ISO 27001 stage 1 and stage 2 audits

Certification is two audits, not one. Stage 1 reads your documents and tells you what will stop you. Stage 2 tests whether the management system actually runs. They are booked together, priced separately, and fail for completely different reasons.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

Stage 1 is a documentation and readiness review. It takes one to two days, is usually remote, and costs $3,000 to $8,000 CAD. Stage 2 is the evidence audit, takes two to eight days depending on headcount and sites, and costs $9,000 to $25,000 CAD. The two are normally separated by two weeks to three months. Stage 1 cannot certify you and it cannot fail you either. Its output is an audit plan for stage 2 and a written list of what will block it, which makes it the cheapest advice a certification body will ever give you.

What is the difference between stage 1 and stage 2

Stage 1 asks whether the management system exists and is coherent. Stage 2 asks whether it operates and whether anybody follows it. That distinction decides everything else about the two visits: who gets interviewed, what gets sampled, what a finding means and what it costs to be wrong.

Both numbers come from audit day tables rather than from a sales conversation, which is why the day count is the only figure worth comparing between two bodies. How those days are derived, and which parts of a quote are genuinely negotiable, is set out line by line on the itemised certification cost page.

What actually happens on a stage 1 audit day

It is a reading exercise with interruptions. The auditor has usually had your documents for a week and arrives with questions already written down.

1. Opening meeting, twenty minutes. Confirmation of scope, the audit plan, confidentiality, and who is available on the day.
2. The scope statement, first and at length. The auditor is testing whether the wording that will appear on the certificate matches the organization they are looking at, and whether anything has been carved out that cannot be.
3. The Statement of Applicability, control by control for the exclusions. Every exclusion is a question they write down for stage 2.
4. Risk assessment and risk treatment plan, checked for a method that is repeatable and for risk owners who are real people.
5. Internal audit report and management review minutes. Both must have happened. This is the single most common reason a stage 1 concludes that stage 2 should be moved.
6. A walk through your sites, systems and headcount to confirm the audit day calculation, because a scope larger than the one quoted changes the price.
7. Closing meeting. You are told what will block stage 2, and you are given the stage 2 audit plan naming the areas, the days and the people.

How long can we leave between stage 1 and stage 2

Two weeks at the fast end, three months at the comfortable end. The certification body sets the interval and has to justify it, and the reasoning runs both ways. Too short and you cannot close what stage 1 raised. Too long and the documents the auditor read are no longer the documents you are running, at which point parts of stage 1 have to be repeated at your cost.

The interval is also where the operating period gets fixed. Stage 2 samples records over a window, and a window of three weeks produces three weeks of evidence. If stage 1 reveals that your access reviews started last month, the useful decision is to move stage 2 out by a quarter rather than to arrive with one review to sample. Whether you are far enough along to book at all is the subject of the readiness page, and it is a cheaper question to answer before the stage 1 invoice than after it.

What the stage 2 auditor does differently

Stage 2 is sampling, and the sample is drawn from your own claims. Every control marked implemented in the Statement of Applicability is a request for evidence, and the auditor picks which ones without telling you in advance.

• Interviews rather than documents. The auditor asks the engineer who runs the access review to show it, not the person who wrote the procedure. Answers that do not match the document are the finding, and it usually goes against the document.
• Population and sample. Give the auditor a list of the twelve joiners this year and they will pick four and ask for the screening record, the signed agreement and the training completion for each. One missing record in a sample of four is a finding you cannot fix on the day.
• Trace one incident end to end. Detection, ticket, assessment, response, lessons learned, and whether the risk register moved as a result. This single trace tells an auditor more than a day of reading.
• Physical scope, in person. If an office is in scope, someone looks at it. If nothing physical is in scope, say so in the scope statement rather than hoping it is not asked about.
• Technical vulnerability management. The scan schedule, the remediation timeline against your own policy, and whether an independent penetration test exists and whether the findings from it went through the same process as everything else.

The closing meeting gives you every nonconformity in writing, graded major or minor, and the auditor's recommendation. The recommendation is not the decision. An independent reviewer inside the certification body makes the certification decision, which is why the certificate arrives two to eight weeks after the audit rather than on the day. What the grades mean, how long you have to close each, and what happens if you do not, is covered on major and minor nonconformities.

When you should move stage 2 rather than sit it

Most published advice on this subject assumes you should push on. Frequently you should not, and the certification body would rather you moved it than failed it, because a rescheduled audit costs them nothing and a stage 2 that produces four majors costs them a follow-up visit and an argument.

Move stage 2 if any of the following is true on the day the auditor asks for dates. You have not completed an internal audit covering the whole management system. No management review has been held with the clause 9.3 inputs. Your recurring controls have run once rather than on their stated frequency. A significant part of the scope changed in the last month, such as a new cloud region or an acquisition. Or the person who built the system has left and nobody can answer for it in an interview.

The counter-case is worth stating too, because postponement is not free. Every month of delay is another month of consultant retainer, another month the deal that funded the project is not closed, and a stage 1 that ages past three months starts to need redoing. If the only gap is a thin evidence window and that window closes in six weeks, sitting the audit six weeks late beats moving it a quarter.

What the two audits cost together in Canada

For a Canadian company under 250 staff, the certification body portion of initial certification is $15,000 to $40,000 CAD across both stages, plus travel where the audit is not remote and a certificate issue fee of $500 to $2,000 CAD. That is between a fifth and a third of what year one costs in total, since the consultant, the internal time and the testing sit outside it. The full Canadian cost picture puts the audit fee next to everything else, and the cost calculator runs your own headcount through the same arithmetic.

Common questions