ISO 27001 Stage 1 vs Stage 2 Audit: Go/No-Go Checklists, the 6-Month Major Nonconformity Rule, and How to Vet Your Certification Body

Stage 1 decides whether Stage 2 happens at all; Stage 2 decides whether you get a certificate. Stage 1 is a readiness review of your documentation, your scope and the evidence that the ISMS has started to run. If the auditor cannot confirm you are ready, the audit can be broken off there. Stage 2 then checks whether what you documented actually happens. No certificate is issued until the certification body has verified the fix for every major nonconformity, and if it cannot do so within six months of the last day of Stage 2, it must run another Stage 2.

This guide turns both stages into go/no-go gates you can check before you book. It also explains how findings are graded under ISO/IEC 17021-1, the standard that governs how certification bodies audit and certify management systems, and gives a five-step check on the certification body itself. For the full certification path, timeline and budget, start with our ISO 27001 compliance guide.

Stage 1 vs Stage 2 at a glance

Plain-language summary: Stage 1 asks “is this ISMS complete enough to audit?” and Stage 2 asks “does it work?”. The two stages have different inputs, different outputs and different ways to fail.

Question	Stage 1	Stage 2
Purpose	Confirm the ISMS is documented and far enough along to justify Stage 2	Evaluate whether the ISMS is implemented and effective against ISO/IEC 27001
What the auditor examines	Documentation, scope details, site conditions, whether internal audit and management review are planned and performed	Practice against documented processes: interviews, documents, records, visits to relevant areas
Typical output	Readiness conclusion and any weaknesses you must correct before Stage 2	Audit report with graded findings and a recommendation on certification
How it fails	Readiness cannot be positively established, so the audit stops after Stage 1	Major nonconformities whose fixes are not verified in time, so certification is not recommended

The table’s biggest takeaway: a Stage 1 problem costs you a delay, while a Stage 2 problem can cost you the stage itself. TÜV NORD CERT’s published ISMS certification procedure states both rules plainly. Weaknesses found at Stage 1 “must be corrected by the customer before the Stage 2 audit”. If readiness “cannot be established positively”, the audit “is broken off after the Stage 1 audit”.

The Stage 1 go/no-go gate: seven objectives, seven pass conditions

Plain-language summary: Stage 1 has a fixed list of objectives. Turn each one into a pass condition, check it internally, and book Stage 1 only when every row is a “go”.

TÜV NORD’s procedure lists seven Stage 1 objectives. The other columns are our translation into checkable evidence; owner and effort are planning estimates.

Stage 1 objective	“Go” looks like	No-go signal	Owner / effort
1. Audit the management system documentation	Scope statement, security policy, risk method, risk treatment plan and Statement of Applicability approved and current	Drafts, unsigned approvals, SoA rows with no justification	ISMS manager / Medium
2. Assess the site and talk to personnel about readiness	Staff in scope can explain the policies and procedures that apply to their own work	Interviewees have never seen the ISMS documents	Department heads / Low
3. Assess understanding of the standard: processes, objectives, operation	Security objectives are measurable, owned and tracked	Objectives copied from a template with no figures	Top management / Medium
4. Collect scope information: processes, locations, people in scope, compliance obligations, information security aspects	Headcount and sites match what you declared in the certification body’s questionnaire	A site or team appears that the quote never covered	ISMS manager / Low
5. Review resources for Stage 2 and agree its details	Dates, interviewees and access to systems and records agreed	Records the auditor needs are confidential and no access route exists	ISMS manager / Low
6. Build a focus for Stage 2 planning	Risk register and SoA show where the significant risks and controls sit	Risk register untouched since the first workshop	Risk owner / Medium
7. Confirm internal audits and management review are both planned and performed	Completed internal audit report with logged nonconformities, plus management review minutes	An audit programme and a review date, but no results	Internal auditor + top management / High

Row 7 is where projects stall. The wording is “planned and performed”, so a schedule alone does not pass. ISO/IEC 27001:2022 makes internal audit (clause 9.2) and management review (clause 9.3) requirements in their own right. ISOQAR, another certification body, advises scheduling Stage 1 once you have generated evidence such as internal audits and management reviews for the auditor to examine. Our ISO 27001 internal audit checklist covers how to run that first cycle.

Row 5 has a trap of its own. TÜV NORD’s procedure says that if the ISMS cannot be adequately audited without records you have classified as confidential, the audit cannot take place until access arrangements are agreed. Settle that before the auditor arrives.

One newer item belongs on the list. In February 2024, IAF and ISO announced climate-change additions to clauses 4.1 and 4.2 of a number of management system standards, the context clauses that ISO/IEC 27001 also uses. The IAF-ISO joint communiqué expects certification bodies to check that climate change was considered and, where you judged it not relevant, that the process behind that decision was effective. Have that decision and its reasoning documented in your context analysis.

What Stage 2 tests, and its go/no-go gate

Plain-language summary: Stage 2 compares what people do with what your documents say. You pass it with records that show the ISMS operating over time, not with better documents.

TÜV NORD describes the Stage 2 task as comparing “the practical application of the management system with the documented processes”. Its auditors question employees, examine documents, records, orders and guidelines, and visit relevant areas. Our guide to objective evidence in an audit sets out the five tests a screenshot or record has to pass.

Before you confirm Stage 2 dates, check four things:

1. Every Stage 1 weakness is closed, with proof. Put a record of the fix next to each point in the Stage 1 report.
2. Each SoA control marked “implemented” has a record. Pick five at random and find the log, ticket or minutes that proves each one operated.
3. Your internal audit findings have moved. Each one shows a cause analysis, an action and a status.
4. Interviewees know their part. People in scope can explain the procedures that apply to their own work.

Stage 2 also has a cost side. ISOQAR notes that clearing a major nonconformity may involve a further site visit by the auditor. Our ISO 27001 certification cost breakdown shows how audit days drive the budget.

How findings are graded: major vs minor under ISO/IEC 17021-1

Plain-language summary: a finding is first a nonconformity or not. Only then is it graded, and the grade decides whether your certificate waits or goes ahead.

ISO/IEC 17021-1:2015 defines a nonconformity as the “non-fulfilment of a requirement”. European Accreditation’s FAQ on the definition of nonconformity quotes the grading rules from the standard. A major nonconformity “affects the capability of the management system to achieve the intended results”. A minor one does not. A note to the major definition adds two triggers: significant doubt that effective process control is in place, and “a number of minor nonconformities associated with the same requirement or issue”, which “could demonstrate a systemic failure and thus constitute a major nonconformity”.

Grade	Test in ISO/IEC 17021-1	What the certification body needs before deciding	Effect on your certificate
Major nonconformity	Affects the capability of the ISMS to achieve its intended results	Correction and corrective action reviewed, accepted and verified (clause 9.5.2 b)	No certificate until verified; if not verified within 6 months of the last day of Stage 2, another Stage 2
Minor nonconformity	Does not affect that capability	Your plan for correction and corrective action reviewed and accepted (clause 9.5.2 c)	Decision can go ahead; implementation is checked at a later audit
Opportunity for improvement	Not a nonconformity	May be identified and recorded (clause 9.4.5.2)	None on the decision; a finding that is a nonconformity must not be recorded as one

The practical consequence: a major is a timing problem as much as a quality problem. The European Accreditation FAQ on corrections and corrective actions sets the clock. If the certification body “is not able to verify the implementation of corrections and corrective actions of any major nonconformity within 6 months after the last day of stage 2”, it “shall conduct another stage 2 prior to recommending certification”. Individual bodies add deadlines of their own. TÜV NORD’s procedure, for example, requires you to report your corrective actions and their dates within 6 weeks of the last audit day, and treats the audit as not passed if you miss it. Check your own body’s deadline before Stage 2 starts.

Three grading points are worth knowing before you argue a finding.

• The test is capability, not catastrophe. ISOQAR’s audit guide describes a major as “a total breakdown of a system”. The standard’s own test is narrower: does the gap affect the ISMS’s capability to achieve its intended results? Argue on that test.
• Labels may differ; meanings may not. European Accreditation’s FAQ on findings classification quotes clause 9.4.5.2: nonconformities “shall not be recorded as opportunities for improvement”. A body may add an “observation” category, but major and minor must keep the standard’s meaning.
• A minor closed on paper is still open. In an ISO 9001 case in the FAQ on the definition of nonconformity, the accreditation body RvA described a minor finding closed once a template had been changed, with the certificate issued before the new method had run. RvA called it a case where the definition “does not function properly”. Expect the first surveillance audit to look for the evidence.

How to check a certification body before you sign

Plain-language summary: an ISO 27001 certificate is only as credible as the accreditation behind it. Five checks, all against public sources, tell you whether it is.

ISO’s help centre states that “ISO itself does not perform certifications or accredit certification bodies”. National accreditation bodies do that. Inside the EU, Regulation (EC) No 765/2008 requires each Member State to appoint a single national accreditation body (Article 4(1)). Under Article 11(2), national authorities must recognise the accreditation certificates of bodies that have passed peer evaluation. The five checks:

Check	Where	Pass condition
1. The accreditation body is peer-evaluated	EA directory of members and MLA signatories	Listed as an MLA signatory with “Management System Certification” in its scopes
2. The certification body is accredited for ISO/IEC 27001	The accreditation body’s own register	The legal entity on your quote appears, with ISO/IEC 27001 in its accredited scope
3. It works to the current ISMS rules	Ask for its accreditation certificate or schedule	Accreditation covers ISO/IEC 27006-1:2024 (transition deadline 31 March 2026)
4. Its certificates name the current standard	A sample certificate	ISO/IEC 27001:2022; 2013-edition certificates expired or were withdrawn at the end of October 2025
5. Its existing certificates are listed	IAF CertSearch, or the bodies directly	Status shows Active (an account is needed to search); if a certificate is missing, confirm with the certification or accreditation body

The dates in rows 3 and 4 come from two mandatory documents. IAF MD 29 required accreditation bodies and certification bodies to complete the transition to ISO/IEC 27006-1:2024 by 31 March 2026, as the IAF announcement records. IAF MD 26 ended the ISO/IEC 27001:2022 transition on 31 October 2025 and states that all certifications based on the 2013 edition “shall expire or be withdrawn at the end of the transition period”. A supplier still waving a 27001:2013 certificate in late 2026 is showing you a lapsed document.

One change affects procurement templates. IAF ceased operations on 1 January 2026, and Global Accreditation Cooperation Incorporated (Global ACI) replaced IAF and ILAC, folding the IAF MLA and ILAC MRA into a single Global ACI MRA. Its April 2026 communication to regulators says recognition of existing accredited results continues without interruption, and the IAF and ILAC marks stay recognised until an anticipated 1 January 2029. Questionnaires asking for an “IAF MLA signatory” still work, but new ones should refer to the Global ACI MRA “for the relevant standard and scope”, as its model wording does.

For a CISO, these checks protect the certificate you are paying for; procurement and legal teams can run the same rows on any certificate a vendor sends. If you also need the certificate as NIS2 evidence, our overview of what certification schemes cover under NIS2 explains where an ISO certificate fits.

Who owns which decision

Plain-language summary: on your side, each go/no-go call belongs to a named person. On the certification body’s side, the release decision sits outside the audit team.

Role	Owns	Signs off
ISMS manager / CISO	Stage 1 gate rows 1, 4, 5 and the Stage 2 evidence check	“Ready to book Stage 1” recommendation
Top management	Objectives, management review, resources for corrective action	Go/no-go for both stages
Internal auditor	Completed internal audit cycle and its nonconformity log	Internal audit report
Procurement / legal	Certification body checks 1 to 5 and the contract terms, including deadlines for corrective action	Certification body selection

On the certification body’s side, TÜV NORD’s procedure states that the person who reviews and releases the certificate may not have taken part in the audit. Its certificates are normally valid for three years. The first surveillance audit must take place no later than 12 months after the certification decision, then at least once per calendar year.

Frequently asked questions

Can you fail a Stage 1 audit?

It can stop the process. If readiness for Stage 2 cannot be positively established, TÜV NORD’s procedure says the audit is broken off after Stage 1, and any weaknesses found must be corrected before Stage 2.

Does a major nonconformity at Stage 2 mean starting over?

Not straight away. The certification body must review, accept and verify your correction and corrective action before it decides. If it cannot verify them within six months of the last day of Stage 2, it must run another Stage 2 before recommending certification.

Is an ISO 27001:2013 certificate still valid?

No. IAF MD 26 ended the transition on 31 October 2025 and states that all certifications based on ISO/IEC 27001:2013 expire or are withdrawn at the end of the transition period. Ask for a 27001:2022 certificate.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

Sources

1. TÜV NORD CERT GmbH. Description of the Certification Procedure MS – ISO 27001, MS – ISO 22301, MS – ISO 20000-1 (A50F300e Rev. 07/03.22) (linked above).
2. European Accreditation. Question 35.10, Definition of nonconformity, quoting ISO/IEC 17021-1:2015 clauses 3.11 to 3.13 and 9.5.2 (linked above).
3. European Accreditation. Question 36.14, Corrections and corrective actions (linked above).
4. European Accreditation. Question 39.1, Findings classification – Nonconformities, quoting ISO/IEC 17021-1:2015 clause 9.4.5 (linked above).
5. ISOQAR. The ISO/IEC 27001 audit process explained (linked above).
6. ISMS.online. ISO 27001 Requirements 2022, clauses 4 to 10 (linked above).
7. IAF and ISO. IAF-ISO Joint Communiqué on Addition of Climate Change Considerations to Management System Standards, 22 February 2024 (linked above).
8. ISO Help Centre. How to verify an accredited certification, 9 December 2025 (linked above).
9. Regulation (EC) No 765/2008 of the European Parliament and of the Council setting out the requirements for accreditation, Articles 4 and 11. Official Journal of the European Union, EUR-Lex (linked above).
10. European Accreditation. Directory of EA Members and MLA signatories (linked above).
11. IAF CertSearch. Certificate Verification Guide (linked above).
12. International Accreditation Forum. IAF Publishes MD for Transition to ISO/IEC 27006-1:2024, 24 May 2024 (linked above).
13. International Accreditation Forum. IAF MD 26:2023, Transition Requirements for ISO/IEC 27001:2022 (linked above).
14. NATA for Global Accreditation Cooperation Incorporated. Specifying the Use of Global ACI Accreditation, 14 April 2026 (linked above).
15. ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification of management systems; ISO/IEC 27006-1:2024; ISO/IEC 27001:2022. International Organization for Standardization (cited through the sources above).