Stage 2 audit
A stage 2 audit is the certification audit proper in ISO 27001: the auditor tests whether your ISMS and its applicable Annex A controls actually operate as documented — through evidence sampling and interviews — and, if no major nonconformities surface, recommends you for certification.
The second, decisive phase of an ISO 27001 certification audit, in which the auditor verifies through evidence sampling and interviews that the ISMS and its applicable controls operate in practice, then recommends for or against certification.
Stage 2 audit.
Glossary · Stage 2 AuditHow stage 2 differs from stage 1
Where stage 1 asks whether the system is designed and documented, stage 2 asks whether it runs. The auditor moves from reading to verifying: pulling records, sampling evidence, and interviewing the people who own controls. A policy that exists satisfies stage 1; stage 2 wants the access reviews, incident tickets, and training completions that prove the policy is lived.
What fieldwork covers
The engagement works through your Statement of Applicability and the ISO 27001 management clauses. Expect walkthroughs of onboarding and offboarding, change management, incident response, supplier reviews, and the management loop itself — internal audits, management review, corrective actions. Findings are classified as major or minor nonconformities; majors block certification until resolved, minors come with a corrective-action expectation.
After the recommendation
Pass stage 2 and the auditor recommends certification; the certification body then issues a certificate that runs on a three-year cycle, with surveillance audits in between. The practical takeaway for first-timers: stage 2 is won months earlier, by operating the system long enough to generate real records. How startups build that operating runway is covered in ISO 27001 for startups.
Glossary
Stage 2 without surprises
Agency operates the ISMS in the months before fieldwork, pre-audits every control, and manages the auditor relationship through both stages. Top-ranked Vanta & Drata partner · 1,000+ companies served since 2021 · 4.9/5 on G2.
Platform Products
Agency AIEnd-to-end cybersecurity and compliance, across the stack you already use.GRC IntegrationsEngineer-operated GRC platform integrationAuditsuisse AIAI-powered evidence collection and analysis for IT audits.Find your auditor
Auditnex makes buying audits simpler and more transparent.
Agency implements the controls, collects the evidence, and manages your auditor relationship on top of the GRC tools you already use.
Explore AuditnexCommon GRC Questions
GRC Platform & Virtual CISO FAQ
The long-form FAQ on how managed GRC and virtual CISO coverage work together.
Read the FAQMore from Agency
See it on the home pageBuild a Security & Compliance Team Led by Your Own Virtual CISO
Forward-Deployed Engineers + AI that lower costs, increase velocity, and raise the bar — from policy to audit to remediation. U.S.-based forward-deployed engineers, supercharged by proprietary AI, operate your program end-to-end — on top of the tools you already trust.