ISO 27001 Audit: What to Expect and How to Prepare

An ISO 27001 audit evaluates whether an organization’s Information Security Management System meets applicable requirements and whether the management system is actually operating as intended.

That second part matters.

An ISO 27001 audit is not simply a document review. An auditor may examine policies and procedures, but they can also interview employees, sample records, inspect evidence, trace risks to controls, review completed activities, and evaluate whether the organization is doing what its ISMS says it does.

For organizations pursuing ISO 27001 certification, the external certification process generally includes a Stage 1 audit followed by a Stage 2 audit. Once certification is achieved, surveillance audits occur during the certification cycle, followed by recertification.

But external certification audits are only part of the picture.

ISO 27001 also requires organizations to conduct their own internal audits as part of evaluating and continually improving the ISMS.

Understanding the difference between these audits, what auditors actually look for, and how to prepare can make the process considerably more useful and less stressful.

What Is an ISO 27001 Audit?

An ISO 27001 audit is a systematic evaluation of an organization’s ISMS against defined audit criteria.

Depending on the type of audit, those criteria may include:

• ISO/IEC 27001 requirements;
• the organization’s own policies and procedures;
• ISMS objectives;
• risk treatment decisions;
• the Statement of Applicability;
• applicable legal, regulatory, or contractual requirements;
• internal control requirements.

The purpose isn’t simply to determine whether documents exist.

The auditor is trying to determine whether the management system conforms to applicable requirements and, depending on the audit, whether it is effectively implemented and maintained.

That means an audit may follow a trail through multiple parts of the ISMS.

For example:

Risk identified → treatment decision → control selected → procedure established → control operated → evidence retained → performance evaluated

If that trail breaks down, the auditor may investigate why.

The Main Types of ISO 27001 Audits

Organizations implementing ISO 27001 will typically encounter several types of audits.

Audit Type	Primary Purpose
Internal audit	Evaluate the ISMS internally and identify conformity or problems
Stage 1 certification audit	Evaluate readiness and key elements of the management system
Stage 2 certification audit	Evaluate implementation and operation of the ISMS for certification
Surveillance audit	Periodically evaluate the certified ISMS after certification
Recertification audit	Evaluate the ISMS before renewal of certification

These audits serve different purposes.

Treating them as interchangeable can lead to poor preparation.

What Is an ISO 27001 Internal Audit?

The internal audit is part of the organization’s own ISMS.

Its purpose is to provide information about whether the management system conforms to the organization’s own requirements and the requirements of ISO 27001, and whether it is effectively implemented and maintained.

An internal audit should therefore be more than a rehearsal for the certification audit.

It is a management tool.

A good internal audit can identify:

• processes that aren’t operating as documented;
• controls that aren’t producing expected evidence;
• unclear responsibilities;
• outdated risk decisions;
• incomplete records;
• recurring control failures;
• inconsistent processes;
• gaps between policy and actual practice;
• opportunities to improve the ISMS.

The goal shouldn’t be to achieve a perfect internal audit report.

Finding a legitimate problem internally gives the organization an opportunity to understand and correct it.

That is one of the reasons internal audit exists.

Does the Internal Auditor Have to Be Independent?

Internal auditors need sufficient objectivity and impartiality for the audit process.

That does not necessarily mean an organization must maintain a separate internal audit department solely for ISO 27001.

Smaller organizations may use another qualified employee or an external resource.

The important issue is avoiding situations where someone is effectively auditing their own work without sufficient independence.

For example, asking the person responsible for designing and operating the entire risk management process to independently audit that same process creates an obvious objectivity problem.

Organizations should consider competence as well.

An auditor needs enough understanding of ISO 27001, auditing practices, the organization, and the subject matter being evaluated to perform a meaningful audit.

What Happens During a Stage 1 ISO 27001 Audit?

For organizations pursuing certification, Stage 1 is the first formal stage of the certification audit.

Stage 1 helps the certification body understand the organization and evaluate whether it is sufficiently prepared to proceed to Stage 2.

The exact activities can vary depending on the organization and certification body, but Stage 1 typically focuses heavily on understanding the ISMS and its readiness.

Areas likely to receive attention include:

• ISMS scope;
• organizational context;
• information security policy;
• risk assessment methodology;
• risk assessment and treatment;
• Statement of Applicability;
• information security objectives;
• documented information;
• internal audit;
• management review;
• readiness for Stage 2.

Stage 1 can reveal significant gaps before the more detailed Stage 2 assessment.

That is useful.

An organization should not view Stage 1 as an administrative formality that must simply be passed.

It is an opportunity to determine whether the ISMS is genuinely ready for deeper evaluation.

What Happens During a Stage 2 ISO 27001 Audit?

Stage 2 goes much deeper into the implementation and operation of the ISMS.

The auditor is no longer primarily trying to understand what the organization designed.

They need evidence of what the organization actually does.

That may involve:

• interviewing process and control owners;
• examining records;
• sampling evidence;
• reviewing risk treatment;
• tracing controls to the Statement of Applicability;
• evaluating ISMS processes;
• reviewing security activities;
• examining corrective actions;
• reviewing monitoring and measurement;
• evaluating internal audit and management review;
• determining whether documented processes are followed.

This is where the difference between documented and operating becomes critical.

A policy might say that access is reviewed quarterly.

During Stage 2, an auditor can ask:

When was the last review performed?

Who performed it?

Which systems were reviewed?

What evidence exists?

Were inappropriate accounts identified?

What happened to them?

How are exceptions handled?

A written statement that access is reviewed is not the same thing as evidence that the control operates.

What Do ISO 27001 Auditors Look For?

Auditors are not simply looking for a particular collection of templates.

They are evaluating a management system.

One useful way to understand the process is to think in terms of traceability.

Can the organization explain how important decisions flow through its ISMS?

Consider a security risk involving privileged access.

An auditor might trace:

Risk → risk evaluation → treatment decision → necessary control → Statement of Applicability → control owner → procedure → operation → evidence → monitoring

Each part of that chain should make sense.

The same principle can be applied to supplier risk, vulnerability management, incidents, backups, security awareness, physical security, or other parts of the ISMS.

This is why an organization with fewer but well-integrated processes can sometimes be better prepared than an organization with an enormous library of polished documents that aren’t reflected in actual operations.

What Evidence Might an ISO 27001 Auditor Request?

There is no universal evidence package that applies identically to every organization.

Evidence should reflect the organization’s own ISMS, scope, risks, controls, and processes.

Examples might include:

Area	Possible Evidence
Risk management	Risk assessments, risk register, treatment decisions
Access management	Access requests, approvals, access reviews
Awareness	Training records, completion reports
Vulnerability management	Scan results, remediation records, exceptions
Supplier security	Assessments, approvals, monitoring records
Incident management	Incident records, investigations, corrective actions
Change management	Change requests, approvals, testing
Backup	Backup records, monitoring, restoration tests
Internal audit	Audit plan, working papers, findings, report
Management review	Meeting records, inputs, decisions, actions
Corrective action	Findings, root cause analysis, remediation evidence
Monitoring	Metrics, reports, trends, management decisions

The best evidence is usually created naturally through operation of the process.

Organizations get into trouble when they treat evidence as something that needs to be manufactured specifically for an audit.

If a control has operated consistently, evidence should normally already exist.

What Is Audit Sampling?

Auditors generally cannot examine every transaction, user account, supplier, system change, security incident, or control activity that occurred during the audit period.

They use sampling.

For example, if the organization completed 500 user access requests, an auditor may select a sample and evaluate whether the required process was followed.

The auditor might examine whether:

• access was appropriately requested;
• approval occurred;
• access granted matched the request;
• privileged access received additional scrutiny;
• records were retained.

This creates an important lesson for audit preparation:

A good sample should not be the only part of your process that works.

Organizations sometimes focus heavily on assembling a handful of perfect examples.

That misses the point.

The underlying process should operate consistently enough that the organization is comfortable with an auditor selecting records rather than only reviewing examples chosen in advance.

What Are ISO 27001 Audit Findings?

When an auditor identifies a problem, the result depends on what was observed and the audit criteria.

In certification audits, nonconformities are generally categorized according to their significance.

Major Nonconformity

A major nonconformity indicates a significant problem with the management system or its ability to achieve intended results.

Examples might include a required management system process being substantially absent or a systemic breakdown affecting an important requirement.

Minor Nonconformity

A minor nonconformity is a failure to meet a requirement that does not rise to the level of a major systemic breakdown.

A process might generally exist and operate, for example, but a particular requirement may not have been consistently satisfied.

Observations and Opportunities for Improvement

Depending on the audit and certification body, auditors may also identify observations or opportunities for improvement.

These should not automatically be treated as nonconformities.

The terminology and reporting practices can vary.

The important point is that an audit finding should lead to understanding, not panic.

If a legitimate nonconformity exists, the organization should determine what happened, address the problem, and consider whether the underlying cause requires broader corrective action.

A Finding Is Not Automatically a Failure

Organizations sometimes approach ISO 27001 audits with one objective:

Get zero findings.

That can create the wrong behavior.

People become defensive.

Evidence gets overprepared.

Employees are coached to avoid saying anything that might reveal a problem.

Issues that should be discussed openly are hidden.

That works against the purpose of a management system.

An audit is supposed to help determine whether the ISMS conforms and operates as intended.

If a process is broken, finding the problem is useful.

The important question is what the organization does with it.

A healthy ISMS should be able to identify weaknesses, correct them, and improve.

How to Prepare for an ISO 27001 Audit

Good audit preparation begins long before the auditor arrives.

The objective should not be to create a temporary version of the ISMS that looks good for a week.

It should be to confirm that the actual management system is ready to be evaluated.

1. Confirm Your ISMS Scope

Everyone involved should understand what is inside the ISMS boundary.

Review the formal scope statement and confirm that it still reflects the organization.

Pay particular attention to:

• locations;
• services;
• systems;
• organizational units;
• processes;
• dependencies;
• interfaces with activities outside the scope.

A vague or outdated scope creates problems throughout the audit.

2. Review Your Risk Assessment

Make sure the risk assessment reflects the current environment.

Ask:

Are the risks still relevant?

Have important systems or suppliers changed?

Have new threats emerged?

Have treatment decisions been completed?

Are risk owners clear?

Are accepted risks actually approved according to the organization’s process?

The risk assessment should be a management tool, not a historical artifact created at the beginning of the ISO project.

3. Review the Statement of Applicability

The Statement of Applicability should align with the organization’s current control environment.

Check whether:

• necessary controls are represented;
• inclusion decisions are justified;
• Annex A exclusions are justified;
• implementation status is accurate;
• controls align with risk treatment decisions.

The SoA should tell the same story as the rest of the ISMS.

4. Verify That Controls Are Operating

Don’t stop at documentation.

Select important controls and trace them yourself.

For each control, ask:

Who owns it?

What is supposed to happen?

How frequently?

When did it last happen?

What evidence was produced?

Were exceptions identified?

What happened to those exceptions?

If those questions are difficult to answer internally, an auditor may have the same difficulty.

5. Review Required ISMS Processes

Make sure important management system activities have actually occurred.

Depending on where you are in the implementation cycle, this may include:

• risk assessment;
• risk treatment;
• monitoring and measurement;
• internal audit;
• management review;
• corrective action;
• information security objective tracking.

Do not schedule these simply to check a box before certification.

They should produce useful information about the ISMS.

6. Complete a Meaningful Internal Audit

Your internal audit should challenge the ISMS.

It should not simply confirm that every requirement looks good.

Audit actual processes.

Sample evidence.

Interview owners.

Identify inconsistencies.

Trace risks to controls.

Look for places where documentation and practice differ.

Finding weaknesses before the certification audit gives the organization time to understand and address them.

7. Conduct Management Review

Management review should provide leadership with meaningful information about the ISMS.

It should not consist of a meeting invitation and a slide stating that everything is fine.

Leadership should be able to evaluate performance, changes, risks, audit results, objectives, corrective actions, and opportunities for improvement.

Decisions and resulting actions should be captured.

8. Address Open Corrective Actions

Review findings from:

• internal audits;
• security incidents;
• control monitoring;
• risk assessments;
• previous audits;
• management reviews.

Open issues aren’t automatically disqualifying.

What matters is whether the organization understands them and is managing them appropriately.

An ignored issue is more concerning than a documented problem with a credible corrective action underway.

9. Prepare Control Owners

People who operate important processes should understand their responsibilities.

They do not need memorized scripts.

In fact, overly scripted responses can make an audit more difficult.

A control owner should be able to explain:

• what they do;
• why they do it;
• how frequently it occurs;
• what evidence is created;
• what happens when something goes wrong.

If the process genuinely operates, that conversation should be relatively natural.

10. Organize Evidence

Evidence should be accessible.

That doesn’t mean building an enormous audit folder containing every record the organization has ever created.

It means knowing where relevant records are located and being able to retrieve them efficiently.

A simple evidence index can help map processes and controls to their primary evidence sources.

Don’t Create an Audit-Only ISMS

One of the worst habits an organization can develop is allowing ISO 27001 to operate on an audit calendar.

Three months before the audit, everything becomes urgent.

Policies are updated.

Risks are reviewed.

Evidence is collected.

Controls suddenly receive attention.

Management review is scheduled.

Internal audit is completed.

Then the certification audit ends and the ISMS becomes quiet again.

That is the opposite of what a management system is supposed to accomplish.

A healthier model operates throughout the year.

Risk changes → controls operate → evidence accumulates → performance is monitored → problems are identified → management reviews results → improvements are made

The audit then evaluates a system that already exists.

It doesn’t create the system.

Questions an ISO 27001 Auditor Might Ask

Exact questions will vary, but organizations should be comfortable answering questions such as:

About scope

What does your ISMS cover?

How were the boundaries determined?

What important dependencies exist outside the scope?

About risk

How do you identify information security risks?

How are risks evaluated?

Who can accept risk?

Show me an example of a risk that resulted in a treatment decision.

About controls

Why is this control necessary?

Who owns it?

How does it operate?

How do you know it occurred?

What happens when it fails?

About performance

How do you know whether the ISMS is achieving its objectives?

Which metrics does management review?

What has changed because of those results?

About improvement

What did your last internal audit identify?

What corrective actions resulted?

What security incidents have led to changes?

What has the organization improved during the last year?

These are not trick questions.

They test whether the management system makes sense.

Common ISO 27001 Audit Preparation Mistakes

Waiting Until the Audit to Collect Evidence

Evidence should result from normal operation.

If records cannot be located, determine whether the problem is organization, retention, or whether the activity occurred at all.

Coaching Employees With Scripts

Employees should understand their processes, not memorize approved answers.

Auditors can ask follow-up questions.

Understanding holds up better than scripting.

Hiding Known Problems

An organization does not demonstrate maturity by pretending nothing ever goes wrong.

A documented problem with appropriate corrective action can demonstrate that the management system works.

Updating Documents Without Updating Processes

Changing a policy immediately before an audit can create a new problem if actual practices no longer match the document.

Documentation and operation need to remain aligned.

Treating Internal Audit as a Checklist Exercise

A weak internal audit can create false confidence.

Use internal audit to challenge the system before an external auditor does.

Assuming the Auditor Wants a Specific Template

ISO 27001 defines requirements.

It does not require every organization to use identical spreadsheets, policies, risk registers, or GRC platforms.

The organization needs to demonstrate that its approach meets applicable requirements.

Overloading the Auditor With Evidence

More evidence is not automatically better.

Provide what is requested and what is necessary to demonstrate the process.

Dumping hundreds of unrelated files into an audit portal can create confusion rather than confidence.

ISO 27001 Audit Readiness Checklist

Before a certification audit, an organization should be able to answer yes to questions such as:

• Is the ISMS scope current and understood?
• Is the risk assessment current?
• Are risk treatment decisions documented?
• Is the Statement of Applicability current?
• Are necessary controls implemented as represented?
• Are important controls actually operating?
• Can control owners explain their responsibilities?
• Is operational evidence available?
• Have information security objectives been monitored?
• Has the internal audit been completed?
• Have internal audit findings been addressed appropriately?
• Has management review occurred?
• Are corrective actions being managed?
• Are policies and procedures consistent with actual practice?
• Can the organization explain how risks connect to controls?
• Can the organization demonstrate continual improvement?

A “no” answer doesn’t automatically mean certification is impossible.

It identifies an area that deserves attention before the audit.

ISO 27001 Audit Frequently Asked Questions

What is an ISO 27001 audit?

An ISO 27001 audit evaluates an organization’s Information Security Management System against defined audit criteria, which can include ISO 27001 requirements and the organization’s own ISMS requirements.

What is the difference between Stage 1 and Stage 2?

Stage 1 focuses on understanding the ISMS and evaluating readiness for the more detailed certification assessment. Stage 2 evaluates the implementation and operation of the management system in greater depth.

Is an internal audit required before ISO 27001 certification?

Internal audit is a required part of the ISO 27001 management system. Organizations pursuing initial certification should ensure that the required internal audit activities have been performed as part of establishing and evaluating the ISMS.

Who can perform an ISO 27001 internal audit?

The organization determines how to provide appropriate objectivity, impartiality, and competence. Depending on the organization, internal audits may be performed by qualified internal personnel or external resources.

What evidence does an ISO 27001 auditor need?

Evidence depends on the organization’s ISMS and the area being audited. Examples include risk records, access reviews, training records, vulnerability results, supplier assessments, incident records, internal audit reports, management review records, and corrective actions.

What happens if an auditor finds a nonconformity?

The organization needs to address the nonconformity according to the applicable audit and corrective action process. The response generally involves correcting the issue where appropriate, understanding its cause, taking corrective action, and demonstrating that the issue has been addressed.

Does an ISO 27001 audit only review the 93 Annex A controls?

No. ISO 27001 includes management system requirements in Clauses 4 through 10. Annex A controls are only part of the broader ISMS.

Can you fail an ISO 27001 audit?

Significant or unresolved nonconformities can prevent or delay certification. The certification decision depends on the results of the certification body’s audit and its certification process.

The Best ISO 27001 Audit Preparation Happens Before the Audit

The strongest audit preparation is not a frantic evidence collection exercise.

It is an ISMS that has been operating consistently.

If risks are reviewed, controls operate, evidence is retained, internal audits challenge the system, management evaluates performance, and problems lead to corrective action, the certification audit becomes much easier to approach.

You are not trying to manufacture an audit-ready organization.

You are demonstrating the management system you already operate.

If you’re still building that system, start with our ISO 27001 Implementation Guide: A Practical Roadmap for Building Your ISMS.

For a deeper understanding of the control environment an auditor may evaluate, see ISO 27001 Controls: A Practical Guide to Annex A.