ISO 27001 is the international standard for information security management. Having the certification means that the company has implemented a structured Information Security Management System, audited by independent third parties and compliant with globally recognized requirements. What many companies do not know is that an ISO 27001 audit is not a one-time event. It is a process with defined stages, technical prerequisites, and a maintenance cycle that continues after the initial certification. In this article, you will understand how the audit process works, what the stages are, how long it typically takes, and what the company needs to have in place before getting started. Enjoy the read.
What Is an ISO 27001 Audit?
An ISO 27001 audit is the formal verification, conducted by an accredited certification body, that a company’s ISMS meets the requirements of the standard. It evaluates not only whether security controls exist, but also whether they are documented, implemented, monitored, and continuously improved.
The standard follows the PDCA cycle: plan, do, check, and act. The audit verifies whether this cycle is actually working within the company, not merely described in documents.
Internal Audit and External Audit
Before reaching certification, the company needs to undergo two types of audits with distinct purposes.
The internal audit is conducted by the company itself or by an external consultant hired for this purpose. It serves to identify gaps before the official audit, verify that the implemented controls are working as documented, and prepare the team for the formal process. It does not result in certification, but it is a necessary step toward achieving it.
The external audit is conducted by a certification body accredited by INMETRO in Brazil or by equivalent bodies in other countries. This is the audit that results in ISO 27001 certification and formally validates that the ISMS meets the requirements of the standard.
The Stages of an ISO 27001 Audit
The certification process follows a sequence that most certification bodies divide into two formal stages, preceded by an internal preparation phase.
Preparation Phase
Before any contact with the certification body, the company needs to have its ISMS implemented. This includes having the certification scope defined and documented, the information security policy approved by management, the risk assessment and treatment process completed, the controls in Annex A of the standard implemented or justifiably excluded, and at least one complete internal audit cycle conducted.
This stage has no fixed timeline. It takes as long as necessary for the company to implement what the standard requires. For organizations starting from scratch, the implementation process typically takes between six months and one year before the company is ready to request the formal audit. Companies that already have structured security controls and compliance with information security standards can significantly reduce this timeframe.
Stage 1: Documentation Review
The certification body reviews the ISMS documentation to verify that it is complete and appropriate for the requirements of the standard. At this stage, the auditor evaluates whether the scope is clearly defined, whether the security policy has been approved, whether risks have been properly identified and treated, and whether the internal audit program has been carried out.
Stage 1 does not verify the practical implementation of controls, only the adequacy of the documentation. At the end, the auditor issues a report indicating what is compliant and what needs to be corrected before moving on to Stage 2. Any nonconformities identified at this stage must be addressed before proceeding.
Stage 2: Certification Audit
This is the on-site verification that the controls documented in Stage 1 have actually been implemented and are functioning. The auditor interviews employees, observes processes, reviews records, and tests whether what is written corresponds to what happens in practice.
Nonconformities found during Stage 2 are classified by severity. Major nonconformities block certification until they are corrected and verified. Minor nonconformities must be addressed within a defined timeframe after certification.
At the end of Stage 2, if the major nonconformities have been resolved, the certification body recommends certification. The ISO 27001 certificate is valid for three years.
How Long Does the Complete Process Take?
The total timeframe depends on three factors: the company’s size, the maturity of its security environment before starting, and its internal availability to carry out the implementation.
For a mid-sized company starting from scratch, the complete process, from initial implementation to certificate issuance, typically takes between 12 and 18 months. Smaller companies with simpler operations may complete it in 6 to 9 months. Larger organizations, with multiple locations or broader scopes, often exceed 18 months.
What has the greatest impact on the timeline is not the company’s size, but the number of gaps identified during the preparation phase and how quickly the organization can address them. Companies that have already undergone an independent technical assessment of their security environment before starting the certification process typically encounter fewer surprises during the audit and complete the cycle more quickly.
What Happens After Certification?
ISO 27001 certification is not permanent. The certificate is valid for three years, but during that period the certification body conducts annual surveillance audits to verify that the ISMS continues to operate as certified.
In the third year, the company undergoes a recertification audit, which repeats the Stage 2 process to renew the certificate for another three years.
This means that ISO 27001 requires a continuous improvement approach, not just a one-time certification effort. Companies that treat the ISMS as a project with an end date often struggle to maintain compliance during surveillance audits.
What Does the Company Need Before Getting Started?
In addition to the standard’s technical requirements, there are organizational elements that determine whether the process will move smoothly or stall.
Leadership commitment is the most critical. ISO 27001 requires evidence of senior management involvement, including approval of the security policy, allocation of resources, and participation in ISMS reviews. Without this formal commitment, the audit will identify the gap.
Defining the scope is also an area that many companies underestimate. A poorly defined scope can result in certification that does not cover the processes most relevant to customers and partners, or in a longer-than-necessary process because it includes areas that did not need to be part of the initial certification.
Finally, the company needs to have a routine for monitoring security metrics. The standard requires ISMS performance to be measured and the results to inform improvement decisions. This cycle needs to be functioning before the audit, rather than being created at the last minute to demonstrate it to the auditor. An environment that already has regular vulnerability assessment cycles naturally has part of this monitoring integrated into the process.
STWBrasil supports companies throughout the preparation process for ISO 27001 audits, from the initial ISMS assessment through internal audits and support during the formal certification stages. If your company is considering starting this process, talk to our team.
