Title: ISO 27001 Internal Audit Case Study, Stage 2 > A UK professional services group passed Stage 1 without an internal audit. Here is how the gap was closed and Stage 2 readiness achieved. Source: https://aegentra.co.uk/case-studies/iso-27001-stage-1-passed-stage-2-postponed Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT. Published: 2026-11-06 Updated: 2026-11-06 Licence: public web content; cite the source URL. Case study / United Kingdom # ISO 27001 Stage 1 Passed, Stage 2 Postponed: Why an Internal Audit Could Not Be Skipped How a UK professional services group recovered a stalled ISO 27001 certification programme: a Stage 1 audit passed on documentation, a Stage 2 audit the certification body said it was not ready for, and the Clause 9.2 internal audit and Clause 9.3 management review that turned a document set into evidence, with UK GDPR Article 32 accountability evidence as the by-product. By [Harry Sidhu](https://aegentra.co.uk/about#director) — ISO 27001 Lead Implementer · Director and Principal Consultant, AegentraPublished 6 November 2026 · 8 min read [Read the case study](https://aegentra.co.uk/case-studies/iso-27001-stage-1-passed-stage-2-postponed#client) [ISO 27001 internal audit service](https://aegentra.co.uk/services/govern/iso-27001-internal-audit) Written by Harry Sidhu from the engagement Aegentra’s consultants delivered. The client is not named; no written approval for naming is on file. The Stage 2 outcome will be stated once the client confirms what may be published. In one paragraph A Stage 1 pass on paper. A Stage 2 the certification body said the group was not ready for. One internal audit cycle closed the gap. A 2,400-person UK professional services group passed ISO 27001 Stage 1 and read it as proof that its ISMS worked. The certification body disagreed: no internal audit had been run, no management review held, and the controls had not operated long enough to leave evidence. Aegentra recommended an extension, then ran the Clause 9.2 audit cycle that produced the evidence Stage 2 tests, with UK GDPR Article 32 accountability evidence as the by-product. - **Client:** A UK-headquartered professional services group, about 2,400 staff across the United Kingdom, Australia and the United States; not named. - **Trigger:** A major client contract required ISO 27001 certification as a condition of renewal, with a fixed deadline. - **Position on arrival:** Stage 1 passed; told by the certification body it was not ready to proceed to Stage 2; no internal audit, no management review. - **What Aegentra did:** Recommended an extension, then a readiness gap assessment, an audit programme, an evidence request list chased until complete, a full multi-region internal audit, a report that indexed the evidence for operating controls and raised findings for the missing ones, and a facilitated management review. - **Result:** The group entered Stage 2 with an evidence pack rather than a document set, and UK GDPR accountability evidence it did not previously have. 2,400 Staff across three regions United Kingdom, Australia and the United States 0 Internal audits before Stage 1 None conducted; none planned 4 Finding themes, one root cause Controls written for the audit, not built into the business 6 to 12 Weeks a first audit cycle usually adds Gap assessment to completed management review Who ## The client A professional services group headquartered in the United Kingdom, with additional offices in Australia and the United States. Approximately 2,400 staff across the three regions. The group handles client data subject to UK GDPR, including personal data transferred between its UK, Australian and US entities. A major client contract required ISO 27001 certification as a condition of renewal, with a fixed deadline. The organisation had engaged a certification body and passed Stage 1. It came to Aegentra after being told it was not ready to proceed to Stage 2. The problem ## The problem: a Stage 1 pass that meant less than it looked The group passed Stage 1 and read it as confirmation that the ISMS worked. It was not. Stage 1 is a readiness review. The auditor checks that the required documentation exists, that the scope and the Statement of Applicability are coherent, and that the organisation appears ready for a full audit. It is largely a documentation review. What the group had not done: - No internal audit had been conducted across the ISMS - No management review had taken place - Controls were documented but had not been operating long enough to produce evidence - Evidence of control operation across the UK, Australian and US entities had not been collected The certification body raised this before Stage 2. Without a completed internal audit cycle and management review, there was nothing to audit against. The group faced a choice: attempt Stage 2 and risk major nonconformities, or extend the timeline. The pattern ## Why this happens so often ISO 27001:2022 makes the requirement explicit, but it sits in a clause most organisations read late. **Clause 9.2: internal audit.** The organisation must conduct internal audits at planned intervals to determine whether the ISMS conforms to its own requirements and to the standard, and whether it is effectively implemented and maintained. This means a documented audit programme, defined criteria and scope, objective auditors, and reported results. **Clause 9.3: management review.** Top management must review the ISMS at planned intervals. The review takes defined inputs, including internal audit results, and produces decisions on improvement and resourcing. **Clause 10: nonconformity and corrective action.** Findings must be acted on, with the root cause identified and corrective action recorded. These three clauses form a cycle. The internal audit generates findings, the management review decides what to do about them, and corrective action closes them. A certification body expects to see at least one full pass of that cycle, with evidence, before Stage 2. **The misconception:** Stage 1 is widely treated as a milestone proving the ISMS is sound. It is not an assessment of whether controls operate. An organisation can pass Stage 1 on documentation alone and still be months away from Stage 2 readiness, which is precisely what happened here. The internal audit and management review are what generate the evidence Stage 2 tests. Skip them and Stage 2 has nothing to audit. If the ISMS itself is still being built, the [ISO 27001 implementation service](https://aegentra.co.uk/services/govern/iso-27001) plans that cycle in from the start rather than discovering it at Stage 1. Data protection ## The UK GDPR dimension The evidence gap was not only a certification problem. It was a data protection problem. **Article 32 requires appropriate technical and organisational measures**, taking into account the state of the art and the risk to data subjects. It also requires a process for regularly testing, assessing and evaluating the effectiveness of those measures. An organisation that has documented controls but has never tested whether they operate cannot evidence that requirement. **Article 5(2): accountability.** The controller must be able to demonstrate compliance, not merely assert it. Documentation without operational evidence does not demonstrate anything. **International transfers.** Personal data moved between the UK, Australian and US entities engages Chapter V. Australia has no UK adequacy decision, so transfers to the Australian entity required a transfer mechanism and a transfer risk assessment. The group had intra-group agreements in place but had not evidenced that the safeguards described in them were operating. **Where ISO 27001 and UK GDPR meet.** ISO 27001 is not a data protection standard, and certification does not make an organisation UK GDPR compliant. But a functioning ISMS produces exactly the evidence the ICO expects to see under accountability: risk assessments, access reviews, supplier assurance, incident records, and audit results showing controls were tested. The internal audit the group had skipped was the mechanism that would have generated that evidence. Skipping it left gaps in both the certification programme and the privacy position. The engagement ## What Aegentra did The first recommendation was the one the group did not want to hear: request an extension from the certification body rather than attempt Stage 2. Going into Stage 2 without a completed internal audit cycle risks major nonconformities. A major finding requires corrective action and a follow-up audit, which costs more time than an extension and leaves a record on the certification history. Extending was the cheaper failure. With the deadline moved, the work ran in six stages. The order matters: nothing was reported until the evidence behind it had been requested, chased and received. - Stage 1 ### Readiness gap assessment A full review against Clauses 4 to 10 and all applicable Annex A controls, separating what was documented from what was evidenced. The output was a single register showing, per control, whether a policy existed, whether the control was operating, and whether evidence had been retained. - Stage 2 ### Audit programme design Clause 9.2 requires a programme, not a single audit. We built a rolling programme covering the full ISMS over twelve months, with scope, criteria, frequency and auditor independence defined. The first cycle was scheduled to complete before Stage 2. - Stage 3 ### Evidence request and follow-up A single evidence request list was issued against the register, with an owner and a due date for every item. What came back was reviewed, and what was missing was requested again, with a second and in some cases a third follow-up, until every item had either arrived or been confirmed as not existing. Nothing was accepted on assurance alone, and nothing was audited before the evidence was in. - Stage 4 ### Full internal audit Fieldwork ran across all three regions, sampling the UK entity in depth and testing the Australian and US entities for consistency of control operation. Multi-site sampling was agreed with the certification body in advance so the approach would be accepted. This is the [ISO 27001 internal audit service](https://aegentra.co.uk/services/govern/iso-27001-internal-audit) as it is delivered for UK organisations. - Stage 5 ### Internal audit report Issued once the evidence was complete. For every control that was operating, the report indexed the evidence the group already held but had never gathered in one place, so it could be presented to the certification body as it stood. Every control that was missing, or documented but not operating, was raised as a finding with its root cause and a corrective action. The auditor indexes and tests the evidence the organisation holds; the auditor does not create it, because that would compromise impartiality. - Stage 6 ### Management review We facilitated a Clause 9.3 review with top management, using the audit report as input. Decisions on corrective action, resourcing and ISMS objectives were minuted and became part of the Stage 2 evidence pack. Four themes ## What the audit found The report separated two things the group had been treating as one. Most controls were operating, and the evidence existed; it had simply never been retained or gathered in one place, and the report indexed it. The controls that were missing, or documented but not operating, became findings. Those findings clustered into four themes, and each traced back to the same root cause: controls had been written for the audit rather than built into how the business runs. | Theme | What we found | Root cause | | --- | --- | --- | | Evidence retention | Controls operating with no record kept that they had operated | No defined evidence owner or retention point per control | | Access review | Privileged access reviews documented as quarterly, never performed | Policy written to the standard, not to an existing process | | Supplier assurance | Third parties onboarded without security assessment against the documented procedure | Procurement not in ISMS scope in practice, only on paper | | Regional consistency | Controls operating in the UK entity but applied inconsistently in the other two regions | Single ISMS documented, three operating realities | The regional inconsistency was the most significant. A single ISMS covering multiple jurisdictions must operate consistently, or the scope statement is inaccurate. This is the finding most multi-country organisations are least prepared for, because the documentation looks complete at group level. Corrective actions were raised against each, with root cause analysis and verification evidence, under Clause 10. Where it ended ## Outcome The certification body granted the extension. The group completed its first full internal audit cycle and management review, closed the corrective actions, and entered Stage 2 with an evidence pack rather than a document set. What changed beyond the certificate: - An audit programme that runs on a schedule, not only before an external audit - Named evidence owners for each control, with defined retention points - Access reviews performed rather than described - Consistent control operation tested across all three regions - Accountability evidence under UK GDPR Article 5(2) that did not previously exist The extension cost time. Attempting Stage 2 unprepared would have cost more, and left a record of major nonconformities on the certification history that future clients could ask about. The honest framing The outcome reported here is the state of the group’s management system when it entered Stage 2. Certification is the certification body’s decision, and no consultancy can promise it in advance. What the engagement demonstrates is the method, and the cost of skipping it. Before you book ## What to check before you book Stage 2 If you are preparing for ISO 27001 certification, work through this before confirming your Stage 2 date. The ten checks below are the ones a certification body will make at Stage 2, whether or not you made them first. - A documented internal audit programme exists, covering the full ISMS over a defined period - At least one complete internal audit cycle has been conducted, not a self-assessment - Auditors were objective and impartial: nobody audited their own work - Audit results are documented and have been reported to management - A Clause 9.3 management review has been held, with minuted decisions - Nonconformities have root cause analysis and verified corrective action under Clause 10 - Every applicable Annex A control has a named evidence owner and a retention point - Controls have been operating long enough to have produced evidence, typically three months minimum - Multi-site organisations have tested control operation in each location, not just at head office - Your sampling approach for multiple sites has been agreed with the certification body in advance If more than two of these are unchecked, your Stage 2 date is optimistic. Moving it is cheaper than failing it. ### A note on timing The most common question is how long the internal audit cycle adds. For an organisation with controls already documented, expect six to twelve weeks from gap assessment to completed management review. The binding constraint is usually not the audit itself. It is waiting for controls to have operated long enough to produce evidence worth auditing. ### Questions readers ask before Stage 2 **Does passing ISO 27001 Stage 1 mean the ISMS is ready for certification?** No. Stage 1 is a readiness review of documentation: the auditor checks that the required documents exist, that the scope and Statement of Applicability are coherent and that the organisation appears ready for a full audit. It does not test whether controls operate. An organisation can pass Stage 1 on documentation alone and still be months away from Stage 2 readiness. **Can we go to ISO 27001 Stage 2 without an internal audit?** You can book it, but a certification body expects to see at least one completed internal audit cycle (Clause 9.2) and a management review (Clause 9.3), with evidence, before Stage 2. Without them there is nothing to audit against, and the likely result is major nonconformities, a corrective-action period and a follow-up audit. In this engagement, asking the certification body for an extension was the cheaper route. **How long does the ISO 27001 internal audit cycle add before Stage 2?** For an organisation with controls already documented, expect six to twelve weeks from gap assessment to a completed management review. The binding constraint is usually not the audit itself but waiting for controls to have operated long enough, typically three months, to produce evidence worth auditing. **Can our own staff conduct the ISO 27001 internal audit?** Only if they are objective and impartial with respect to what they audit: nobody may audit their own work. Where the people who designed and operate the ISMS are the only people available, an external internal audit is the route Clause 9.2 allows, and the certification body will ask to see how impartiality was assured. **Does a multi-site ISMS need every location audited before Stage 2?** Control operation must be tested in each location in scope, not only at head office; a single ISMS that operates differently in each region has an inaccurate scope statement. In this engagement the UK entity was sampled in depth and the Australian and US entities were tested for consistency, with the multi-site sampling approach agreed with the certification body in advance. **How does ISO 27001 relate to UK GDPR Article 32?** ISO 27001 is not a data protection standard and certification does not make an organisation UK GDPR compliant. But Article 32 requires appropriate measures and a process for regularly testing their effectiveness, and Article 5(2) requires the controller to demonstrate compliance. A functioning ISMS, with internal audit results showing controls were tested, produces exactly the evidence that accountability expects. Passed Stage 1 and not sure Stage 2 will hold? An ISO 27001 readiness review separates what is documented from what is evidenced, control by control, before the certification body does. [Book an ISO 27001 readiness review](https://aegentra.co.uk/contact) UK engagements are quoted in pounds sterling plus VAT, delivered remotely across England, Scotland, Wales and Northern Ireland, with on-site observation where agreed. ## Check the primary sources. [ISO: ISO/IEC 27001:2022 Information security management systems](https://www.iso.org/standard/27001) [ICO: security (UK GDPR Article 32) guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/) [ICO: international transfers guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/) [The earlier engagement record: a Clause 9.2 internal audit met with evidence](https://aegentra.co.uk/case-studies/iso-27001-internal-audit) ## Choose the next step. [ISO 27001 internal audit service for UK organisations](https://aegentra.co.uk/services/govern/iso-27001-internal-audit) [ISO 27001 implementation for UK organisations](https://aegentra.co.uk/services/govern/iso-27001) [All internal audit services: ISO 27001, 42001, 27701, 9001 and 45001](https://aegentra.co.uk/services/internal-audit) [What ISO 27001 Clause 9.2 requires](https://aegentra.co.uk/knowledge/iso-27001-clause-9-2-internal-audit-requirements)