ISO 27001 for IT managers 7: survive Stage 1 and Stage 2 without theatre

Confirm what the audit will cover

Obtain the audit plan, scope, criteria, locations, attendees and secure evidence-sharing arrangements from the certification body. Check that the service and legal entity match your programme. Raise changes before the audit rather than surprising the auditor with a new site or outsourced operation.

Stage 1 examines readiness, including the management-system design and supporting information. Stage 2 evaluates implementation and effectiveness. They are not interchangeable, and a satisfactory Stage 1 is not certification. The certification body determines readiness, findings and the eventual certification decision through its process.

Agree timing based on the actual system. Leave space to address Stage 1 concerns before Stage 2. Do not assume every organisation needs the same number of audit days or that a fixed gap between stages guarantees success. Size, scope and complexity matter, and the certification body's proposal should explain the arrangement.

Prepare an index people can navigate

Create a concise evidence index grouped around scope, governance, risk/treatment, selected controls, performance, internal audit and improvement. Point to the authoritative records with version, owner and date. Confirm access before the audit and provide an alternative if the normal screen-sharing or document system fails.

Keep confidential records controlled. Agree redaction or supervised viewing where appropriate, while retaining enough evidence to assess the requirement. Never share passwords, private keys or recovery codes as proof of control. An auditor can inspect an access arrangement without becoming the custodian of its secrets.

Freeze a dated reference pack for the audit where useful, but keep operating the system. If something changes, identify the newer record and explain the sequence. Do not alter old minutes or approvals to make the reference pack appear more complete than it was.

Rehearse questions rather than scripted answers

Ask people to explain their own work in ordinary language. The goal is understanding, not memorising clauses. An IT engineer should be able to show how an update failure is escalated. A manager should explain who accepts residual risk. HR should explain how a leaver reaches IT.

If someone does not know an answer, they should say so and find the responsible owner. An invented answer can contradict the records and create a larger problem. Keep a shared request log so evidence promised during an interview is delivered and tracked.

Handle a sample you would not have chosen

Auditors may follow a record across systems or ask for another example. In fictional Merefield, the team prepares a recent leaver, but the auditor selects a privileged contractor instead. The account register and service list should let the team trace that case without relying on a special “audit folder”.

If a gap appears, explain the observed facts and immediate containment where needed. Do not delete the account history or quietly rewrite a procedure mid-interview. Record the issue and investigate it through the normal process. A disclosed gap is manageable; misleading evidence undermines confidence in the whole system.

When evidence is unavailable, distinguish why. A system outage, a missing retention decision and a record that never existed are different problems. Agree how and when supplementary evidence can be provided. Do not promise that later evidence will automatically remove a finding; the auditor and certification body assess it.

Manage each audit day

Have a coordinator, available subject owners and a way to obtain decisions without interrupting every employee. Protect ordinary service support so the organisation can still operate. Confirm the day's requests and emerging issues with the auditor at the agreed points; avoid a parallel running argument in the interview.

Use the opening meeting to confirm logistics and the closing meeting to understand conclusions. Ask for the criterion, objective evidence and classification of each finding. You can seek clarification or challenge a factual error respectfully with evidence. Use the certification body's formal process if a disagreement remains; do not try to negotiate away an observed failure through optimistic wording.

Leave with a precise action list

Record each finding, required response, owner, due date and evidence needed for closure. Ask which matters affect the certification decision and what further review is required. Do not assume a minor finding can be ignored, or that a major finding is resolved by submitting a plan alone. The specific closure process belongs to the certification body.

Stage 2 ending is not the same as a certificate being issued. Wait for the formal decision before making public claims. Once issued, check the scope, entity and dates, and follow the rules for certificate or mark use.

Your deliverable is the audit record and a controlled response plan. Part 8 shows how to complete corrective action and maintain the programme through surveillance rather than letting the evidence decay after the first successful audit.

Check your understanding