Chapter 10 of 13 · Months 4–6
Stage 1, Stage 2 and What Comes After
- How do I prepare for my first ISO 27001 audit?
- What is the difference between stage 1 and stage 2?
- What happens after we pass?
A certification audit for ISO/IEC 27001 or ISO/IEC 42001 happens in steps. Knowing what each step checks stops you over-preparing for one and under-preparing for the other.
| Step | What it checks | What to have ready |
|---|---|---|
| Stage 1 | Your documentation, scope and understanding of the requirements; whether you are ready for stage 2 | Scope, policies, risk assessment, Statement of Applicability, internal audit and management review records |
| Stage 2 | Whether the system is implemented and effective, including risk management and controls | Evidence that controls ran, people who can explain their work, records across the period |
| Surveillance | Yearly checks that the system still conforms and works | Evidence of ongoing operation, closed corrective actions |
| Recertification | A full check before the end of the three-year cycle | The whole system, again |
Before stage 1
- Confirm the scope in writing: which locations, teams, systems and services are in.
- Make sure your Statement of Applicability matches your risk treatment decisions.
- Run at least one internal audit across the scope, and act on what it finds.
- Hold a management review with real decisions recorded.
- Read your own documents as if you were the auditor. Fix contradictions.
Between stage 1 and stage 2
Stage 1 often ends with areas of concern. Treat each one as a deadline. Stage 2 will look at whether you addressed them. This is also the time to walk each control owner through what they may be asked.
The question you might not ask out loud
What if we are not ready for stage 2?
Talk to your certification body early. Moving a date is better than going in unready. A stage 2 with many serious findings costs more time than a short delay.
Rule of thumb:A certificate covers the scope written on it. Check the scope statement carefully before it is issued, and never describe the whole company as certified if only part of it is.
During the audit
Keep a simple log of every evidence request: what was asked, who is fetching it, and when it was sent. Answer what was asked, not more. If something cannot be found, say so and say when you will know. Meet the auditor briefly at the end of each day to hear what they found, so nothing in the closing meeting is a surprise.
After certification, the work continues. Surveillance audits come each year, and the certificate runs on a three-year cycle with recertification before it ends. Plan your internal audits and management reviews around that calendar.
Sources
- TÜV NORD, ISO/IEC 27001 certification (stage 1, stage 2, surveillance, three-year cycle) (read 2026-11-14)
- TÜV NORD, ISO/IEC 42001 certification (AI management system; certification cycle) (read 2026-11-14)
- ISO/IEC JTC 1/SC 27 Journal 2025, Issue 1 (93 controls in ISO/IEC 27002:2022; how the SoA works) (read 2026-11-14)