ISO 27001 Stage 1 Audit: What to Expect & How to Prepare

The primary goal of the Stage 1 audit is to verify that your ISMS documentation, policies, and procedures are properly designed and align with ISO 27001 requirements. The auditor assesses whether your organization has a solid foundation in place before proceeding to full certification, ensuring that essential elements such as risk assessments, control justifications, and compliance frameworks are properly structured.

Key Activities in the Stage 1 Audit

During the audit, the auditor will focus on several key areas:

• ISMS Documentation Review: Assessing policies, procedures, and other information security management documents to ensure completeness, accuracy, and compliance with ISO 27001 requirements.

• Scope Definition: Confirming that the scope of your ISMS is well-defined, including what’s covered and excluded (Clause 4.3).

• Risk Assessment & Risk Treatment: Reviewing your risk assessment methodology, criteria for conducting risk assessments, acceptable risk levels, and the assignment of risk owners (Clause 6.1.2).

• Statement of Applicability (SoA): Ensuring the justification for inclusion or exclusion of controls is documented and that controls align with your risk assessment (Clause 6.1.3).

• Walkthroughs: The auditor may conduct walkthroughs of your organization’s operations and infrastructure to gain a better understanding of how your ISMS is structured.

• Employee Competency & Training: Evaluating your training and awareness programs, including methods to measure their effectiveness (Clauses 7.2 & 7.3).

• Legal and Regulatory Compliance: Reviewing your legal register for completeness, ensuring it includes all applicable laws and regulations (Clause 4.2).

• Internal and External Communication Policies: Reviewing policies related to ISMS-related communication within and outside the organization (Clause 7.4).

• Monitoring and Measurement: Checking whether appropriate monitoring, measurement, and evaluation criteria are defined (Clause 9.1).

• Internal Audits & Management Review: Ensuring evidence of internal audits, auditor competency, and a documented management review process (Clauses 9.2 & 9.3).

• Non-Conformities & Corrective Actions: Confirming that your organization has a process for handling non-conformities and implementing corrective actions (Clause 10.2).