The auditor reads the scope, the risk assessment, the Statement of Applicability, the policies and the records of internal audit and management review, and confirms that the system is designed and far enough along to be tested. It is often done remotely. The output is a list of areas of concern that could become nonconformities if they are left as they are.
Stage 2 normally follows within a few weeks to a few months; a long gap can mean Stage 1 has to be repeated. See Stage 2 audit and the implementation guide.
Read more
Related terms
- Stage 2 audit
- A Stage 2 audit is the main part of ISO 27001 certification, in which the certification body tests that the ISMS is implemented and operating as documented.
- Certification body
- A certification body is the independent organization that audits a management system against an ISO standard and issues the certificate when it conforms.
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.
- Information security management system
- An information security management system is the set of policies, processes and responsibilities an organization uses to manage information security risk.
- Statement of Applicability
- The Statement of Applicability is the mandatory ISO 27001 document listing which Annex A controls apply, which are excluded and why.