Help centre
Preparing Evidence for an ISO 27001 Certification Audit
Stage 1 checks that your ISMS is designed and documented and that you are ready for Stage 2; Stage 2 tests whether the controls actually operate, by sampling records and interviewing the people who run them. Organise evidence the way the auditor will read it: by clause 4 to 10 and by each control in your Statement of Applicability, with documents kept apart from the records that prove they were followed. SecureRoot helps you prepare and supports you through both stages, but the accredited certification body runs the audit and decides on the certificate.
About this help article
Written by SecureRoot Risk Advisory LLP.
The certification body's side
What Stage 1 and Stage 2 look at
Certification bodies are accredited against ISO/IEC 17021-1, and for an ISMS also against ISO/IEC 27006. Under ISO/IEC 17021-1 the initial certification audit is one audit conducted in two stages. Before Stage 2, the certification body gives you documented conclusions from Stage 1 on your readiness, including any areas of concern that could become a nonconformity at Stage 2. That is your chance to fix them.
- 01
Stage 1: is the ISMS designed and ready?
Expect the auditor to read the scope statement, the policy and objectives, the risk method, risk register and treatment plan, the Statement of Applicability, the internal audit report and the management review minutes, and to talk with your people about readiness. They check that these agree with one another. Since 2024 they also check that you have decided whether climate change is relevant to your ISMS.
- 02
Stage 2: do the controls operate?
The auditor samples records, interviews control owners and looks for gaps between what the policy says and what teams do. Findings are raised as minor or major nonconformities, and a major one has to be closed before the certificate is issued.
The number of audit days is set by the certification body under its own accredited procedure and depends on your scope, including how many sites it covers.
Organising evidence
Organise evidence by clause and by control
- 01
Build one index that mirrors the auditor's route
One section for each of clauses 4 to 10, then one row for each Annex A control in your Statement of Applicability. Each row names the owner, the governing document and where the records live.
- 02
Record exclusions in the same index
For each control you excluded, keep the reason next to it, and make sure it matches the reason in the Statement of Applicability.
- 03
Link to the system of record
Point to the ticketing system, the identity provider or the compliance platform where the evidence is generated, rather than to screenshots copied into a folder. Evidence produced by normal operation is more convincing than evidence prepared for the audit.
- 04
Cover the period, not one good week
For recurring controls such as access reviews, log review, backup restore tests and training, keep every run since the control started, with dates.
Records versus documents
Documents say what you intend; records show it happened
A document sets a rule or a method: the policy, a procedure, the risk method, the Statement of Applicability. Documents are approved, versioned and updated when things change. A record is evidence that something took place: a completed access review, a closed change ticket, a restore test result, training completion, internal audit findings, management review minutes. Records are dated and not edited afterwards.
Stage 1 leans on documents. Stage 2 leans on records. A common failure is a strong document set with few records behind it, which usually means controls were written down but not yet run long enough to leave a trail.
Sampling
How sampling works, and how to be ready for it
- The auditor asks for a full population first, such as all joiners and leavers in the period, all production changes or all supplier contracts in scope, and then picks items from it.
- Be able to export each population quickly and completely. A list that looks edited raises more questions than a gap.
- For each sampled item, be ready to show the trail end to end: the request, the approval, the action and the check.
- Make sure the same fact agrees across systems. A leaver still in an active account list is a finding whatever the HR record says.
- The control owner, not the ISMS manager, should be able to explain the sample.
Our role
What SecureRoot does and does not do in the audit
SecureRoot prepares the evidence for the Stage 1 review, runs the internal audit and management review beforehand, supports you during the Stage 2 audit and helps close any findings raised. We are not the certification body: we do not audit you on its behalf, we do not decide on findings, and we do not issue the certificate.
Scope boundaries
What this does not cover
- SecureRoot is not an accredited certification body and does not issue ISO/IEC 27001 certificates.
- Nobody can guarantee the outcome of a certification audit; the certification body's auditors decide on what they sample.
- Producing records, running controls and answering auditor interviews stay with your own people.
- The certification body is contracted and paid by you directly.
Questions
Common questions
Does SecureRoot support us during the audit itself?
Yes, as your adviser. We support you during Stage 2 and help close findings, but the certification body runs the audit and makes the certification decision.
Primary Sources
Where the Figures on This Page Come From
Every deadline, threshold and control count above is taken from the instrument itself. These are links to the primary text, not to a summary of it.
- EA Certification Committee FAQs, questions on ISO/IEC 17021-1:2015 (two-stage initial audit, clauses 9.1.3.2, 9.3.1.2 and 9.3.3.1)
European co-operation for Accreditation · Link checked 2026-11-12
- Management Systems accreditation: ISO/IEC 17021-1:2015, and ISO/IEC 27006 for ISMS
National Accreditation Board for Certification Bodies (NABCB) · Link checked 2026-11-12
- Accreditation Criteria for Information Security Management Systems Certification, BCB 125 (Jan 2026), section 6 on audit time
National Accreditation Board for Certification Bodies (NABCB) · Link checked 2026-11-12
- IAF-ISO Joint Communiqué on Addition of Climate Change Considerations to MSS, with the IAF final decision (February 2024)
International Accreditation Forum · Link checked 2026-11-12
- Certification: ISO does not perform certification; certification bodies and accreditation
International Organization for Standardization (CASCO) · Link checked 2026-11-12
Related
Services and help that go with this
- ISO 27001 checklist
What each clause and control requires, and the evidence usually sampled.
- ISO 27001 certification services
Our programme, including audit support.
- ISO 27001 certification timeline
Where Stage 1 and Stage 2 fall in the programme.
- Understanding findings and retesting
If a penetration test is part of your evidence.
Audit coming up?
Tell SecureRoot your scope and your audit dates. We will review your evidence against the clauses and your Statement of Applicability before the certification body does.