ISO 27001 Audit Preparation: How to Pass Your Certification Audit

Understanding the ISO 27001 Certification Audit

The ISO 27001 certification audit is conducted by an accredited certification body and consists of two stages. Understanding what to expect at each stage is crucial for a successful outcome.

Stage 1 Audit: Documentation Review

The Stage 1 audit (also called the "desktop review") focuses on your ISMS documentation. The auditor verifies that:

What Auditors Check

• ISMS scope is clearly defined
• Information Security Policy is approved by top management
• Risk assessment methodology is documented
• Risk assessment has been conducted
• Statement of Applicability (SoA) is complete
• Risk treatment plan exists
• Internal audit has been performed
• Management review has been conducted
• Security objectives are defined and measurable

How to Prepare

1. Organize your document library – Use a logical folder structure with version control
2. Ensure all mandatory documents exist – See our ISO 27001 checklist
3. Verify document approval – Every policy needs a signature and date
4. Check cross-references – Documents should reference each other consistently
5. Prepare a document matrix – Map each ISO 27001 clause to your documents

Common Stage 1 Findings

• Missing or incomplete SoA justifications
• Risk assessment not covering all assets in scope
• No evidence of management review
• Internal audit not covering all clauses
• Security objectives not measurable

Stage 2 Audit: Implementation Verification

Stage 2 typically happens 1-4 weeks after Stage 1. The auditor verifies that your documented ISMS is actually implemented and effective.

What Auditors Do

• Interview staff at various levels about security awareness
• Review evidence of control implementation
• Test controls by requesting demonstrations
• Sample records to verify ongoing operations
• Walk through processes like incident management and access provisioning

Key Areas of Focus

People & Awareness

Auditors will speak with random employees to verify:

• They know the Information Security Policy exists
• They understand their security responsibilities
• They know how to report security incidents
• They have received security awareness training

Preparation: Ensure all staff have completed awareness training and can answer basic questions.

Access Control

• How are access rights granted and revoked?
• Is there a formal access provisioning process?
• Are access rights reviewed periodically?
• Is privileged access separately managed?
• Is multi-factor authentication in use?

Preparation: Have evidence of access reviews, provisioning requests, and revocation records.

Incident Management

• How are incidents reported?
• Show evidence of recent incident handling
• Is there a severity classification system?
• Are lessons learned documented?

Preparation: Even if no real incidents occurred, have the process documented and tested via tabletop exercises.

Change Management

• How are changes to systems and infrastructure managed?
• Is there a change approval process?
• Are changes tested before deployment?
• Are emergency changes handled differently?

Supplier Management

• How are suppliers assessed for security?
• Are security requirements in contracts?
• Is there ongoing supplier monitoring?

Use our Supplier Risk Manager to maintain supplier assessments.

Handling Audit Findings

Types of Findings

• Major Nonconformity: A significant failure to meet a requirement. Must be resolved before certification.
• Minor Nonconformity: A minor gap that doesn't undermine the ISMS. Must be resolved within a set timeframe (usually 90 days).
• Observation: A recommendation for improvement. No action required but noted.
• Opportunity for Improvement: Suggestions that could enhance the ISMS.

Response Strategy

1. Don't argue – Acknowledge the finding professionally
2. Ask for clarification – Ensure you understand exactly what's expected
3. Provide root cause analysis – Show you understand why the gap exists
4. Present a corrective action plan – With specific actions, owners, and dates
5. Implement promptly – Don't wait until the deadline

30-Day Audit Preparation Timeline

Week 1: Documentation Review

• Review all mandatory documents for completeness
• Update any outdated policies (anything over 12 months old)
• Verify the SoA is current and justified
• Ensure risk assessment is up to date

Week 2: Evidence Collection

• Gather evidence of control implementation
• Collect training records and awareness materials
• Prepare access review records
• Compile incident logs and response records

Week 3: Internal Readiness Check

• Conduct a pre-audit self-assessment using our Internal Audit Checklist
• Brief key staff on the audit process
• Prepare an audit schedule with room bookings
• Identify escorts for the auditor

Week 4: Final Preparations

• Address any gaps found in the self-assessment
• Conduct refresher awareness sessions
• Prepare opening and closing meeting presentations
• Ensure all documentation is accessible and organized

Tips from Experienced Auditors

1. Be honest – Auditors appreciate transparency over perfection
2. Have evidence ready – Don't make auditors wait while you search for documents
3. Assign an audit liaison – One person to coordinate logistics and requests
4. Prepare your staff – They should know what to expect but not be coached on answers
5. Show continuous improvement – Evidence of learning and adapting impresses auditors
6. Don't over-document – Quality over quantity; don't create documents just for the audit

Post-Audit: Surveillance and Recertification

After certification:

• Surveillance audits occur annually (covering part of the ISMS)
• Recertification audit happens every 3 years (full scope)
• Continual improvement evidence is expected at every audit

Conclusion

Successful audit preparation is about demonstrating that your ISMS is a living, working system – not just a set of documents. Start preparing at least 30 days before your audit using this guide and our free audit preparation tools.