---
title: "ISO 27001 certification process: from Stage 1 to your certificate"
canonical: https://www.grcmana.io/vault/iso-27001/certification-process
published: 2023-09-01
updated: 2026-10-20
author: "Harry West"
framework: "ISO 27001"
control: "Guide ISO 27001 certification and audit process"
journeyStage: fundamentals
---

# ISO 27001 certification process: from Stage 1 to your certificate

## Key takeaways

The ISO 27001 certification process runs in two audit stages: a Stage 1 readiness review of your documented ISMS, then a Stage 2 audit that tests whether it operates. An accredited certification body grades findings, issues a three-year certificate and returns for surveillance audits in years two and three before recertification.

- **Who certifies** — An independent certification body, never ISO itself. In the UK, choose one accredited by UKAS for ISO 27001, and confirm a certificate on the free UKAS CertCheck database.
- **Stage 1 audit** — A readiness review of your documented ISMS: scope, risk assessment, Statement of Applicability, internal audit and management review. Serious gaps are logged as areas of concern and delay Stage 2.
- **Stage 2 audit** — The main assessment. The auditor samples records, interviews owners and observes practice to confirm the ISMS operates as written. A major nonconformity blocks the certification recommendation until it is closed.
- **Three-year cycle** — The certificate runs for three years. Surveillance audits in years two and three sample the system, and a full recertification audit before expiry starts the next cycle.

The customer contract says "ISO 27001 certified by Q3". You have a policy set, a risk register and a calendar invite from a certification body, and no clear picture of what happens between now and the certificate.

This guide walks through the [ISO 27001](https://www.grcmana.io/vault/iso-27001) certification process step by step, for founders and compliance leads at UK firms with 25–250 staff. It covers choosing a certification body, the Stage 1 and Stage 2 audits, how findings are graded and closed, and what the three-year cycle asks of you afterwards.

The process is more predictable than its reputation. Every stage has a defined purpose, and almost every surprise is visible in advance.

## How does the ISO 27001 certification process work?

The ISO 27001 certification process is a two-stage external audit run by an independent certification body.

- **Stage 1** reviews your documented ISMS and readiness.
- **Stage 2** tests whether the ISMS operates in practice.

If no major nonconformity remains open, the body issues a certificate valid for three years, with surveillance audits in between.

ISO writes the standard but never certifies anyone. Certification bodies do the auditing. The rules they follow come from ISO/IEC 17021-1, the general standard for bodies that certify management systems. [ISO/IEC 27006-1:2024](https://www.iso.org/standard/82908.html) adds the rules specific to information security.

Those scheme rules are why the process looks broadly the same whichever reputable body you choose. The sequence below is the shape almost every UK certification follows:

| Step | What happens | What it asks of you |
| --- | --- | --- |
| Readiness | You build and operate the ISMS, then run an internal audit and a management review | A working system with records, not just documents |
| Choose a body | You select an accredited certification body and agree scope and audit days | A clear scope statement and headcount |
| Stage 1 | Readiness review of the documented ISMS | Documents, risk work and the first cycle of review |
| Stage 2 | Full assessment of the ISMS in operation | Records, interviews and observed practice |
| Decision | The body reviews the audit report and decides on certification | Accepted corrective action plans for any findings |
| Surveillance | Shorter audits in years two and three | Evidence the system kept running |
| Recertification | Full reassessment before the certificate expires | The same standard of evidence as Stage 2 |

## How do you choose a certification body for ISO 27001?

Choose a certification body accredited for ISO 27001 by UKAS, the UK's national accreditation body, or by an equivalent body recognised internationally. Accreditation means the auditor's competence and impartiality are themselves checked. Then compare audit days, auditor experience in your sector, scheduling and how the body handles remote auditing.

Outside the UK, look for a national accreditation body that has signed the [Global Accreditation Cooperation's Multilateral Recognition Arrangement](https://iaf.nu/en/news/global-accreditation-cooperation-incorporated-launch-unifies-international-accreditation-organisations-and-strengthens-worldwide-trust/). That arrangement replaced the International Accreditation Forum's own on 1 January 2026, and accreditations issued under the old arrangement are still recognised. Examples you may meet as a UK firm include:

- **ANAB** in the United States
- **DAkkS** in Germany
- **COFRAC** in France
- **INAB** in Ireland
- **RvA** in the Netherlands
- **JAS-ANZ** in Australia and New Zealand

Accreditation from any signatory is recognised as equivalent under the arrangement. That matters when your preferred certification body is based overseas, or when a buyer abroad asks who accredited your certificate.

The difference between certification and accreditation trips up many first-time buyers. [UKAS describes the relationship](https://www.ukas.com/accreditation/about/accreditation-vs-certification/) simply: certification bodies are the checkers, and UKAS checks the checkers. Only the certification body is "accredited". Your organisation holds certification, and when the body is accredited for ISO 27001, you hold accredited certification.

That distinction matters commercially. Enterprise procurement teams and public-sector buyers often specify accredited certification, and they verify it.

A certificate nobody can verify is a claim, not evidence.

Buyers can check a UK certificate on UKAS CertCheck, a free public database for verifying UKAS-accredited management system certification. Internationally, [IAF CertSearch](https://www.iafcertsearch.org/), set up by the former International Accreditation Forum, lets anyone search by company name or certificate number to confirm that a certificate is valid and issued under accreditation. Run your shortlisted bodies through the same check before you sign.

Once you have a shortlist of accredited bodies, these questions separate them:

- **Audit days.** How many days will Stage 1, Stage 2 and each surveillance audit take for your headcount and scope? Audit time is set by scheme rules, so a quote far below the others deserves a question.
- **Auditor fit.** Has the lead auditor worked with cloud-native or software businesses at your scale?
- **Remote auditing.** Which activities can run remotely, and which need someone on site?
- **Scheduling.** How far ahead are auditors booked, and how quickly can a major nonconformity be re-verified?
- **Transfer terms.** What happens if you need to move to another body mid-cycle?

Cost is a fair comparison point too, but it follows audit days more than anything else. Our [ISO 27001 certification cost guide](https://www.grcmana.io/vault/iso-27001/certification-cost) breaks down what drives the fee.

## What happens at the ISO 27001 Stage 1 audit?

The ISO 27001 Stage 1 audit is a readiness review, mostly of documented information. The auditor confirms your scope, reads the risk assessment, Statement of Applicability and core policies, and checks that an internal audit and management review have taken place. Serious gaps are recorded as areas of concern and can delay Stage 2.

Stage 1 is where the auditor learns what your ISMS claims to be. Expect a review of:

- the [ISMS scope statement](https://www.grcmana.io/vault/iso-27001/clause-4-3-determining-the-scope-of-the-information-security-management-system), and whether it matches the services you sell;
- the information security policy and objectives;
- the risk assessment method, the latest risk assessment and the risk treatment plan;
- the [Statement of Applicability](https://www.grcmana.io/vault/iso-27001/clause-6-1-actions-to-address-risks-and-opportunities), with a justification for every included and excluded Annex A control;
- the records of at least one internal audit and one management review;
- the evidence that documents are controlled, approved and current.

Our list of [ISO 27001 mandatory documents](https://www.grcmana.io/vault/iso-27001/documents) sets out exactly what the standard requires you to hold.

Stage 1 does not formally raise nonconformities. A gap that would grade as a major at Stage 2, such as a missing risk assessment, is logged as an area of concern instead. Enough of them, or one serious enough, and the body will not schedule Stage 2 until they are resolved.

Stage 1 isn't a rehearsal. It's the auditor deciding whether Stage 2 is worth scheduling.

The gap between the stages exists so that you can close what Stage 1 found. Treat the Stage 1 report as a precise work list, and plan the interval so there is time to act on it. How long that interval is depends on the body and on what was found.

## What happens at the ISO 27001 Stage 2 audit?

The ISO 27001 Stage 2 audit is the main certification audit. The auditor tests whether the ISMS you documented at Stage 1 operates in practice: sampling records, interviewing control owners and observing how work is done. Findings are graded as major nonconformities, minor nonconformities or opportunities for improvement.

Stage 2 moves from what your documents say to what your organisation does. Auditors gather evidence in three ways:

- **Interviews.** Leaders, control owners and staff explain how a process runs. The auditor listens for whether the answer matches the written procedure.
- **Record sampling.** The auditor picks real items from a population, such as a handful of joiners and leavers, a set of changes or an incident, and traces each one through its records.
- **Observation.** The auditor watches practice where it can be seen, from how a screen is locked to how a production change is approved.

At a firm of 25–250 people, the samples are small. A handful of joiners or two incidents is a visible fraction of the whole, so one missing record stands out.

An auditor can't sample a control that only exists in a policy.

The questions follow a simple pattern. First the auditor asks what you do, then how you do it, then for the evidence that you did it.

Typical questions sound like these:

- "Walk me through how a new risk gets onto the register and who decides what to do about it."
- "Show me the last three people who left, and when their access was removed."
- "How do staff report a security event, and what happened to the last one reported?"

Short, honest answers backed by a record beat long explanations. Auditors aren't trying to catch you out. They need enough evidence to support their recommendation.

The phrase "ISO 27001 audit" covers two different things, and both appear in the certification process. The Stage 2 audit is an external certification audit run by the certification body. Your [ISO 27001 internal audit](https://www.grcmana.io/vault/iso-27001/clause-9-2-internal-audit) is a Clause 9.2 requirement you run yourself, and the external auditor will sample its programme and results.

At the closing meeting, the auditor presents the findings and a recommendation. The certification body then makes the certification decision, based on the audit report and your response to any findings.

## How are nonconformities handled in an ISO 27001 audit?

Nonconformities are graded by severity. A major nonconformity is a missing or broken requirement that means the ISMS cannot be relied on, and it blocks certification until it is closed and verified. A minor nonconformity is an isolated lapse, accepted with a corrective action plan. Opportunities for improvement carry no obligation.

The grades come from scheme rules, not auditor style, so reputable bodies apply them in much the same way. Auditors still differ at the margins, most often on record-keeping findings.

| Grade | What it means | Typical example | What happens next |
| --- | --- | --- | --- |
| Major nonconformity | A required element is missing, has collapsed in practice or fails so broadly the ISMS can't be relied on | No management review has ever taken place | Certification is withheld until the major is closed and verified |
| Minor nonconformity | A real but isolated breach of a requirement | One leaver's access removed late, against an otherwise sound process | Certification proceeds with an accepted corrective action plan; closure is checked at the next visit |
| Opportunity for improvement | Something works but could work better | A risk register that could link more clearly to the treatment plan | No obligation, though an ignored opportunity can harden into a finding |

Minors are graded one by one but read together. Several minors against the same requirement, or the same kind of failure across different controls, can be rolled up into a major, because the pattern shows the system is failing rather than an individual.

Closing a finding takes three steps:

1. **Correction.** Fix the specific instance the auditor found.
2. **Root cause analysis.** Establish why it happened, past "human error" to the process that allowed it.
3. **Corrective action.** Change the process so the failure cannot recur, and check for the same weakness elsewhere.

Auditors reject closures that fix the instance without addressing the cause. A major typically has to be closed with evidence within a window the certification body sets, often around 90 days, sometimes with a follow-up visit. The discipline is the same one ISO 27001 asks of you every day under [Clause 10.2 nonconformity and corrective action](https://www.grcmana.io/vault/iso-27001/clause-10-2-nonconformity-and-corrective-action).

## What happens after ISO 27001 certification?

After certification, the certificate is valid for three years. The certification body returns for surveillance audits in years two and three, which sample the ISMS and always cover incidents, corrective actions, internal audit and management review. Before the certificate expires, a recertification audit reassesses the whole system and starts a new three-year cycle.

Surveillance audits are shorter than Stage 2, but they use the same grading scale. A major nonconformity found at surveillance can lead to suspension of a certificate you already hold, and an unresolved minor from a previous visit is itself graded up.

The areas a surveillance auditor always looks at are the ones that prove the system is alive:

- the [internal audit programme](https://www.grcmana.io/vault/iso-27001/clause-9-2-internal-audit) and what it found since the last visit;
- the minutes and outputs of your [management review](https://www.grcmana.io/vault/iso-27001/clause-9-3-management-review);
- how incidents were handled and what was learned;
- whether corrective actions from earlier findings were completed and verified;
- changes to the business, the scope or the technology estate.

Scope changes need attention between audits. If you add a service, acquire a company or move to a new platform, tell the certification body before the next visit, because the certificate only covers what its scope says.

A certificate is a three-year commitment, not a one-day pass.

Some firms run the ISMS as part of daily work, with evidence produced by the tools they already use. For them, surveillance becomes routine. Firms that rebuild their evidence each spring find every visit feels like Stage 2 again.

## How long does the ISO 27001 certification process take?

For a firm that already operates its ISMS, the external certification process typically takes two to four months from booking Stage 1 to receiving the certificate. The larger variable is readiness before Stage 1: building and running the ISMS long enough to produce records usually takes a further three to nine months.

The audit stages themselves are short. The time goes on the weeks between them and on the readiness work before them. The table below shows typical durations by starting point.

| Starting point | Readiness before Stage 1 | Stage 1 to certificate | Typical total |
| --- | --- | --- | --- |
| ISMS designed and operating, records in place | Little or none | 2–4 months | 2–4 months |
| Policies written, little operating evidence | 3–6 months | 2–4 months | 5–10 months |
| Starting from scratch | 6–9 months | 2–4 months | 8–13 months |

Booking matters more than most firms expect. Certification bodies schedule auditors weeks or months ahead, so contact them as soon as the ISMS is running, not when it is finished.

If you don't yet know which row describes you, an [ISO 27001 gap analysis](https://www.grcmana.io/vault/iso-27001/gap-analysis) will tell you. Our [ISO 27001 implementation roadmap](https://www.grcmana.io/vault/iso-27001/implementation) then shows how to sequence the readiness work so the audit stages follow without a rush.

## Frequently asked questions

### Can you fail the ISO 27001 Stage 2 audit?

Not in the sense of a single pass or fail mark. A Stage 2 audit that finds a major nonconformity ends without a certification recommendation, and the certificate is withheld until you close the major with evidence the auditor accepts. If the window set by the certification body passes without closure, you may need to repeat part or all of the audit.

### Can ISO 27001 certification audits be carried out remotely?

Partly, and often substantially. Accredited certification bodies may use video interviews, screen sharing and remote document review, provided they follow IAF MD 4, the mandatory document on using information and communication technology in audits. Physical controls, such as office access or equipment storage, may still need an on-site visit, so agree the split with your body before Stage 1.

### Can you change certification body during the three-year cycle?

Yes. Accredited certificates can be transferred between accredited bodies, and the new body reviews your existing certificate, recent audit reports and any open nonconformities before accepting it. Transfer is usually simplest straight after a surveillance audit, when nothing is outstanding. Ask the new body for its transfer process before you give notice to the current one.

### Is ISO 27001 certification the same as ISO 27001 accreditation?

No. Your organisation is certified, while the certification body that audits you is accredited by a national accreditation body such as UKAS. People often search for "ISO 27001 accreditation" when they mean certification. What buyers usually want to see is accredited certification: a certificate issued by an accredited body, which they can verify on UKAS CertCheck.

### What does the ISO 27001 certificate actually cover?

The certificate covers only what its scope statement names: the entities, services, locations and systems inside your ISMS boundary. Enterprise buyers read that wording closely, so a scope limited to one office or department may not reassure them about the service they are buying. Scope is set by Clause 4.3 and agreed with the certification body before Stage 1.