Two audits, not one
ISO 27001 certification is awarded after a two-stage audit performed by an accredited certification body. Stage 1 reviews your documentation and readiness. Stage 2 tests whether the ISMS actually operates. They are usually several weeks apart, and they answer different questions.
| Stage 1 | Stage 2 | |
|---|---|---|
| Question | Is the ISMS documented and ready? | Does it actually work? |
| Method | Document review, limited interviews | Interviews, sampling, evidence testing |
| Duration | Typically 1 day | Typically 2–5 days, scaled by scope |
| Outcome | Readiness decision plus findings | Certification recommendation |
| Can you fail? | Not exactly — Stage 2 gets deferred | Yes, on a major nonconformity |
Stage 1: the documentation review
The auditor is deciding whether your ISMS is coherent enough to be worth testing. They will read your scope statement, your Statement of Applicability, your risk assessment and treatment plan, your policy set, and evidence that internal audit and management review have actually happened.
The single most common Stage 1 finding is that internal audit or management review has not been done. Both are mandatory clauses. Teams treat them as post-certification housekeeping and discover they are prerequisites.
Stage 1 usually produces findings rather than a pass or fail. If they are significant, Stage 2 is deferred until you close them — which is a scheduling problem, because certification body calendars are not elastic.
Stage 2: the operational audit
Now the auditor tests whether the documented ISMS matches the running organization. They interview control owners, sample evidence, observe controls being performed, and trace risks through to controls and back.
What they are looking for is consistency between the documents and reality. A policy saying access reviews happen quarterly, and evidence of two reviews in a year, is a nonconformity — not because two is too few in the abstract, but because it contradicts your own stated control.
Stage 2 length scales with scope and headcount, which is the mechanism by which a broad scope becomes expensive. See ISO 27001 certification cost.
Nonconformities: major and minor
| Type | Means | Consequence |
|---|---|---|
| Major | A clause requirement is absent, or a systemic failure | Certification withheld until closed and verified |
| Minor | An isolated lapse in an otherwise working control | Corrective action plan, closed at surveillance |
| Observation | Not a failure; a risk of one | No action required, worth addressing |
A major nonconformity does not usually mean starting again. It means closing the finding, submitting evidence, and in some cases a follow-up visit. The cost is time and an additional audit day, not the whole programme. Minors are routine — most first certifications carry a few.
What happens after
The auditor recommends certification, a technical reviewer at the certification body approves it, and the certificate issues. It is valid for three years, with a surveillance audit in each of years two and three, and recertification at the end.
Surveillance audits are shorter than Stage 2 but they are not a formality. They check that the ISMS is still running, that the risk assessment has been refreshed, that internal audits are happening, and that the SoA still matches what you actually do.
How to make both uneventful
Do the internal audit and management review before Stage 1. They are prerequisites, not follow-ups, and they are the most common Stage 1 finding.
Write your own SoA justifications. Template language is recognisable and it lengthens Stage 1.
Make sure documents match reality. Where they differ, change whichever is wrong — but do not leave a policy describing a control you do not operate.
Rehearse the interviews. Control owners who have never been asked to explain their control in an audit setting perform worse than the control deserves.
Book early. Certification body scheduling is frequently the longest pole in the project, and a deferred Stage 2 does not simply move by a week.
FAQs
What is the difference between Stage 1 and Stage 2 ISO 27001 audits?
Stage 1 is a documentation and readiness review — the auditor checks your scope, Statement of Applicability, risk assessment, policies and evidence of internal audit and management review. Stage 2 tests whether the ISMS actually operates, through interviews, sampling and evidence testing. Stage 1 decides whether Stage 2 should proceed.
How long do Stage 1 and Stage 2 take?
Stage 1 is typically one day. Stage 2 typically runs two to five days depending on ISMS scope and headcount within it, which is the mechanism by which a broader scope raises your certification cost.
Can you fail an ISO 27001 Stage 1 audit?
Not in the sense of a pass or fail grade. Stage 1 produces findings, and if they are significant the certification body defers Stage 2 until they are closed. The practical cost is scheduling, because audit calendars are not elastic.
What is a major nonconformity in ISO 27001?
A clause requirement that is absent altogether, or a systemic failure of a control. Certification is withheld until it is closed and the closure verified, sometimes requiring a follow-up visit. It does not mean restarting the programme. Minor nonconformities are isolated lapses and are closed through a corrective action plan at the next surveillance audit.
What happens after ISO 27001 Stage 2?
The auditor recommends certification, a technical reviewer at the certification body approves, and the certificate issues for three years. Surveillance audits follow in years two and three, and recertification at the end of year three. Surveillance checks that the ISMS is still operating and that the risk assessment and SoA have been kept current.
Where to go next
Make Stage 1 uneventful with an ISO 27001 gap analysis, get the mandatory clauses covered in internal audit, or see the fee structure in certification cost.