The short answer
An ISO 27001 certification audit is carried out by an independent certification body in two stages: stage 1 reviews your ISMS documentation and readiness, and stage 2 tests whether it works in practice. The certificate lasts three years, with a surveillance audit in each of years two and three and a recertification audit before it expires.
On this page
- What types of ISO 27001 audit are there?
- How does the ISO 27001 certification audit cycle work?
- What happens in an ISO 27001 stage 1 audit?
- What happens in an ISO 27001 stage 2 audit?
- How are nonconformities graded and closed?
- What is an ISO 27001 surveillance audit?
- How long is an ISO 27001 certificate valid?
- How long does each ISO 27001 audit take?
- How do you prepare your team for the certification audit?
- Why Sovereign Secure
- Get ready for your ISO 27001 audit
An ISO 27001 audit, in the certification sense, is an independent certification body checking that your information security management system (ISMS) meets ISO/IEC 27001:2022. It runs in two stages. Stage 1 reviews the design and documentation; stage 2 tests whether the ISMS works. A pass leads to a three-year certificate, kept alive by surveillance audits in years two and three and renewed by a recertification audit.
Sovereign Secure Ltd is an ISO 27001-certified UK consultancy. We prepare clients for certification and run ISO 27001 internal audits, but we do not issue ISO certificates. Certification audits are carried out by an independent certification body, our partner MQA International, which makes its own certification decisions.
What types of ISO 27001 audit are there?
Three, and people mix them up. Only one of them leads to a certificate.
| Audit | Who carries it out | Purpose | Can the auditor advise you? |
|---|---|---|---|
| Internal audit (first party) | Your staff or an auditor you appoint | Clause 9.2: check your ISMS conforms and works | Yes |
| Customer or supplier audit (second party) | A customer auditing you, or you auditing a supplier | Check contract and security requirements | Depends on the contract |
| Certification audit (third party) | An independent certification body | Decide whether to grant or keep certification | No, impartiality rules prevent it |
ISO itself does not certify organisations; certification bodies do, working to ISO/IEC 17021-1 and, for information security, ISO/IEC 27006-1. ISO/IEC 17021-1 bars a certification body from offering management system consultancy, which is why preparation and certification come from separate organisations.
How does the ISO 27001 certification audit cycle work?
Certification runs in three-year cycles. The certification body plans an audit programme for the whole cycle at the start.
| When | Audit | What it decides |
|---|---|---|
| Year 1 | Stage 1 | Whether you are ready for stage 2 |
| Year 1 | Stage 2 | Whether to recommend certification |
| Year 1 | Certification decision | Made at the certification body by people who were not on the audit team |
| Year 2 | Surveillance audit 1 | Whether certification continues; held within 12 months of the certification decision |
| Year 3 | Surveillance audit 2 | Whether certification continues |
| Before expiry | Recertification audit | Whether to renew for another three years |
What happens in an ISO 27001 stage 1 audit?
Stage 1 checks that your ISMS is designed properly and ready to be tested. The auditor reviews your documented information and plans stage 2 around what they find.
Expect them to look at:
- the scope statement, and whether it makes sense for your business and the services customers ask about;
- the information security policy and objectives;
- your risk assessment method, risk register and risk treatment plan;
- the Statement of Applicability, and whether it matches the treatment plan;
- evidence that internal audits and management reviews are planned and being carried out;
- how well you understand the ISO 27001 requirements, your sites, processes and legal obligations.
The output is a stage 1 report listing any areas of concern that could be graded as nonconformities at stage 2. The gap before stage 2 is set with the certification body and should give you time to resolve those concerns. If your ISMS changes significantly in between, the certification body may need to repeat all or part of stage 1.
What happens in an ISO 27001 stage 2 audit?
Stage 2 tests whether the ISMS works as documented. It starts with an opening meeting, then interviews, observation and sampling of records, and ends with a closing meeting where the auditor presents findings and a recommendation.
Auditors follow an audit trail: from a risk in your register, to the control chosen to treat it, to that control’s entry in the SoA, to records proving the control operates. A gap anywhere along that trail is a finding.
What an ISO 27001 audit day looks like
Whether the audit lasts one day or several, each day follows a similar pattern. Certification bodies run them slightly differently, so check the audit plan they send you beforehand.
| Part of the day | What happens | Who should be there |
|---|---|---|
| Opening meeting | The lead auditor confirms the scope, the audit plan and timetable, how findings will be graded and reported, and who will guide the auditors | Top management, the ISMS owner and your guide |
| Interviews | Auditors ask top management, the ISMS owner and control owners how each process works in practice | The people who run each control, not a spokesperson |
| Evidence sampling | The auditor picks samples, such as a few leavers, access reviews, changes or incidents, and asks to see the records | Your guide, with access to the evidence store |
| Site walk-round | Where premises are in scope, auditors check physical controls such as entry, secure areas, clear desk and equipment disposal; remote audits may use a video tour instead | Facilities or office manager |
| Auditor review | The audit team reviews the evidence on its own and agrees any findings | Nobody from your side |
| Closing meeting | The lead auditor presents the findings, their grades and the recommendation, and explains the deadlines for corrective action | Top management and the ISMS owner |
On audits that run over several days, many auditors also give a short summary at the end of each day, so nothing in the closing meeting comes as a surprise. Interview questions are usually open and practical: how do you remove access when someone leaves, when did you last test a backup restore, how do you decide which risks to accept. Answer in your own words and show the record; an honest “I would need to check” is better than a guess.
| Area | What auditors typically sample |
|---|---|
| Leadership (clause 5) | Interviews with top management on objectives, resources and risk acceptance |
| Risk (clauses 6 and 8) | Risk assessments repeated at planned intervals or after change; treatment actions closed |
| Support (clause 7) | Training and awareness records, competence evidence, document control |
| Performance (clause 9) | Metrics, internal audit reports, management review minutes |
| Improvement (clause 10) | Nonconformity log, root causes, effectiveness checks |
| Access control (5.15 to 5.18) | Joiner and leaver records, access reviews |
| Suppliers (5.19 to 5.22) | Supplier assessments and contract terms |
| Incidents (5.24 to 5.27) | Incident records and lessons learned |
| Technical (8.8, 8.13, 8.15, 8.32) | Vulnerability scan or penetration test results and fixes, backup restore tests, logs, change records |
For 8.8 and 8.29, our guide to ISO 27001 penetration testing explains what evidence holds up.
How are nonconformities graded and closed?
Findings are graded by how much they affect the ISMS. Exact labels vary between certification bodies, but the structure is the same.
| Grade | Typical example | What must happen |
|---|---|---|
| Major nonconformity | No management review held; a whole clause not addressed; a control in the SoA that does not operate at all | Correction and corrective action verified by the certification body before certification is granted |
| Minor nonconformity | A few leavers’ accounts disabled late; one supplier review missed | Corrective action plan accepted by the certification body; implementation checked at the next audit |
| Opportunity for improvement | A manual process that works but could be stronger | Optional; no response required |
Under ISO/IEC 17021-1, if the certification body cannot verify the fixes for a major nonconformity within six months of the last day of stage 2, it must carry out another stage 2 before recommending certification. Each corrective action should address the root cause, not just the symptom, as clause 10.2 requires.
What is an ISO 27001 surveillance audit?
A surveillance audit is a shorter audit the certification body carries out at least once a calendar year between recertifications. The first must take place within 12 months of the certification decision.
Surveillance audits are not full system audits. They sample part of the ISMS and always review:
- internal audits and management review since the last visit;
- action taken on previous nonconformities;
- changes to scope, systems, sites or people;
- complaints received and how they were handled;
- progress against objectives and continual improvement;
- how you use the certification mark and refer to your certificate (our guide to the ISO 27001 logo rules explains what is allowed).
Missing a surveillance audit, or leaving major nonconformities unresolved, can lead the certification body to suspend or withdraw the certificate.
How long is an ISO 27001 certificate valid?
Three years, subject to passing both surveillance audits. The recertification audit takes place before the expiry date and reviews the whole ISMS, including how it has performed over the cycle.
Plan recertification early. If it is not completed before expiry, the certificate lapses. ISO/IEC 17021-1 lets a certification body restore it within six months once the outstanding work is done (after that, at least a stage 2 audit is needed), but you cannot claim certification for the gap.
How long does each ISO 27001 audit take?
Audit length is measured in auditor days, which the certification body sets from rules in ISO/IEC 27006-1. The main input is the number of people doing work within your ISMS scope, adjusted for the number of sites and the complexity of your technology, development and outsourcing.
| Audit | Typical length relative to the others | What changes it |
|---|---|---|
| Stage 1 plus stage 2 | The full initial audit time, split between the two stages | Headcount in scope, number of sites, ISMS complexity |
| Surveillance (each year) | Usually about a third of the initial audit time | Changes since the last audit, open nonconformities |
| Recertification | Usually about two thirds of the initial audit time | Performance over the cycle, changes in scope |
The certification body confirms audit days in its quote. Our guide to ISO 27001 certification cost shows how audit days drive the fees over the three-year cycle.
How do you prepare your team for the certification audit?
The best preparation is a working ISMS with records to prove it. On top of that:
- Close your internal audit findings first. Certification bodies expect a completed internal audit and management review before stage 2.
- Check the SoA matches the risk treatment plan. Auditors compare the two early, often at stage 1.
- File evidence by clause and control so any record can be found within minutes.
- Brief interviewees. Control owners should explain what they do, in their own words, and show the records. A short honest answer beats a guess.
- Name a guide who knows the ISMS, keeps the timetable and fetches evidence.
- Test remote audit tools if any part is remote, including screen sharing and access to your evidence store.
Our ISO 27001 checklist includes a stage 1 and stage 2 audit checklist. If you have not built the ISMS yet, start with the ISO 27001 implementation plan.
Why Sovereign Secure
- ISO 27001 certified ourselves, so we prepare for our own surveillance audits too.
- Formal assessment is our day job. We are a PCI SSC Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA) company, and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) 2026 to 2028, so we know how independent assessors sample evidence.
- Preparation and certification kept separate. We prepare you and run your internal audits; MQA International, an independent certification body, carries out the certification audits and decides on certification.
- UK company since 2012, headquartered in Accrington, Lancashire (Companies House 08334453).
Get ready for your ISO 27001 audit
Book an independent internal audit before stage 2 or your next surveillance visit, or ask our ISO 27001 consultancy team to prepare you for certification. Use the enquiry form or call +44 161 523 5276.
Your next step
- ISO 27001 checklistClause-by-clause readiness and a Stage 1 and Stage 2 audit checklist, free in Excel.Get the checklist
- Statement of Applicability templateAll 93 Annex A controls in a free spreadsheet, with a worked example.Get the SoA template
- Get an ISO quoteConsultancy from an ISO 27001-certified firm, with audits through our partner certification body, MQA International.Get an ISO quote
Last reviewed October 2026 by the Sovereign Secure assessment team.
