ISO 27001 Stage 1 Passed, Stage 2 Postponed: Why an Internal Audit Could Not Be Skipped

The client

A professional services group headquartered in the United Kingdom, with additional offices in Australia and the United States. Approximately 2,400 staff across the three regions.

The group handles client data subject to UK GDPR, including personal data transferred between its UK, Australian and US entities. A major client contract required ISO 27001 certification as a condition of renewal, with a fixed deadline.

The organisation had engaged a certification body and passed Stage 1. It came to Aegentra after being told it was not ready to proceed to Stage 2.

The problem: a Stage 1 pass that meant less than it looked

The group passed Stage 1 and read it as confirmation that the ISMS worked. It was not.

Stage 1 is a readiness review. The auditor checks that the required documentation exists, that the scope and the Statement of Applicability are coherent, and that the organisation appears ready for a full audit. It is largely a documentation review.

What the group had not done:

• No internal audit had been conducted across the ISMS
• No management review had taken place
• Controls were documented but had not been operating long enough to produce evidence
• Evidence of control operation across the UK, Australian and US entities had not been collected

The certification body raised this before Stage 2. Without a completed internal audit cycle and management review, there was nothing to audit against. The group faced a choice: attempt Stage 2 and risk major nonconformities, or extend the timeline.

Why this happens so often

ISO 27001:2022 makes the requirement explicit, but it sits in a clause most organisations read late.

Clause 9.2: internal audit. The organisation must conduct internal audits at planned intervals to determine whether the ISMS conforms to its own requirements and to the standard, and whether it is effectively implemented and maintained. This means a documented audit programme, defined criteria and scope, objective auditors, and reported results.

Clause 9.3: management review. Top management must review the ISMS at planned intervals. The review takes defined inputs, including internal audit results, and produces decisions on improvement and resourcing.

Clause 10: nonconformity and corrective action. Findings must be acted on, with the root cause identified and corrective action recorded.

These three clauses form a cycle. The internal audit generates findings, the management review decides what to do about them, and corrective action closes them. A certification body expects to see at least one full pass of that cycle, with evidence, before Stage 2.

The misconception: Stage 1 is widely treated as a milestone proving the ISMS is sound. It is not an assessment of whether controls operate. An organisation can pass Stage 1 on documentation alone and still be months away from Stage 2 readiness, which is precisely what happened here.

The internal audit and management review are what generate the evidence Stage 2 tests. Skip them and Stage 2 has nothing to audit. If the ISMS itself is still being built, the ISO 27001 implementation service plans that cycle in from the start rather than discovering it at Stage 1.

The UK GDPR dimension

The evidence gap was not only a certification problem. It was a data protection problem.

Article 32 requires appropriate technical and organisational measures, taking into account the state of the art and the risk to data subjects. It also requires a process for regularly testing, assessing and evaluating the effectiveness of those measures. An organisation that has documented controls but has never tested whether they operate cannot evidence that requirement.

Article 5(2): accountability. The controller must be able to demonstrate compliance, not merely assert it. Documentation without operational evidence does not demonstrate anything.

International transfers. Personal data moved between the UK, Australian and US entities engages Chapter V. Australia has no UK adequacy decision, so transfers to the Australian entity required a transfer mechanism and a transfer risk assessment. The group had intra-group agreements in place but had not evidenced that the safeguards described in them were operating.

Where ISO 27001 and UK GDPR meet. ISO 27001 is not a data protection standard, and certification does not make an organisation UK GDPR compliant. But a functioning ISMS produces exactly the evidence the ICO expects to see under accountability: risk assessments, access reviews, supplier assurance, incident records, and audit results showing controls were tested.

The internal audit the group had skipped was the mechanism that would have generated that evidence. Skipping it left gaps in both the certification programme and the privacy position.

What Aegentra did

The first recommendation was the one the group did not want to hear: request an extension from the certification body rather than attempt Stage 2.

Going into Stage 2 without a completed internal audit cycle risks major nonconformities. A major finding requires corrective action and a follow-up audit, which costs more time than an extension and leaves a record on the certification history. Extending was the cheaper failure.

With the deadline moved, the work ran in six stages. The order matters: nothing was reported until the evidence behind it had been requested, chased and received.

1. 1. Readiness gap assessment

   A full review against Clauses 4 to 10 and all applicable Annex A controls, separating what was documented from what was evidenced. The output was a single register showing, per control, whether a policy existed, whether the control was operating, and whether evidence had been retained.

2. 2. Audit programme design

   Clause 9.2 requires a programme, not a single audit. We built a rolling programme covering the full ISMS over twelve months, with scope, criteria, frequency and auditor independence defined. The first cycle was scheduled to complete before Stage 2.

3. 3. Evidence request and follow-up

   A single evidence request list was issued against the register, with an owner and a due date for every item. What came back was reviewed, and what was missing was requested again, with a second and in some cases a third follow-up, until every item had either arrived or been confirmed as not existing. Nothing was accepted on assurance alone, and nothing was audited before the evidence was in.

4. 4. Full internal audit

   Fieldwork ran across all three regions, sampling the UK entity in depth and testing the Australian and US entities for consistency of control operation. Multi-site sampling was agreed with the certification body in advance so the approach would be accepted. This is the ISO 27001 internal audit service as it is delivered for UK organisations.

5. 5. Internal audit report

   Issued once the evidence was complete. For every control that was operating, the report indexed the evidence the group already held but had never gathered in one place, so it could be presented to the certification body as it stood. Every control that was missing, or documented but not operating, was raised as a finding with its root cause and a corrective action. The auditor indexes and tests the evidence the organisation holds; the auditor does not create it, because that would compromise impartiality.

6. 6. Management review

   We facilitated a Clause 9.3 review with top management, using the audit report as input. Decisions on corrective action, resourcing and ISMS objectives were minuted and became part of the Stage 2 evidence pack.

What the audit found

The report separated two things the group had been treating as one. Most controls were operating, and the evidence existed; it had simply never been retained or gathered in one place, and the report indexed it. The controls that were missing, or documented but not operating, became findings. Those findings clustered into four themes, and each traced back to the same root cause: controls had been written for the audit rather than built into how the business runs.

The regional inconsistency was the most significant. A single ISMS covering multiple jurisdictions must operate consistently, or the scope statement is inaccurate. This is the finding most multi-country organisations are least prepared for, because the documentation looks complete at group level.

Corrective actions were raised against each, with root cause analysis and verification evidence, under Clause 10.

Outcome

The certification body granted the extension. The group completed its first full internal audit cycle and management review, closed the corrective actions, and entered Stage 2 with an evidence pack rather than a document set.

What changed beyond the certificate:

• An audit programme that runs on a schedule, not only before an external audit
• Named evidence owners for each control, with defined retention points
• Access reviews performed rather than described
• Consistent control operation tested across all three regions
• Accountability evidence under UK GDPR Article 5(2) that did not previously exist

The extension cost time. Attempting Stage 2 unprepared would have cost more, and left a record of major nonconformities on the certification history that future clients could ask about.

What to check before you book Stage 2

If you are preparing for ISO 27001 certification, work through this before confirming your Stage 2 date.

• A documented internal audit programme exists, covering the full ISMS over a defined period
• At least one complete internal audit cycle has been conducted, not a self-assessment
• Auditors were objective and impartial: nobody audited their own work
• Audit results are documented and have been reported to management
• A Clause 9.3 management review has been held, with minuted decisions
• Nonconformities have root cause analysis and verified corrective action under Clause 10
• Every applicable Annex A control has a named evidence owner and a retention point
• Controls have been operating long enough to have produced evidence, typically three months minimum
• Multi-site organisations have tested control operation in each location, not just at head office
• Your sampling approach for multiple sites has been agreed with the certification body in advance

If more than two of these are unchecked, your Stage 2 date is optimistic. Moving it is cheaper than failing it.

A note on timing

The most common question is how long the internal audit cycle adds. For an organisation with controls already documented, expect six to twelve weeks from gap assessment to completed management review. The binding constraint is usually not the audit itself. It is waiting for controls to have operated long enough to produce evidence worth auditing.

Questions readers ask before Stage 2

Choose the next step.