Guidance · Situation
The auditor arrives in six weeks
A Stage 1 or Stage 2 ISO 27001 audit is in the diary.
Why this moment is hard
Six weeks is enough to close the gaps an auditor reliably finds, and not enough to build what was never there. The risk is spending the time polishing documents while the scope, the exclusions or the people interviews let you down.
5 Guidance questions3 pack documents1 toolAbout 3 h 40 min of reading in all
This is a reading path, not a checklist. Nothing is ticked off or saved, and you can start at any step.
First, the decisions
Guidance · Regulation, audit and certification
When are we ready for the Stage 1 audit?Why here First decide honestly whether you are ready, and what would make you move the date.
Guidance · Regulation, audit and certification
How do we justify excluding an Annex A control?Why here Exclusions are the first thing a Stage 1 auditor reads in the Statement of Applicability.
Guidance · Regulation, audit and certification
How do we run an internal audit when we are small?Why here An internal audit has to have happened before certification, even a small one.
Guidance · Regulation, audit and certification
How do we prepare our people for auditor interviews?Why here People are interviewed, not only documents; prepare them without scripting them.
Guidance · Regulation, audit and certification
If the auditor raises a major nonconformity, then what?Why here Know in advance what you will do if a major nonconformity is raised.
Then, the documents
Checklist · P08-A05
Mandatory ISMS Documentation ChecklistWhy here Check every required document and record exists.
Template / Form · P08-A04
Statement of Applicability TemplateWhy here Make the Statement of Applicability defensible on inclusions and exclusions.
Guidance / Handbook · P08-A10
Stage 1 and Stage 2 Audit Preparation GuideWhy here What the certification body will ask, sample and challenge at each stage.
Finally, a tool
Tool
Where are our gaps? — ISO/IEC 27001 2022Why here A last pass over what you could not evidence, against the standard itself.
If your start looks different
- If the audit is further off and you want the whole ISO 27001 routeWe have decided to get ISO 27001 certified
Reading times are estimates: the words on each question's flow or document's preview at 220 words a minute, rounded up to the next five minutes. A tool shows its own time.