---
title: "Preparing for Your ISO 27001 Stage 2 Audit: A Practical Checklist"
canonical: https://www.grcmana.io/vault/iso-27001/stage-2-audit-checklist
published: 2026-08-24
updated: 2026-08-24
framework: "ISO 27001"
control: "Clause 9.2 Preparing for Your ISO 27001 Stage 2 Audit: A Practical Checklist"
journeyStage: audit
---

# Preparing for Your ISO 27001 Stage 2 Audit: A Practical Checklist

## Key Takeaways

Stage 2 tests whether your ISMS operates the way your documentation says it does — auditors sample evidence, not just policies.

- **Evidence window** — Auditors typically sample the last 3–6 months
- **Common finding** — Risk register not kept current after Stage 1

Stage 2 auditors are checking for operating effectiveness, not just documented intent. Expect them to ask for evidence — ticket trails, meeting minutes, access logs — that controls were actually followed during the audit period.

Run an internal audit and a management review before the external Stage 2 visit. Both are explicit requirements, and auditors will look for them as evidence the ISMS is self-correcting.

Brief control owners ahead of time. Auditors interview staff directly, and a control owner who cannot explain their own process is a more common nonconformity trigger than missing documentation.