Guidance · Situation
The auditor arrives in six weeks
A Stage 1 or Stage 2 ISO 27001 audit is in the diary.
Why this moment is hard
Six weeks may be enough to close some of the gaps an auditor commonly finds, but it is not enough to produce months of records for a system that has not been running. The risk is spending the time polishing documents while the scope, the exclusions or the people interviews let you down.
5 Guidance questions3 pack documents1 toolAbout 3 h 40 min of reading in all
This is a reading path, not a checklist. Nothing is ticked off or saved, and you can start at any step.
First, the decisions
Guidance · Regulation, audit and certification
When are we ready for the Stage 1 audit?Why here First decide honestly whether you are ready, and what would make you move the date.
Guidance · Regulation, audit and certification
How do we justify excluding an Annex A control?Why here A Stage 1 auditor reads the Statement of Applicability, and every exclusion in it needs a reason.
Guidance · Regulation, audit and certification
How do we run an internal audit when we are small?Why here A certification body expects an internal audit, even a small one, to have been done before the Stage 2 audit.
Guidance · Regulation, audit and certification
How do we prepare our people for auditor interviews?Why here People are interviewed, not only documents; prepare them without scripting them.
Guidance · Regulation, audit and certification
If the auditor raises a major nonconformity, then what?Why here Know in advance what you will do if a major nonconformity is raised.
Then, the documents
Checklist · P08-A05
Mandatory ISMS Documentation ChecklistWhy here Check every required document and record exists.
Template / Form · P08-A04
Statement of Applicability TemplateWhy here Make the Statement of Applicability defensible on inclusions and exclusions.
Guidance / Handbook · P08-A10
Stage 1 and Stage 2 Audit Preparation GuideWhy here What the certification body will ask, sample and challenge at each stage.
Finally, a tool
Tool
Where are our gaps? — ISO/IEC 27001 2022Why here A last pass over what you could not evidence, against the standard itself.
If your start looks different
- If the audit is further off and you want the whole ISO 27001 routeWe have decided to get ISO 27001 certified
Reading times are estimates: the words on each question's flow or document's preview at 220 words a minute, rounded up to the next five minutes. A tool shows its own time.