallel and what the organization should have ready for each.

Scope and ISMS boundaries

The auditor reads the documented scope and checks that it matches the clause 4.3 requirements, the products, services, sites and people it covers, and the interfaces with external parties. They look for boundaries that are vague, that exclude systems the business actually runs, or that do not match the scope stated in sales material. Have a written scope statement, a list of in-scope locations and systems, and a short explanation of each exclusion ready.

Documented information for clauses 4 to 10

The auditor checks that the documented information the standard requires exists, is approved, is version controlled and is current. This covers the context, interested parties, leadership commitments, objectives, competence records, operational planning and performance evaluation records. Gaps here are the most common stage 1 concern. Have a document register that maps each required item to its owner and its approval date.

Statement of Applicability and risk link

The auditor traces each Annex A control in the Statement of Applicability to the risk assessment and risk treatment plan. They check that every inclusion and exclusion has a justification and that the implementation status is credible. A statement that lists controls without links to identified risks is a frequent concern. Have the risk register, the treatment plan and a Statement of Applicability that cites them for each control.

Policies and operating procedures

The auditor reviews the information security policy and the procedures that put it into practice, such as access control, incident handling, change management and supplier management. They check that the policies are approved by top management, communicated and consistent with the scope and risk treatment decisions. Have each policy approved and dated, and be able to show which procedure enforces it.

Internal audit and management review records

The auditor looks for evidence that the internal audit and management review have run as planned, before stage 1 if possible. Clause 9.2 and 9.3 records should show a programme, a scope, findings and actions taken. An auditor expects to see the ISMS working, not just designed. Have the internal audit programme, at least one completed internal audit report, and the minutes of a management review with decisions recorded.

People, sites and integrated standards

The auditor checks that the people and sites in scope know their roles and that the scope reflects where work actually happens, including remote staff and any outsourced operations. If ISO 27001 is audited with another management system standard, stage 1 must also confirm the declared level of integration, and the certification body may adjust audit time accordingly. Have an accurate headcount in scope, a site list, and a written statement of how the standards share processes.

Why a pre-audit cannot replace stage 1

A pre-audit is not the stage 1 audit, and a certification body cannot count it as one. According to the IAF Technical Committee consensus recorded in European Accreditation FAQ 48.11, a pre-audit before stage 1 is acceptable if impartiality is not compromised, but a pre-audit cannot be used as a stage 1 audit. The same consensus does not accept a pre-audit between stage 1 and stage 2. Some certification bodies sell a pre-audit as a readiness check, and it can be useful, but the reader should treat it as an extra conversation about gaps, not as the formal review that starts the certification process. The certification body still has to run its own stage 1 later.

A pre-audit can show where the management system looks weak, such as a thin risk assessment, an unclear scope or missing internal audit records. It cannot give a formal readiness conclusion, and it does not replace the documented stage 1 conclusions that clause 9.3.1.2.3 of ISO/IEC 17021-1 requires the certification body to record and communicate to the client, including areas of concern that could become a nonconformity in stage 2. Only the stage 1 output carries that status. Ask the chosen certification body who performs the pre-audit, whether the same people can later conduct stage 1, and how it protects impartiality if they do. Ask whether the pre-audit findings bind the later stage 1 or are advisory only.

Before you buy a pre-audit, confirm in writing how it is priced, what it covers, how many days it takes, and whether its fee is credited against stage 1. Ask whether the pre-audit report will be retained by the certification body and what the reader should expect to fix before stage 1. Plan for the pre-audit to add cost and calendar time without shortening the interval that stage 1 requires before stage 2. If the pre-audit finds gaps, the time needed to close them still falls inside the stage 1 to stage 2 interval, which has no maximum under European Accreditation FAQ 49.3, so the certification body decides whether earlier stage 1 results are still valid.

What stage 2 tests that stage 1 does not

Stage 1 asks whether the ISMS is designed and ready for an assessment of its implementation. The assessor reviews documentation and the organization's own understanding of its context, scope, risks and controls, and records conclusions on readiness for stage 2. Those conclusions must be communicated to the client, including areas of concern that could become a nonconformity in stage 2. Stage 1 opens with its own opening meeting, because its objectives differ from stage 2.

Scope and context: A documented ISMS scope, interested parties and the context that shapes it, ready for the assessor to test against the organization's operations.
Policies and the Statement of Applicability: Approved policies, a risk assessment and treatment record, and a Statement of Applicability that justifies each Annex A control included or excluded.
Management system records: Evidence of internal audit planning and management review, both required by clauses 9.2 and 9.3.
Readiness signals: Owners named for controls, and a clear view of which controls are not yet operating.
Common mistake: Treating stage 1 as a document review only. Assessors also test whether the documents describe what the organization actually does, and a Statement of Applicability that cites policies nobody has adopted is a frequent source of concerns.

Before stage 2, confirm with the certification body in writing which stage 1 concerns must be resolved.

Which preparation route fits your organization before stage 1

This table compares four ways to prepare for the stage 1 audit, showing who does the work, what each route gives you and when it fits. Read it as a decision aid: the organization owns the controls and the decision to certify in every row, the partner or reviewer prepares evidence, and only the certification body audits and recommends certification.

Option	Who does the work	What it gives you	When it fits
In-house readiness review	Your own staff, ideally people who did not build the ISMS	A self-check of documents, records and the Statement of Applicability against clauses 4 to 10 and the Annex A controls	Your team already has a working ISMS and needs to confirm it is ready for stage 1
Independent gap analysis	A consultant or implementation partner, separate from the certification body	A written list of gaps, prioritized findings and input to the implementation plan, with no certificate or audit opinion	You are starting out or unsure how far current practice is from the requirements
Certification body pre-audit	The certification body, under its own rules for preliminary audits	An early view from the body that will later audit you, but it cannot count as stage 1	Your body offers it and it does not compromise impartiality, so confirm the terms before booking
Full implementation engagement	A partner that prepares systems, policies and evidence, while you own the controls and decisions	Prepared systems and evidence ready for stage 1, with the organization still accountable for running them	Your team lacks capacity or skills and needs hands-on help across the whole ISMS

How nonconformities are closed before certification

Findings raised during stage 2 can be classified as nonconformities, and the classification decides how much work stands between the audit and a certification recommendation. Under ISO/IEC 17021-1, major nonconformities from the initial audit must have their corrections and corrective actions verified within 6 months after the last day of stage 2. If that window closes without verification, the certification body requires another stage 2 before it can recommend certification. Minor findings follow the certification body's own process, so the reader should confirm with the body how it handles them and how long it allows for closure. Plan the 6-month limit into the schedule from the start, counting from the last day of stage 2 rather than from the date the findings were written up.

Closing a finding means producing evidence that the gap is fixed and that the cause will not recur. Typical evidence includes the corrected record itself, such as a revised procedure, a completed access review or a patched and re-scanned system; a root cause analysis that explains why the gap happened; and a corrective action that has been implemented and shows results over a period the auditor can sample. The organization owns this evidence and its underlying decisions. An implementation partner or consultant can help prepare the records, but the evidence must come from the organization's own operation, and the certification body is the party that verifies it and decides whether the finding is closed.

Ask the certification body, before stage 2 starts, how it classifies findings, what evidence it expects for closure, whether it accepts document review or needs an on-site or remote check, and how it confirms the closure date. Clarify these points in writing so the timetable is not decided after the audit. Where a consultant prepared the response, keep the verification step separate: the consultant should not be the one signing off that a finding is closed. If the schedule cannot absorb the 6-month limit or a second stage 2, raise the risk with the certification body early rather than discovering it at the end of the window.

What usually delays stage 1 and stage 2

Most delays in the two-stage initial audit trace back to a small set of avoidable gaps: an unfinished Statement of Applicability, a moving scope, open stage 1 findings, misused pre-audits and corrective actions that arrive too late. Each card names the effect and the step that prevents it. A repeated stage 1 is the certification body's decision, not the client's, and it must be justified and handled with an impartiality safeguard.

Incomplete Statement of Applicability

The Statement of Applicability must list every Annex A control, state whether it is included or excluded, justify each decision and show implementation status. When controls are marked applicable without evidence, or exclusions lack reasons, stage 1 reviewers raise concerns that push the stage 2 date back. Before stage 1, check that each of the 93 Annex A controls has a status, a justification and a pointer to the policy or record that supports it.

Scope that changes between stages

If the business boundary, sites, products or people in scope move between stage 1 and stage 2, the auditor must re-examine what was already reviewed. A new business unit or a cloud migration added late can mean the stage 1 conclusions no longer hold. Freeze the scope statement before stage 1, record any change in writing, and tell the certification body early so it can judge whether the stage 1 result is still valid.

Stage 1 findings left open

Stage 1 must document conclusions on readiness for stage 2, including areas of concern that could become a nonconformity. The interval between the two stages exists so the client can resolve them. Organizations that treat these concerns as optional notes and start stage 2 with the same gaps repeat work and risk a nonconformity they could have closed. Assign each concern an owner and a date, and show the auditor the closed evidence before stage 2 begins.

Repeated stage 1 without justification

Some organizations ask for a second stage 1 after the first one raises concerns, hoping a fresh review will go more smoothly. The certification body decides whether a repeat is needed, must justify it, and treats a second stage 1 as a potential impartiality risk that requires added safeguards. Expect the cost and the calendar to grow with it. The practical fix is to close the stage 1 concerns in writing so that a repeat is not needed.

Pre-audit used as stage 1

A pre-audit or readiness review can be useful before stage 1 if the certification body's impartiality is preserved, but it cannot stand in for stage 1. It also is not acceptable between stage 1 and stage 2. Organizations sometimes assume a pre-audit already satisfied stage 1 and schedule stage 2 too early. Ask the certification body in writing which activity counts as stage 1 and confirm that the stage 1 plan and report still apply.

Major nonconformities past the limit

Major nonconformities from the initial audit must have corrections and corrective actions verified within 6 months after the last day of stage 2. If that window is missed, another stage 2 is required before certification can be recommended. Late discovery is the usual cause, often in the management review, internal audit or risk treatment records. Run the internal audit and management review before stage 2, and plan corrective action verification with a date that falls inside the window.

Common questions about ISO 27001 stage 1 and stage 2 audits

Are ISO 27001 stage 1 and stage 2 two separate audits?

No. The initial certification audit is one audit conducted in two stages, as ISO/IEC 17021-1:2015 frames it in clause 9.3.1.1. Stage 1 checks whether the management system is documented and ready for a detailed test, and stage 2 tests whether it is implemented and operating. Each stage has its own opening meeting because the objectives differ, and the formal closing meeting with the certification recommendation comes at the end of stage 2. The certification body, not the organization, decides how the two stages are scheduled and reported.

How long can the gap between stage 1 and stage 2 be?

The standard requires an interval so the client can resolve concerns raised in stage 1, but European Accreditation FAQ 49.3 sets no maximum. The certification body must judge whether the stage 1 results are still valid, especially after significant changes to the organization, its scope or its controls. Ask your certification body in writing how it will assess the gap, what evidence it expects you to show it, and whether stage 1 would need repeating if the gap is long. The length of the gap is driven mostly by how many concerns stage 1 raises and how quickly your team can close them.

Can DeployOpen or a consultant run the stage 1 or stage 2 audit?

No. Only an independent certification body can perform the audit and issue a certification decision. DeployOpen prepares systems, controls and evidence so the organization is ready for assessment, and an implementation partner can help with the answers to auditor questions. The organization owns its controls and its management system. Keep the implementation partner separate from the team that performs your internal audit and from the certification body, because impartiality rules limit how closely the two can be linked.

What must the organization provide before stage 1 starts?

Before stage 1, the organization should be able to show a defined scope, the documented management system clauses 4 to 10, a Statement of Applicability, a risk assessment and treatment record, and evidence that internal audit and management review have started. The certification body will usually request a document list in advance and confirm the audit plan, even if it is informal. If your environment is shared with other management systems, confirm the declared level of integration, since the certification body must confirm it at stage 1. Effort rises with the number of sites, systems and people in scope.

Does a pre-audit count as the stage 1 audit?

No. European Accreditation FAQ 48.11 records IAF Technical Committee consensus that a pre-audit cannot be used as a stage 1 audit. Pre-audits before stage 1 are acceptable if impartiality is not compromised, but they are not acceptable between stage 1 and stage 2. A pre-audit can reveal gaps early, yet the certification body still runs its own stage 1 with its own documented conclusions. Ask whether a pre-audit is offered by the certification body itself and how it will be kept separate from the formal assessment.

What happens if stage 2 finds major nonconformities?

Major nonconformities from the initial audit must have corrections and corrective actions verified within 6 months after the last day of stage 2, according to the rule ISO/IEC 17021-1 sets out and European Accreditation FAQ 36.14 explains. If that verification is not completed in time, another stage 2 is required before certification can be recommended. Minor nonconformities are handled through a corrective action plan. Your team's speed in identifying root causes, documenting evidence and getting controls operating across the sampled areas drives how many findings close without a repeat audit.

What drives the effort of stage 1 and stage 2 audits?

The main drivers are the scope of the ISMS, the number of people, sites and systems in it, how mature the documentation and evidence already are, and whether remote auditing is used. Remote audits follow the rules in ISO/IEC 27006-1:2024, and the audit report must state the extent and effectiveness of remote auditing. Ask your certification body for an audit time estimate based on your written scope, and confirm how it will treat integrated audits and any remote elements. Fees and audit days are set by the certification body, so compare quotes on the same scope.

How DeployOpen prepares systems and evidence for stage 1 and stage 2

DeployOpen plans, implements and documents the self-hosted open-source platforms that an ISMS depends on, inside the client's own infrastructure. We prepare systems and evidence for the stage 1 documentation review and the stage 2 on-site or remote testing, while the organization owns its controls and an independent certification body makes the certification decision.

How we scope

Agree the written scope of systems, sites and evidence sources before any stage 1 preparation work starts.
Map which platforms and controls will generate evidence for the stage 1 documentation review and the stage 2 sampling.
Confirm with the certification body which audit plan and stage 1 documents it expects before fixing deliverables.

How we build

Configure logging, access control, backup and change records so they produce dated evidence an auditor can sample.
Prepare the documented information needed for stage 1, including policies, the Statement of Applicability and procedures.
Document the concerns found during readiness checks so the client can resolve them before stage 2 begins.

How we hand over

Deliver written configuration records, runbooks and an evidence index that shows where each artifact is held.
Walk the client's staff through how to produce evidence for a stage 2 sample on request.
Record open items and corrective actions in a tracker so nonconformity closure can be shown with dates.

How we support

Offer ongoing support and retainers for platform upgrades, evidence collection and surveillance audit preparation.
Keep configuration and evidence current between audits so the client is not rebuilding records each year.
Confirm with the client and the certification body which support scope fits the cycle before the engagement is signed.

ISO 27001 stage 1 and stage 2 audits