ISO 27001

ISO 27001 Internal Audit vs Certification Audit

By Samaksh·2026-10-05·11 min read

Short answer: An ISO 27001 internal audit is a management control required by Clause 9.2 — it is conducted by or on behalf of your organisation to verify that the ISMS operates as intended and to identify improvement opportunities. A certification audit is conducted by an accredited third-party certification body to formally determine whether your ISMS conforms to ISO/IEC 27001:2022. Both are essential; neither replaces the other.

TL;DR: Internal audits are your quality control mechanism — they find problems before a certification auditor does. Certification audits are the formal third-party assessment that produces (or withholds) the certificate. Running a rigorous internal audit programme is the best preparation for a successful Stage 2 certification audit.

Key Takeaways - Internal audits are a mandatory ISO 27001 clause requirement (Clause 9.2) — not optional, not the same as a security assessment. - Certification audits have two stages: Stage 1 (documentation review) and Stage 2 (implementation verification). - Nonconformities found in internal audits must be addressed through formal corrective action (Clause 10.1) before the certification audit. - Surveillance audits — conducted annually by the certification body — keep the certificate valid between full recertification cycles (every three years). - Auditors look for evidence of operation, not just documentation — the same principle applies to both audit types.

Why both audit types exist

An information security management system is only as good as the discipline used to maintain it. ISO 27001 builds two audit layers into the management system for this reason:

The internal audit (Clause 9.2) is the organisation's own quality check. It answers: is our ISMS doing what we designed it to do? It is owned and driven by the organisation, and its outputs feed into management review and continual improvement.

The certification audit answers the external question: does this ISMS conform to the requirements of ISO/IEC 27001:2022? It is conducted by an independent, accredited third party. Its output is a binary conformity determination — and, if conforming, a certificate.

Both are necessary because they serve different purposes and different audiences. Internal audits serve the organisation; certification audits serve customers, regulators, and business partners who need independent assurance.

The internal audit in detail

What Clause 9.2 requires

Clause 9.2 of ISO 27001:2022 requires that the organisation:

Conduct internal audits at planned intervals.
Audit against both the requirements of ISO 27001 (Clauses 4–10) and the organisation's own ISMS requirements.
Select auditors who are objective and impartial — they must not audit their own work.
Report audit results to relevant management.
Retain documented information as evidence of the audit programme and results.

The standard does not specify how frequently audits must occur, but "planned intervals" means at a minimum annually, and most organisations audit the full ISMS scope at least once in each 12-month period.

What internal auditors actually do

Internal auditors work through the ISMS systematically, reviewing:

Documentation: are all required documents in place, current, version-controlled, and approved?
Process operation: are procedures being followed in practice? (Interview process owners; examine records.)
Control effectiveness: are controls operating as designed? (Review access logs, patch records, training completion, incident records.)
Objectives and metrics: is the organisation measuring what it said it would measure, and are results used to drive improvement?

Internal audit outputs

The internal audit produces a findings report containing:

Nonconformities (major and minor): where the ISMS fails to meet a requirement of ISO 27001 or the organisation's own documented processes.
Observations: areas where improvement is recommended but conformity exists.
Positive findings: areas operating effectively.

Major nonconformities (a complete failure of a clause requirement, or multiple minor issues indicating a systemic breakdown) must be resolved and verified before a Stage 2 certification audit proceeds. Minor nonconformities must be addressed through corrective action but may not block certification — the certification body makes this determination.

Every nonconformity must enter the corrective action process under Clause 10.1: root cause analysis, corrective action, implementation, and verification of effectiveness.

The certification audit in detail

How to select a certification body

Certification bodies must be accredited by a national accreditation body that is a member of the International Accreditation Forum (IAF). In the UK, that is UKAS; in the US, ANAB; in Germany, DAkkS. Accreditation ensures the certification body's processes meet the requirements of ISO/IEC 17021-1 and the ISO 27001-specific requirements in ISO/IEC 27006-1 (available at iso.org).

When selecting a CB, consider: sector experience, geographic coverage if you have multiple sites, price, and auditor availability. Get quotes from at least two accredited CBs.

Stage 1 — Documentation review

Stage 1 is typically conducted remotely or on-site over one to two days for a medium-sized organisation. The auditor reviews:

ISMS scope document
Information security policy
Risk assessment methodology and results
Statement of Applicability
Risk treatment plan
Objectives and plans
Internal audit programme and results
Management review records
Sample policies and procedures

Stage 1 output is a Stage 1 report that identifies whether the organisation is ready for Stage 2 and lists any areas requiring attention before Stage 2 proceeds. Many Stage 1 findings mirror the gaps surfaced during pre-implementation planning, so a thorough ISO 27001 gap assessment beforehand reduces surprises at this stage. Addressing Stage 1 findings promptly, typically within two to four weeks, keeps the certification timeline on track.

Stage 2 — Implementation audit

Stage 2 is the main conformity assessment. Auditors spend time on-site (or in extended remote sessions) verifying that the ISMS operates as documented. They will:

Interview employees at all levels — not just ISMS staff.
Review records (access logs, change tickets, patch records, training logs, incident records).
Test specific controls against documented procedures.
Verify that nonconformities found at Stage 1 have been addressed.

Stage 2 findings are classified as major nonconformities, minor nonconformities, or observations. Major nonconformities must be closed (with evidence) before the certificate is issued. Minor nonconformities are typically addressed within 90 days, verified at the first surveillance audit.

Figure 1. ISO 27001 certification and surveillance audit cycle. After initial certification, surveillance audits occur annually: the first must take place no more than 12 months after the certification decision date, which falls at Month 15 on this timeline (certificate issued Month 3). Full recertification is required every three years. Source: IAF MD 6:2014, mandatory document for the application of ISO/IEC 17021-1 to management system certification.

Surveillance and recertification audits

After initial certification, the certificate is valid for three years subject to annual surveillance audits. Surveillance audits are shorter than the Stage 2 and typically cover: progress on corrective actions, changes to the ISMS, internal audit and management review records, key controls, and any incidents that occurred in the period.

Recertification (every three years) is a full reassessment comparable in scope to the original Stage 2 audit. EU cybersecurity guidance recognises independently audited certification as evidence of ongoing security assurance to customers and regulators (ENISA).

Side-by-side comparison

Dimension	Internal audit (Clause 9.2)	Certification audit (Stage 1 + Stage 2)
Who conducts it	Organisation's own auditors or contracted team	Accredited third-party certification body
Purpose	Verify ISMS operates as intended; identify improvements	Determine conformity with ISO 27001:2022
Output	Internal findings report; corrective actions	Certification decision; certificate (if conforming)
Consequence of findings	Corrective action required internally	Major NC blocks certificate; minor NC resolved post-issue
Frequency	At planned intervals (typically annually)	Stage 2 once; surveillance annually; recert every 3 years
Independence required	Auditors must not audit their own work	Auditors must be independent of the organisation
Mandatory?	Yes — Clause 9.2	Yes — required to gain and maintain certification
Cost	Internal resource or consultant fee	Certification body fees (varies by organisation size)

How to prepare for a Stage 2 certification audit

The best preparation for a Stage 2 audit is a rigorous internal audit programme that identifies and addresses nonconformities before the certification body arrives. Specifically:

Complete at least one full internal audit cycle covering all clauses and applicable Annex A controls before Stage 2.
Close all major nonconformities found in the internal audit with documented root cause analysis, corrective action, and effectiveness verification.
Hold a management review with documented minutes addressing all required inputs (Clause 9.3).
Brief staff who will be interviewed — not to rehearse answers, but to ensure they understand their roles in the ISMS and can explain what they do.
Organise evidence: auditors will request records. Having them organised by control area saves time and demonstrates operational discipline.

For guidance on the full implementation sequence, see the ISO 27001:2022 implementation roadmap and the ISMS documentation checklist.

Frequently asked questions

Can the same person conduct an internal audit and act as the ISMS owner?

No. Clause 9.2 requires that auditors be objective and impartial, which means they cannot audit activities they are responsible for. An ISMS manager can audit areas outside their own responsibilities but must not audit their own work.

What happens if the certification body finds a major nonconformity at Stage 2?

The certification body will not issue the certificate until the major nonconformity is closed. The organisation must provide objective evidence that the root cause has been addressed and the control or process is now operating effectively. Depending on the finding, this may require a follow-up visit or a review of submitted evidence.

How long does a Stage 2 certification audit take?

Duration depends on the size and complexity of the organisation. ISO/IEC 27006-1 provides formulas for calculating audit days based on employee numbers and site count. For a 250-person single-site organisation, Stage 2 typically takes two to three days on-site.

Is an internal audit required before the first certification audit?

Yes. The certification body will expect to see at least one complete internal audit cycle as part of the Stage 1 documentation review. An ISMS that has never been internally audited has not completed the management cycle that Clause 9 requires.

ThreatBlock's ISO 27001:2022 Readiness course includes practical internal audit methodology training to help you build an audit programme that prepares your organisation for certification.

About the author: Samaksh is Lead Instructor at ThreatBlock and holds the OSCP, CRTP, CRTO, and CEH certifications, with expertise in cybersecurity compliance and risk management. Read more on the author page · Editorial policy.