Stage 1 / Stage 2 audit.

Accredited certification against a management system standard such as ISO/IEC 27001 is not a single visit. The certification body runs an initial audit in two distinct stages, and they answer two different questions. Stage 1 asks whether the management system exists and is ready to be audited. Stage 2 asks whether it actually works in practice. Treating these as one continuous exam is the most common way teams get surprised, because the two stages reward completely different kinds of preparation.

What stage 1 actually checks

Stage 1 is a readiness and documentation review, typically the shorter of the two. The auditor reads your core documents, confirms the scope is coherent, and looks for the mandatory artefacts the standard requires. For an ISMS that means the Statement of Applicability, the risk assessment and treatment process, the security policy, internal audit and management review records, and evidence that the system has been running long enough to produce data. The deliverable is not a certificate. It is a written summary of findings and any areas of concern that you are expected to close before stage 2.

In practice stage 1 is your early warning system. The auditor flags gaps while there is still time to fix them. Teams that read those findings as a to-do list arrive at stage 2 prepared. Teams that file them and move on are the ones that struggle later.

What stage 2 verifies

Stage 2 is the operational evidence audit, and it is usually longer. The auditor moves from "does the policy say so" to "show me it happened". They sample records, interview the people who run the controls, trace incidents and access reviews through to closure, and test whether the documented process matches daily reality. This is where the Statement of Applicability gets cross-checked against real operating evidence, and where weak controls that looked fine on paper come apart.

Stage 1 vs stage 2 at a glance

What practitioners do between the two visits

The window between stage 1 and stage 2 is the real work. Findings from stage 1 are not non-conformities yet, so there is no formal corrective action plan, but they are the auditor telling you exactly where stage 2 will probe. Strong teams convert each stage 1 observation into an owner, an action and a deadline, then make sure the evidence that closes it lives in the records the auditor will sample. They also keep the system running normally rather than staging a one-off cleanup, because stage 2 looks for sustained operation, not a tidy snapshot.

Where stage 2 does raise a non-conformity, the response is the same discipline a surveillance audit expects: classify it honestly as major or minor, plan corrective action with a deadline, and address the root cause rather than the symptom. The certification decision follows once the certification body is satisfied those actions hold.