ISO 27001 Audit Prep: What Does the Auditor Check?

In an ISO 27001 certification audit, an accredited certification body assesses you in two stages: Stage 1 uses your documentation to establish whether your ISMS is ready for audit, Stage 2 samples whether it works in practice. If a major nonconformity has not been verified as resolved within six months of Stage 2, ISO/IEC 17021-1 requires a new Stage 2. The KaitoSec Team shows which evidence the auditor expects to see.

How does an ISO 27001 certification audit work?

An ISO 27001 certification audit runs in two stages: Stage 1 reviews documentation and audit readiness, Stage 2 the effectiveness of the ISMS in operation. The certification body then decides on the certificate independently of the audit team, and the certificate opens a three-year cycle. The rules the certification body audits by are set out in ISO/IEC 17021-1 and ISO/IEC 27006-1.

Together, the Stage 1 audit and the Stage 2 audit make up the initial certification audit. Make sure you choose an accredited certification body; in Germany, accreditation is granted by DAkkS. The basis is ISO/IEC 17021-1, with the general requirements for bodies certifying management systems, and ISO/IEC 27006-1:2024, with the additional ISMS-specific requirements. Whether a body is accredited for ISO/IEC 27001 can be checked in the DAkkS search for accredited bodies.

The process in five steps:

• Based on the scope details you provide, the certification body prepares a quote including audit time.
• In the Stage 1 audit, the auditor reviews documentation, scope and readiness for Stage 2.
• In the Stage 2 audit, the audit team uses sampling, interviews and observation to assess effectiveness.
• The certification decision is made by personnel of the body who did not take part in the audit.
• After the decision come surveillance audits and, in the third year, recertification.

The body derives audit time under ISO/IEC 27006-1 from factors including the number of people within the scope. For budget planning, read what the certification audit costs and how the audit days are calculated. For multiple sites, the body can draw a site sample under IAF MD 1 (IAF document list) instead of auditing every site.

The DQS auditing and certification rules show what this looks like in practice: the results are "evaluated by independent personnel of the respective DQS certification body", and the audit team's recommendation is "not binding for them" (our translation).

KaitoSec is not a certification body; this guide explains the rules that apply to certification bodies.

What does the auditor check in an ISO 27001 Stage 1 audit?

In the Stage 1 audit, the auditor checks whether your ISMS is documented, has a clearly defined scope and is ready for Stage 2. ISO/IEC 17021-1 explicitly requires an evaluation of whether internal audits and the management review are being planned and performed. Stage 1 does not decide on the certificate, but it can postpone Stage 2.

ISO/IEC 17021-1, Clause 9.3.1.2, assigns Stage 1 several tasks. The auditor reviews the documented information of your management system and gains an understanding of site conditions and scope. They establish how you have understood the requirements of the standard, particularly regarding performance indicators, significant aspects, processes and objectives, and plan resources and logistics for Stage 2 with you. The DQS auditing rules describe Stage 1 as "an analysis and evaluation of the system documentation, the objectives, the results of the management review and the internal audits".

These are the documents the auditor typically requests for Stage 1:

• ISMS scope with sites, processes and interfaces to service providers and other areas
• Information security policy, approved by top management and communicated within the organization
• Methodology for risk assessment and risk treatment, along with current results and the risk treatment plan
• Statement of Applicability (SoA) with a justification for every included or excluded Annex A control
• Information security objectives with owners, deadlines and a statement of how you measure success
• Audit programme and internal audit report, including identified nonconformities and actions taken
• Minutes of the management review with the inputs and decisions of top management

An internal audit that takes place only after Stage 1 cannot be evaluated there. Our knowledge base explains how to plan the internal audit under ISO 27001.

The auditor documents any Stage 1 concerns that could lead to a nonconformity in Stage 2 and communicates them to you before Stage 2 (ISO/IEC 17021-1, 9.3.1.2.3). The certification rules of TÜV AUSTRIA Deutschland state that where deficiencies are found, Stage 2 is "only continued once the client has remedied the deficiencies" (our translation). The interval between the two stages is set by the certification body; the standard does not specify a fixed period.

Stage 1 is the best point to find gaps. Submit your documents complete and approved rather than sending in drafts later.

What does the auditor check in the Stage 2 audit?

In the Stage 2 audit, the audit team checks whether your ISMS is implemented as documented and whether it is effective. To do so, it samples records, interviews staff and observes processes across all Clauses 4 to 10 and the applicable Annex A controls. The outcome is a set of findings and a recommendation to the certification body.

ISO/IEC 17021-1, Clause 9.3.1.3, defines the purpose of Stage 2 as evaluating the implementation of the management system, including its effectiveness. The DQS auditing rules describe the audit team's assessment as "based on their observations, reviews, interviews, examination of the related documents and other audit techniques". In an ISMS, this looks like the following, for example:

• For a sample, the auditor picks an Annex A control from the Statement of Applicability (SoA), such as A.5.18 Access rights, and asks for evidence that it is applied, for instance records of an access rights review.
• In an interview, a department head explains how a security incident is reported. The auditor compares the answer with the documented process.
• Along the chain of effect, the auditor traces a risk through the treatment decision to the control, its evidence and the acceptance of the residual risk. How this chain is built is covered in the article on how to assess and treat risks under ISO 27005.
• During on-site observation, the auditor looks at screen locking, access control to premises and the handling of visitors.

Stage 1 and Stage 2 compared. Compiled by the KaitoSec Team based on ISO/IEC 17021-1 and published auditing rules of certification bodies.

Aspect	Stage 1 audit	Stage 2 audit
Key question	Is the ISMS documented and ready for Stage 2?	Is the ISMS implemented and effective?
Focus	Documentation, scope, planning of Stage 2	Records, interviews, observation in operation
Internal audit and management review	Checks whether both are planned and performed.	Checks whether their results have led to actions.
Annex A controls	Statement of Applicability and justifications	Evidence of application, by sampling
Location	On site or remote, as determined by the body	On site or remote under IAF MD 4 and as determined by the body
Outcome	Concerns and notes for preparing Stage 2	Findings and recommendation for the certification decision

With sampling, the auditor does not check everything, but every sampled item has to hold up. The DQS rules state: "Most findings are based on a sampling process" (our translation). A gap in the sample becomes a finding.

The information security officer is not the only one interviewed. The auditor talks to top management about Clause 5 (Leadership), to business units and to IT operations. Prepare these roles so they know where their evidence is kept.

Before Stage 2, the certification body sends an audit plan showing who will be interviewed on which topic and when. The audit starts with an opening meeting. In the closing meeting, according to the DQS rules, the audit team presents its findings and recommendation, and action plans are agreed where needed. The findings then go into the audit report, which forms the basis for your corrective action plan and for the certification decision.

Which documents and evidence should be ready before the ISO 27001 audit?

Before the certification audit, all documented information required by ISO/IEC 27001 in Clauses 4 to 10 should be ready, including the scope, risk assessment, Statement of Applicability (SoA) and the results of the internal audit and management review. Since February 2024, the standard also requires you to determine whether climate change is a relevant issue. For Annex A, evidence of application counts, not policies alone.

The table maps each clause to the evidence the auditor typically sees.

Clause	Typical evidence	What the auditor looks for
4.1/4.2 Context and interested parties	Assessment of internal and external issues and requirements, including climate change	Whether the climate question has been consciously decided
4.3 Scope	Documented scope with interfaces	Whether exclusions are justified and interfaces named
5.2 Information security policy	Approved policy	Whether it has been communicated
6.1.2/8.2 Risk assessment	Method and results	Whether results are repeatable and current
6.1.3/8.3 Risk treatment	Treatment plan, Statement of Applicability	Whether risk owners have approved the plan and the residual risk
6.2 Objectives	Documented information security objectives	Whether they are measurable, where practicable, and tracked
7.2 Competence	Evidence of competence	Whether training matches the role
9.1 Monitoring and measurement	Monitoring and measurement results	Whether results have been evaluated
9.2 Internal audit	Audit programme and audit results	Whether the programme covers the scope
9.3 Management review	Results of the management review	Whether decisions and resources are documented
10.2 Nonconformity and corrective action	Nature of nonconformities, actions taken, results	Whether causes were analysed and effectiveness reviewed

Two rows carry particular weight. The auditor bases their sampling on the Statement of Applicability, so it is worth looking at how the Statement of Applicability becomes a steering document. For the management review, the documented results are what count: which decisions the management review has to make.

The climate question comes from ISO/IEC 27001:2022/Amd 1:2024, which amends Clauses 4.1 and 4.2. According to the IAF-ISO Joint Communiqué, certification bodies include the new text in their audits "upon publication"; no full transition programme is planned. At a minimum, you need a traceable decision; if climate change is relevant, it belongs in the risk assessment and, where appropriate, in the objectives.

For every Annex A control declared applicable, evidence of application should be at hand, such as a log, a configuration, a ticket or a training record. A policy proves the requirement, not its application. A separate article explains how to track status and evidence for each control.

The auditor checks the version that was released for the audit. Clause 7.5.3 requires control of documented information, including control of changes, for example through version control. A date and an approval on the evidence make its state provable; an overwritten file proves no reference date.

What types of nonconformities exist in an ISO 27001 audit, and what do they mean?

ISO/IEC 17021-1 distinguishes major nonconformities, which affect the capability of the ISMS to achieve its intended results, from minor nonconformities, which do not. For a major nonconformity, the certification body must verify the correction and corrective action before the decision; if this is not possible within six months of Stage 2 in the initial audit, it conducts another Stage 2. Opportunities for improvement are not nonconformities.

Under ISO/IEC 17021-1, Clause 3.11, a nonconformity is the non-fulfilment of a requirement (basic concept: nonconformity). The note to the definition of a major nonconformity (3.12) gives two typical cases: significant doubt that effective process control is in place, or a number of minor nonconformities associated with the same requirement that together demonstrate a systemic failure. A minor nonconformity (3.13) does not affect the capability of the ISMS. The wording of the definitions is reproduced by the European co-operation for Accreditation in FAQ 35.10.

For the certification decision, Clause 9.5.2 clearly separates the two classes. For a major nonconformity, the body has reviewed, accepted and verified the correction and corrective action. For a minor nonconformity, a reviewed and accepted plan is sufficient; the auditor verifies implementation later, for example in the first surveillance audit.

For major nonconformities in the initial audit, Clause 9.5.3.2 applies: if the certification body cannot verify implementation within six months of the last day of Stage 2, it conducts another Stage 2 before its recommendation. The EA cites this rule in FAQ 36.14.

Class	Meaning	What the certification body requires before the decision	Reference
Major nonconformity	Affects the capability of the ISMS to achieve its intended results	Correction and corrective action reviewed and verified; in the initial audit within six months of the last day of Stage 2, otherwise another Stage 2	ISO/IEC 17021-1, 3.12, 9.5.2, 9.5.3.2
Minor nonconformity	Requirement not fulfilled, capability of the ISMS not affected	Accepted plan for correction and corrective action; implementation verified later	ISO/IEC 17021-1, 3.13, 9.5.2
Opportunity for improvement	Not a nonconformity, a note from the auditor	No corrective action under 9.4.9 required	ISO/IEC 17021-1, 9.4.5.2

Some certification bodies require more than this minimum rule. The DQS rules, for example, stipulate that all nonconformities must be resolved, or conditions fulfilled, before the certificate is issued. What applies to you is set out in your contract and in your body's auditing rules.

Auditors record opportunities for improvement but do not require a corrective action for them. Some bodies call them "observations" instead; that is not a category of its own in the standard. By the logic of the standard, minor nonconformities in the initial audit do not prevent certification, provided the body accepts the plan.

How should you handle nonconformities, and which deadlines apply?

You respond to each nonconformity with a root cause analysis, a correction and a corrective action, submitted within the deadline your certification body sets. ISO/IEC 17021-1 only requires that this deadline is defined; the standard does not specify a fixed number of days. For major nonconformities in the initial audit, the body must also verify implementation within six months of Stage 2, otherwise another Stage 2 follows.

Under ISO/IEC 17021-1, Clause 9.4.9, the body requests a root cause analysis and a description of the corrections and corrective actions within a defined time. How long that is, each body decides for itself. The DQS rules, for example, provide that the client plans corrective actions and implements them within a specified period; they list corrective actions not implemented on time as a reason for suspension. The certification rules of TÜV AUSTRIA Deutschland refer to a grace period for remedying deficiencies after a negative audit result.

Your deadline is stated in the audit report or in your body's auditing rules; in the closing meeting, clarify what you need to submit, in what form and by when.

In substance, handling nonconformities follows ISO/IEC 27001, Clause 10.2:

1. Correction: Eliminate the identified nonconformity itself, for example by supplying a missing piece of evidence.
2. Root cause analysis: Establish why the nonconformity occurred and whether it also occurs elsewhere.
3. Corrective action: Eliminate the cause so that the nonconformity does not recur.
4. Review effectiveness: Demonstrate that the corrective action works and retain the evidence.

A fictional example shows the difference: the access rights review is missing. The correction carries it out after the fact. The corrective action assigns an owner and a deadline in the action register so that it is not missed again.

If you submit only the correction, you risk the body not accepting the plan. Corrective actions from the audit, like any other measure, need a status, owner, deadline and evidence.

What happens after certification: surveillance audits and recertification?

The ISO 27001 certificate opens a three-year cycle. Under ISO/IEC 17021-1, the certification body must audit at least once per calendar year, with the first surveillance audit no later than twelve months after the certification decision. Before the third year ends, recertification follows and looks at the ISMS in full again.

The cycle starts with the certification decision, not with the last day of the Stage 2 audit. Surveillance audits follow in the first and second year after it, recertification in the third. The European co-operation for Accreditation (EA) sums up the basic rule as follows:

"in each calendar year, at least (the CB can have a stricter regime but not an 'easier' one), there shall be an audit, whether surveillance or recertification."

— European co-operation for Accreditation (EA), FAQ 37.12 on ISO/IEC 17021-1, Clause 9.1.3

In other words, a stricter audit rhythm is permitted, a looser one is not.

A surveillance audit does not cover the full scope. The auditor checks whether the ISMS works day to day: internal audits, management review, actions on nonconformities from the previous audit and changes (ISO/IEC 17021-1, 9.6.2.2). According to EA FAQ 35.10, the certification body also verifies the implementation of minor nonconformities from the initial audit, for example in the first surveillance audit.

Recertification takes place before the certificate expires. If it expires anyway, the certification body can restore it within six months under EA FAQ 36.14, provided the outstanding recertification activities are completed. Otherwise, at least a Stage 2 audit is required. Plan the date with your certification body early.

Check supplier certificates and older certificates for the version of the standard: since 31 October 2025, only certificates to ISO/IEC 27001:2022 are valid (IAF MD 26:2023).

Our cost article shows which costs for surveillance audits and recertification to expect over the cycle.

How do you prepare for the ISO 27001 certification audit in practice?

Prepare for the certification audit by choosing an accredited certification body, completing the internal audit and management review, working through open findings and mapping every piece of evidence to its clause or Annex A control. ISO/IEC 17021-1 requires the certification body to check in Stage 1 whether the internal audit and management review have been planned and performed. No tool replaces any of these decisions.

1. Check the certification body's accreditation in the DAkkS database and request the derivation of audit time in writing.
2. Align the certification body's audit plan with your interviewees and their availability.
3. Complete the internal audit across the entire scope before Stage 1.
4. Hold the management review before Stage 1 and document the decisions taken.
5. Work through open internal audit findings with cause, action and deadline.
6. Map each piece of evidence to its clause or Annex A control, date and approving person.
7. Clarify with each interviewee where their evidence is kept and how they will show it.

Software replaces neither the definition of the scope, nor the risk decision, nor the conversation with the auditor. Whether your ISMS is effective is demonstrated by people who know their evidence and can explain it.

For step 6, ISO 27001 in KaitoSec starts at the individual piece of evidence: each Annex A control has a dedicated workspace where you assign owners, attach evidence and track implementation status. The Statement of Applicability (SoA) brings together applicability, justification, implementation and evidence, and changes are versioned. If needed, your certification body receives limited read access to a released state of your ISMS evidence. Context, version and accountability stay attached to the evidence.

In policy management, once you publish a version you can see who has acknowledged it and who is still missing; you present this list in the audit. Through reporting for audits and management reviews, management reviews and Statements of Applicability are generated from the current state and stored with their author and timestamp.

Only the accredited certification body decides on the certificate. You can walk through what this looks like for your own scope with KaitoSec in a demo call.

Frequently asked questions about the ISO 27001 certification audit

How much time is there between Stage 1 and Stage 2?

ISO/IEC 17021-1 does not prescribe a fixed interval. The certification body sets it, taking into account whether findings from Stage 1 need to be resolved first. The certification rules of TÜV AUSTRIA Deutschland provide that Stage 2 can also follow directly after Stage 1, provided Stage 1 was completed successfully.

Does the internal audit have to be completed before the certification audit?

Yes, in practice it does. In the Stage 1 audit, the certification body evaluates whether internal audits and the management review are being planned and performed. ISO/IEC 27001, Clause 9.2, requires internal audits at planned intervals. You set the rhythm yourself in the audit programme; at least one cycle covering the entire scope should be completed before Stage 1.

Can the certification audit be done remotely?

Partly or largely, provided the certification body and the organization agree on the use of remote audit technology and the audit objectives remain achievable. The framework for using information and communication technology in audits is set by IAF MD 4:2025 (see IAF document list). Whether on-site visits are needed in addition is decided by the body based on scope and sites.

Can the auditor advise on how to resolve nonconformities?

No. Under the impartiality requirements of ISO/IEC 17021-1 (5.2.5), certification bodies must not offer or provide management system consultancy. The auditor names the nonconformity and the affected requirement without prescribing a solution. You develop the solution yourself or with external support that does not come from the certification body.

Is a certificate to ISO/IEC 27001:2013 still valid?

No. Under IAF MD 26:2023, the transition period ended on 31 October 2025; certificates to the 2013 version have since expired or been withdrawn. The climate change requirements added in 2024 (Amd 1), by contrast, required neither a separate transition nor a new certificate, according to the IAF.

Is a pre-audit worthwhile before certification?

A pre-audit can be useful, but it is voluntary and replaces neither Stage 1 nor Stage 2. Some certification bodies offer it as a dress rehearsal. It makes gaps visible, but here too the auditor does not develop solutions. The internal audit, which ISO/IEC 27001 requires anyway, serves a similar purpose.

Do the same rules apply to ISO 27001 based on IT-Grundschutz?

No, there is a separate certification scheme from the BSI for that. Under it, an auditor certified by the BSI reviews the reference documents and carries out an on-site inspection. The audit report then goes to the certification body within the BSI for review. Process and audit basis are governed by the BSI documents on the scheme.

Sources

1. FAQ 36.14: Corrections and corrective actions, European co-operation for Accreditation (EA), September 2018.
2. FAQ 37.12: ISO 17021-1:2015, clause 9.1.3, European co-operation for Accreditation (EA), March 2019.
3. FAQ 35.10: Definition of nonconformity, European co-operation for Accreditation (EA), March 2018.
4. IAF MD 26:2023, Transition Requirements for ISO/IEC 27001:2022, International Accreditation Forum (IAF), Issue 2, 2023.
5. IAF-ISO Joint Communiqué on the Addition of Climate Change Considerations, IAF and ISO, February 2024.
6. IAF Mandatory Documents (including IAF MD 1 and IAF MD 4:2025), International Accreditation Forum (IAF).
7. ISO/IEC 27006-1:2024, ISO/IEC, 2024.
8. ISO/IEC 27001:2022 Information security management systems, International Organization for Standardization (ISO), 2022, amended by Amd 1:2024.
9. ISO/IEC 17021-1:2015, Conformity assessment: Requirements for bodies providing audit and certification of management systems, ISO/IEC, 2015.
10. Suche nach akkreditierten Stellen (search for accredited bodies), Deutsche Akkreditierungsstelle (DAkkS).
11. DQS Auditierungs- und Zertifizierungsregeln (CF10) (DQS auditing and certification rules), DQS, as of June 2026.
12. Zertifizierungsordnung-MS (certification rules for management systems), TÜV AUSTRIA Deutschland GmbH, Rev. 04, October 2021.
13. Zertifizierungsschema ISO 27001 auf der Basis von IT-Grundschutz (certification scheme for ISO 27001 based on IT-Grundschutz), Bundesamt für Sicherheit in der Informationstechnik (BSI).
14. ISO/IEC 17021-1:2015 Section 9 (extracts from the standard), International Accreditation Service (IAS), secondary source for the cited clauses from Section 9.