The ISO 27001 audit cycle typically runs over three years. Stage 1 is a readiness review that examines your documentation and preparation. Stage 2 is the main certification audit, which assesses whether your Information Security Management System (ISMS) is implemented and operating effectively. After certification, surveillance audits in the following years check that the system remains in operation, while recertification reassesses the ISMS at the end of the cycle.
Understanding what each audit involves helps your organisation prepare for the right requirements at the right time, rather than treating every audit as if it were the first.
Why the ISO 27001 Audit Cycle Confuses People
ISO 27001 certification is not simply a one-time assessment. It involves a series of audits designed to establish whether your ISMS is appropriately designed, implemented and maintained over time.
The cycle has four main components:
Stage 1 audit
Stage 2 audit
Surveillance audits
Recertification audit
These audits are conducted by a certification body, which is separate from any consultant who helps your organisation implement its ISMS.
Each stage has a different purpose, and understanding those differences makes it easier to prepare, maintain evidence and keep your certification on track.
Stage 1: The Readiness Review
Stage 1 is the initial audit on the path to ISO 27001 certification. It focuses on whether your ISMS is adequately documented and ready for the more detailed Stage 2 assessment.
The auditor reviews areas such as:
The scope of your ISMS
Required documentation and policies
Your Statement of Applicability
The design of your information security management system
Your readiness to proceed to Stage 2
Think of Stage 1 as a check that the foundations are in place before the auditor examines how the system operates in practice.
This stage can identify gaps that need attention before Stage 2. Addressing those issues early helps your organisation prepare for a more detailed assessment.
A weak Stage 1 outcome can indicate that further work is needed before the organisation is ready to demonstrate effective implementation.
Stage 2: The Main Certification Audit
Stage 2 is the main audit used to determine whether your organisation meets the applicable ISO 27001 certification requirements.
At this stage, the auditor goes beyond documentation to assess whether the ISMS is implemented and operating effectively.
The assessment may include:
Interviewing staff about their responsibilities and security practices
Examining evidence that controls are operating
Reviewing risk management and treatment activities
Checking whether documented policies match actual practices
Assessing how the organisation monitors and improves its ISMS
This is where the difference between a documented management system and one that operates in practice becomes clear.
Having policies and procedures in place is not enough on its own. Your organisation needs evidence that the relevant processes and controls are being followed.
The certification decision depends on the audit outcome and the resolution of any findings in accordance with the certification body’s process.
Surveillance Audits: Years One and Two
Achieving ISO 27001 certification is not the end of the process. Surveillance audits help confirm that your ISMS continues to operate and improve after certification.
Under the typical three-year certification cycle, surveillance audits take place during the first and second years following the initial certification decision. They are generally narrower in scope than the initial certification audit, sampling relevant parts of the ISMS rather than repeating the entire assessment.
Auditors may look for evidence that your organisation has continued to manage security risks, review access, conduct internal audits, complete management reviews and address opportunities for improvement.
The purpose is to establish that your organisation has maintained its management system rather than allowing it to lapse after certification.
Organisations that maintain their ISMS through regular activities and documented evidence are generally better prepared for surveillance audits than those that only focus on compliance immediately before an audit.
Recertification: Year Three
At the end of the certification cycle, a recertification audit assesses whether your ISMS continues to meet the applicable requirements and whether certification can be renewed.
Recertification is more extensive than a typical surveillance audit. It reassesses the continuing effectiveness of the ISMS and considers changes, performance and ongoing suitability across the certification scope.
This can be challenging for organisations that have allowed their management system to drift since the initial certification audit.
If your organisation has maintained its risk assessments, controls, internal audits, management reviews and improvement activities throughout the cycle, recertification is more likely to be a continuation of established practices rather than a major rebuilding exercise.
How to Prepare for Each ISO 27001 Audit Stage
The practical approach is to prepare for what each audit is designed to assess.
Prepare Documentation for Stage 1
Confirm that your ISMS scope, policies, risk assessment, Statement of Applicability and other required documentation are in place and appropriate for your organisation.
Demonstrate Implementation for Stage 2
Ensure that controls are operating in practice and that you can provide evidence of their implementation. Staff should understand their responsibilities, and documented processes should reflect actual activities.
Maintain Evidence for Surveillance Audits
Keep security activities running throughout the year. Schedule reviews, track corrective actions, document risk treatment and retain evidence of ongoing ISMS operation.
Keep the ISMS Active Between Audits
Treat certification as an ongoing management responsibility rather than an annual preparation exercise. Regular monitoring and improvement help your organisation remain ready for surveillance and recertification.
Get Support Throughout the ISO 27001 Audit Cycle
Preparing for certification and maintaining an ISMS requires consistent attention to risk, documentation, controls and evidence.
Intrix’s virtual CISO services can help organisations establish and maintain their information security management practices across the certification cycle. Our cyber security risk assessment services can also help identify and prioritise risks that inform your ISMS.
For the official standard and its requirements, visit the ISO/IEC 27001 page.
Frequently Asked Questions
What Is the Difference Between Stage 1 and Stage 2?
Stage 1 reviews your ISMS documentation, scope and readiness for certification. Stage 2 assesses whether the ISMS is implemented and operating effectively. The certification decision follows the Stage 2 audit and the certification body’s review of the results.
What Do ISO 27001 Surveillance Audits Check?
Surveillance audits check that your ISMS continues to operate and improve after certification. They typically sample relevant parts of the system and review evidence of ongoing risk management, internal audits, management reviews and corrective actions.
How Often Is ISO 27001 Audited?
The typical certification cycle spans three years. It begins with Stage 1 and Stage 2 audits, followed by surveillance audits in the first and second years and a recertification audit towards the end of the cycle. Exact scheduling depends on the certification body’s arrangements and applicable requirements.
Is Recertification Harder Than the First Certification?
Not necessarily. Recertification reassesses the continuing effectiveness of the ISMS, so organisations that have maintained their system and evidence throughout the cycle are generally better prepared. Organisations that have allowed controls or processes to lapse may need significant work before the audit.
