ISO 27001 Stage 1 vs Stage 2 Audits, and the Surveillance Years After

What is the difference between an ISO 27001 Stage 1 and Stage 2 audit?

Stage 1 is a readiness review of your documentation; Stage 2 is the certification audit of whether the management system described in that documentation actually operates. You need both to get a certificate, in that order, and once you have it the certification body returns every year for a surveillance audit until recertification in year three.

The whole cycle is run by an external certification body, not by ISO. ISO publishes the standard (ISO/IEC 27001:2022 is the current edition) and never audits anyone.

Stage 1: the documentation review

The auditor reads. The purpose is to confirm the information security management system (ISMS) exists on paper, covers the right scope and is mature enough for a full audit to be worth running. Expect the auditor to ask for:

• The ISMS scope statement and the context of the organization (clause 4)
• The information security policy and evidence of leadership commitment (clause 5)
• The risk assessment and risk treatment plan (clause 6)
• The Statement of Applicability (SoA), covered below
• Evidence that at least one internal audit and one management review have happened (clauses 9.2 and 9.3)
• The documented information the standard requires, under control and version-managed

For a small company it is often done remotely and takes one or two days. The output is a report listing areas of concern. They are not nonconformities yet; they are the things that would become nonconformities at Stage 2 if left alone.

The second stage: the certification audit

The auditor tests. Over several days, on site or by screen-share, the certification body samples evidence that each clause of the standard and each applicable Annex A control is implemented and effective. Access reviews from last quarter. The incident log and what was done about each entry. Onboarding records. Supplier contracts. Backup restore tests. Interviews with staff who have never read the policy and should still be able to describe the procedure.

Findings come in two weights. A minor nonconformity is a lapse in an otherwise working control, and you can be certified with a corrective action plan. A major nonconformity is a control missing or failed in a way that undermines the ISMS, and the certificate waits until it is closed and verified.

	Stage 1	Stage 2
Question answered	Is the ISMS designed and documented?	Does the ISMS operate and work?
Evidence	Documents and records	Samples, logs, interviews, observation
Typical gap between them	Weeks to a few months
Outcome	Readiness report	Certificate, or nonconformities to close

The Statement of Applicability

The SoA is the document both stages revolve around. Clause 6.1.3 requires it: a list of every control in Annex A (93 of them in the 2022 edition), a statement of whether each is applicable, the justification for including or excluding it, and whether it is implemented.

At Stage 1 the auditor checks that the SoA exists and that the exclusions make sense. At Stage 2 the auditor uses it as the test plan, because every control marked applicable and implemented is a control the auditor will sample. Marking a control applicable that you do not run is the most common self-inflicted Stage 2 finding we see, and it comes from copying someone else's SoA.

Surveillance years and recertification

A certificate runs three years. During years one and two the certification body conducts a surveillance audit, shorter than Stage 2, that checks a sample of the ISMS plus anything that changed and anything that was a finding last time. Internal audits and management reviews must have continued; the auditor will ask for them first. Year three brings a recertification audit that covers the whole system again and a new three-year certificate is issued.

What the cycle costs

Fees come from the certification body and from the preparation work, and they are separate lines. "Companies can expect to pay up to $40,000 during the audit preparation process, $15,000+ for the certification audit itself, and $10,000 per year for maintenance and surveillance audits," according to Secureframe's ISO 27001 cost guide, fetched 6 October 2026, which puts audit costs at "$~10-50k". If a penetration test is in your risk treatment plan, the same page says "The majority of pen tests cost between $5,000-$20,000, with the average being between $8,000-$10,000."

Certification body fees scale with headcount, number of sites and scope. Ask for a quote covering the full three-year cycle, not just Stage 1 and Stage 2, so the surveillance years are not a surprise. For the choice between this and a SOC 2 report, ISO 27001 vs SOC 2 sets them side by side.

Where AccuSights fits

We build the ISMS, write the SoA from the controls you run, perform the internal audit the auditor will ask for and sit with you through Stage 1 and Stage 2, with a named engineer rather than a ticket queue and implementation and remediation included. An accredited certification body issues the certificate; we prepare you for it and do not issue it ourselves. Start with the ISO 27001 framework page or book a free Risk Diagnosis and we will tell you how far you are from Stage 1.