When are we ready for the Stage 1 audit?

Start

Stage 1 is booked, or about to be

Stage 1 is the certification body's review of your documentation and of whether you are ready for Stage 2. It reads the scope, checks the required documents, checks that the Statement of Applicability follows from the risk assessment, and confirms that an internal audit and a management review have taken place. It is the cheapest place to find a problem, but only if the basics are already there.

• Then: Reassess readiness against the checklist this month

Step

Reassess readiness against the checklist this month

Score every clause requirement and applicable Annex A control from 0 (Not started) to 3 (Operating). When in doubt, take the lower score: it describes what an auditor could see today, not what is planned. Have a second person check the scores of the blocking items, because owners tend to score their own controls high.

• Then: Does every required document exist, approved and under control?

Decision

Does every required document exist, approved and under control?

Every document and record the standard requires must exist, be approved and be kept under document control. The scope, the policy, the risk assessment and treatment processes, the Statement of Applicability, the treatment plan and the objectives are the ones the certification body usually asks for first. A document with no approval, owner or review date is a common Stage 1 challenge. If you are not sure, answer no.

• Yes: Are the scope and the Statement of Applicability defensible?
• No, or not known: No-go: close the gap, then move Stage 1

Decision

Are the scope and the Statement of Applicability defensible?

The scope must be approved by top management and name its interfaces and every exclusion with a reason. The Statement of Applicability must trace every inclusion and exclusion to the risk assessment. Both are on the list of what the certification body tends to challenge at Stage 1: a scope it cannot map to real services, and a Statement of Applicability not traced to the risk assessment.

• Yes: Are a full internal audit and a management review complete?
• No, or not known: No-go: close the gap, then move Stage 1

Decision

Are a full internal audit and a management review complete?

The internal audit must cover the whole ISMS, and nobody may audit their own work. The management review must come after the audit, because the audit results are one of its inputs, and its minutes must show decisions. An audit run by the person who runs the ISMS, or a review held before the audit, will be challenged.

• Yes: Is every blocking item at least In place?
• No, or not known: No-go: close the gap, then move Stage 1

Decision

Is every blocking item at least In place?

Blocking items are the requirements without which Stage 2 cannot pass: the scope, the policy, risk assessment, risk treatment, objectives, the internal audit programme, management review results, and nonconformity and corrective action. For Stage 1 each must be at least In place: documented and working, even with few records yet. If a score is not known, answer no.

• Yes: Does the earliest Stage 2 estimate fall by the booked date?
• No, or not known: No-go: close the gap, then move Stage 1

Decision

Does the earliest Stage 2 estimate fall by the booked date?

Stage 1 is only worth holding if Stage 2 can follow. Work out the earliest Stage 2 date as the latest of three: when the last gap is In place, when the last blocking item has had the operating period of records (the pack's default is 3 months), and when the internal audit and management review are done. Compare it with the booked Stage 2 date.

• Yes: Send the documents the certification body asked for
• No, or not known: Tell the sponsor now: add resource, narrow scope or move dates

Step

Send the documents the certification body asked for

Many certification bodies ask for the documents some weeks before Stage 1; the pack's typical figure is 2 to 4 weeks. Expect also an organisation chart for the scope, the list of legal, regulatory and contractual requirements, the asset inventory, the supplier list and the headline measures so far. Confirm the Stage 1 plan with the body.

• Then: Go: confirm Stage 1 at the management review

Outcome

Go: confirm Stage 1 at the management review

Record the go decision in the management review minutes, with the checks it rests on. Treat anything Stage 1 raises as a nonconformity in waiting: give each area of concern an owner and a date, and close it before Stage 2.

Outcome

No-go: close the gap, then move Stage 1

Move Stage 1 rather than go in with gaps. A Stage 1 that finds missing documents costs a second Stage 1. Put each failed condition in your gap tracker with an owner and a date, and agree new dates with the certification body early, because auditors are booked weeks or months ahead.

Outcome

Tell the sponsor now: add resource, narrow scope or move dates

If the estimate falls after the booked Stage 2 date, tell the executive sponsor the same month and decide between adding resource, narrowing the scope and moving the date. Do not wait for Stage 1 to decide for you. Narrowing the scope after Stage 1 is expensive, so if the scope is to change, change it before Stage 1, and only so far as it still passes every scope test.