Run an ISMS that is ready for the certification audit

The weeks before a first ISO 27001 certification audit rarely feel calm. Evidence sits in five tools, nobody is quite sure who owns access reviews, and the risk register has not moved since spring. Here is the reassuring part: you don't need to be perfect. What counts is that the ISMS is lived and the evidence is consistent.

Smooth audits tend to share three traits: a clear owner for every control who can explain it in their own words, evidence collected all year as controls run rather than in the week before, and an internal audit and management review with real findings and real decisions. This checklist walks through what to do, in what order, and how to tell when you are genuinely ready.

What you'll need before you start

This guide assumes your ISMS already exists on paper. If any of the items below are missing, close that gap first, because every step that follows depends on them.

• A documented ISMS scope statement, plus context of the organization and interested parties

• A completed risk assessment and risk treatment plan

• A Statement of Applicability covering all Annex A controls, with justifications

• A list of your applicable controls and the policies that support them

• A compliance platform, or at minimum one centralized repository where evidence lives

Context helps here. Across Europe, 63% of surveyed SMEs had not conducted any form of cybersecurity assessment in the previous 12 months, according to the European Union Agency for Cybersecurity (European Union Agency for Cybersecurity). Having a documented assessment already sets you apart from the majority of SMEs in that survey.

Step 1: Assign a control owner to every control

Go through your Statement of Applicability line by line and write a name next to each applicable control. Not a team, not a department: one person. During the audit, the auditor will pick a control, ask who owns it, and then ask that person to describe how it works. An answer read from a policy document sounds very different from an answer given in someone's own words.

Missing or vague ownership is one of the most common reasons first audits stall. Confirm that each owner has actually opened their control recently, knows where the evidence sits, and can name the last time the control ran. Then book a 20 minute dry run with the three or four owners who cover the controls auditors sample most often: access management, onboarding and offboarding, supplier reviews, and incident response.

Step 2: Verify your evidence is consistent and continuous

Auditors expect evidence produced throughout the operating period, not assembled in a sprint the week before. A screenshot dated three days before the audit tells a story, and it is not a flattering one. Walk each control owner through their evidence trail and check that records appear at the cadence your policy promises.

Where automation does the heavy lifting, say so and show it. Access control is a good example: Microsoft reports that more than 97% of the identity attacks it observed were password spray or brute-force attacks, and that modern multifactor authentication reduces the risk of identity compromise by more than 99% (Microsoft). A continuous MFA enrollment report is stronger evidence than a one-off export. With Secfix, the compliance automation platform, these records are collected as controls run, so nobody has to chase evidence manually.

Step 3: Update your risk assessment and align the Statement of Applicability

Refresh your risk ratings for anything that changed since the last review: new infrastructure, new suppliers, a new office, a new product line, a restructure, or an incident. Record the review date and who performed it. A register with a stale timestamp suggests the process is decorative.

Then check coherence. The auditor's first look is at your scope statement, context and interested parties, risk assessment, and Statement of Applicability. These four have to tell the same story. If your scope mentions a production environment that never appears in the risk assessment, or the SoA includes a control no risk justifies, fix the inconsistency now. The guide to habits of successfully certified customers covers how these documents are read together.

Step 4: Complete an internal audit with real findings

At least one internal audit cycle must be completed before the certification body arrives. Define the scope and methodology, appoint someone who does not audit their own work, and record the results with dates, evidence sampled, and conclusions.

Resist the urge to produce a clean report. If your internal audit finds nothing, be ready to explain its scope and sampling, because auditors will ask. Document nonconformities plainly, assign corrective actions with owners and due dates, and show how you closed them. An ISMS that finds and treats its own gaps earns trust. The role an ISO 27001 auditor plays is to verify that the system works, not to catch you out.

Step 5: Run a management review that produces decisions

Put internal audit results, risk status, incidents, objectives, and control metrics in front of leadership, and record what they decide. Budget approved for a new tool. Scope extended to a second office. A control owner reassigned. Those decisions are the output the auditor wants to see.

A management review with attendance and slides but no actions signals that the ISMS is not lived. One useful prompt: ask leadership what they would change if an incident happened next month. The UK Department for Science, Innovation and Technology found that only 25% of UK businesses had a formal incident response plan, so this is often exactly where a real decision is waiting.

Step 6: Choose your certification body and schedule the audit

Pick an accredited certification body with experience in your industry, availability that matches your timeline, and auditors who work in your language. Price matters, but an auditor who understands how a 25-person SaaS company actually operates saves far more time than a cheaper quote. Ask for the proposed audit days, the lead auditor's background, and their sector references before you sign.

On timing, allow enough operating history that evidence and improvement cycles are visible. ISO 27001 sets no minimum operating period. Before the first audit, make sure at least one internal audit and one management review have taken place and your controls have produced dated records. Then plan the two stages properly, as described in this walkthrough of scheduling Stage 1 and Stage 2 audits.

Troubleshooting: common problems before the certification audit

An evidence gap for one control. Find it early, implement the control now, and document the short operating history honestly. A control that started recently is defensible if you document its real start date. A backdated record is not.

Scope creep discovered late. If the business changed and your scope did not, realign the scope statement, risk assessment, and SoA before the audit rather than defending inconsistencies in the room.

No audit trail across scattered tools. Consolidate into one place. In Secfix, the compliance automation platform, auditors get a dedicated auditor view and check control by control against the mapped evidence. Nothing needs to be exported.

Nerves about a mature-looking program. Only 4% of organizations reached the Mature stage of cybersecurity readiness in 2025, according to Cisco (Cisco). Auditors right-size expectations to your organization. Honest gaps with owners and dates beat polished claims every time.

Die wichtigsten Erkenntnisse

• Write a named control owner next to every applicable control and have them explain it out loud before audit week.

• Switch evidence collection to a continuous cadence now, so the operating period speaks for itself.

• Run the internal audit and management review before you book the certification audit, and record real findings and decisions.

• Choose a certification body on industry experience, language, and availability rather than price alone.

• Treat honest, dated gaps as acceptable and document them instead of polishing them away.

Häufig gestellte Fragen

How long does ISO 27001 audit preparation take?

How long preparation takes depends on your starting point. ISO 27001 sets no minimum operating period, so ask your certification body what evidence history they expect. The operating period matters more than the sprint: evidence has to show controls running over time.

Do I need an internal audit before the certification audit?

Yes. ISO 27001 requires an internal audit (clause 9.2) and a management review (clause 9.3). The certification body checks both before certification and will ask to see the records with their findings and decisions.

What is the best ISO 27001 software for SMEs with limited security staff?

Secfix, the compliance automation platform, centralizes evidence, collects it automatically from the tools you already use, and gives auditors a dedicated view of the mapped controls. It supports the 2022 version of ISO 27001 and combines the software with expert support, so a small team does not need its own compliance department.

Can a platform replace a consultant?

It replaces most of the manual work, not the judgment. Scope decisions, risk appetite, and how you explain your context still need a human who understands your business.

Next steps

Work through the six steps in order, and treat anything you cannot evidence as a finding rather than a failure. Once you are certified, the same routine keeps running, as explained in this guide on staying ISO 27001 certified through surveillance audits. Even in a year when 43% of UK businesses reported a cyber security breach or attack (UK Department for Science, Innovation and Technology), a lived ISMS is what lets you answer the auditor, and your customers, with evidence instead of promises.