ISO 27001 audits for SMBs: interviews, sites, and evidence

An ISO 27001 certification audit is the two-stage assessment an accredited certification body runs to confirm that your ISMS satisfies every requirement in Clauses 4 to 10, and that the controls declared in your Statement of Applicability are genuinely implemented and effective.

For a lean team, the hard part isn't the standard itself. It's the uncertainty. Which records will the auditor pull? Which colleagues will they want to speak to? Does that second office actually need a visit? This guide walks through what gets checked on each audit day, how auditors select people and evidence, how multi-site and remote audits work in practice, and how SMBs can prepare without a dedicated security department.

Certification is no longer a niche pursuit. The ISO Survey counted 83,016 valid ISO/IEC 27001 certifications worldwide in 2023, spread across 165 countries (International Organization for Standardization). The audit process described below applies just as much to small teams with cloud infrastructure and no full-time CISO as it does to large enterprises.

What happens during a Stage 1 audit?

Stage 1 is a readiness review. The auditor checks whether your management system exists on paper, whether the scope makes sense, and whether the foundational processes have actually run at least once. Nobody is testing your firewall rules yet.

Think of it as a structured sanity check before the real examination. Its length depends on your scope and your certification body, and it often happens remotely. The output is a report listing observations, concerns, and anything that must close before Stage 2 can proceed. Getting the sequencing of both audit stages right is one of the quieter determinants of your overall timeline.

What the auditor reviews on paper

The document set is predictable, and that predictability is your friend. Expect the auditor to work through:

• The scope statement, including which products, teams, locations, and information assets sit inside the ISMS, and the justification for anything excluded.

• The risk assessment methodology and the risk register, with attention to whether risks are owned, scored consistently, and tied to treatment decisions.

• The Statement of Applicability, checked against the risk treatment plan so that inclusions and exclusions line up with your actual risk picture.

• Core policies and procedures, with version history, approval dates, and evidence they've been communicated.

• Clause-level documentation: leadership commitment, objectives, competence records, and the documented information controls in Clause 7.5.

The most common Stage 1 criticism isn't a missing document. It's an inconsistency between documents. A risk register that names ten risks while the Statement of Applicability justifies exclusions on different grounds will attract questions immediately. Auditors read these artifacts against each other, not in isolation.

Internal audit and management review: why they must already be done

Clauses 9.2 and 9.3 require an internal audit and a management review, and your certification body will confirm both have occurred at least once before Stage 2. This is the single most frequent reason an SMB's timeline slips.

Teams build controls diligently, connect their tooling, write their policies, and then discover six weeks before the audit that nobody has run a full internal audit cycle or convened leadership for a documented management review. Both take real calendar time: an internal audit needs an independent reviewer, a plan, findings, and corrective actions. A management review needs minutes that show inputs, decisions, and resource commitments, not a calendar invite.

There's a related maturity gap worth noting. Risk assessment practice is improving but still far from universal among smaller organizations: 48% of UK small businesses said they carried out cybersecurity risk assessments in 2025, up from 41% in 2024 (UK Department for Science, Innovation and Technology). If risk assessment is new to your organization, build in time for the first cycle to be slower than the ones that follow.

What a Stage 1 finding means for your timeline

A Stage 1 finding isn't a failure, and the certification body won't issue a pass or fail verdict at this stage. What it will do is decline to schedule Stage 2 until the gaps close.

Minor observations, such as a policy missing an owner, can usually be cleared in days. Structural gaps are different. A scope that doesn't match how the business operates, a risk assessment with no treatment plan, or a missing internal audit can push Stage 2 back, depending on how quickly the findings are closed. That's the real cost: not a failed certificate, but a delayed one, often while a customer waits.

Treat the Stage 1 report as a free gap analysis from someone who will audit you properly later. Close everything on it, and do so in a way the same auditor can verify quickly.

What does the auditor check in a Stage 2 audit?

Stage 2 shifts from documentation to proof. The auditor tests whether your ISMS actually operates: whether the controls in the Statement of Applicability are implemented, whether people follow the procedures you wrote, and whether the system produces measurable results.

This is where interviews, evidence sampling, and observation come together over several consecutive days. The number of audit days is set by the certification body based on headcount, complexity and number of sites. The auditor's role in certification is to gather objective evidence, not to consult, so expect questions rather than suggestions.

How auditors sample evidence across Clauses 4 to 10

Auditors sample. They don't review every record, because no audit budget would allow it. Instead they pick a representative slice and look for consistency.

A typical sampling pattern for an SMB looks like this:

1. Pick a control from the Statement of Applicability, for example access rights review.

2. Ask for the procedure that governs it and who owns it.

3. Request records covering a defined period: the last two quarterly reviews, the tickets that triggered them, the approvals.

4. Trace one case end to end, such as a single leaver, from the HR offboarding record to the deprovisioning ticket to the confirmation that access was revoked.

5. Look for the exception and ask what happened when the process didn't run cleanly.

That last step matters more than teams expect. Auditors are often more interested in your exceptions than your clean cases, because an exception shows whether the management system notices and corrects itself. Corrective actions that were raised, assigned, and genuinely closed carry far more weight than a register full of open items.

Observation and walkthroughs

Records tell you what someone wrote down. Observation tells the auditor what actually happens. Expect walkthroughs where you demonstrate a process live rather than describing it.

In a cloud-native company this usually means screen sharing: pulling up the identity provider to show MFA enforcement, running a query against logging infrastructure, or walking through a pull request that shows code review in practice. Where there's a physical office in scope, the auditor may walk the floor to check clear desk practice, visitor handling, server room access, and secure disposal. None of this requires theater. It requires that the person doing the demo knows their own system.

How effectiveness is measured

Clause 9.1 asks you to monitor and measure the ISMS, and this is where many first-time certifications get thin. Implementation is binary and visible. Effectiveness has to be argued with data.

Auditors look for metrics that connect to your objectives: patch latency against a target, phishing simulation results over time, incident response times, training completion rates, supplier review coverage. Then they look for the loop. Did anyone review those numbers? Did a bad trend prompt a decision? Did the decision show up in the management review minutes?

Incident response is a reliable pressure point, because the paperwork often outpaces the practice. Only 25% of UK businesses had a formal incident response plan in 2025/2026 (UK Department for Science, Innovation and Technology). If yours exists but has never been tested, run a tabletop exercise before Stage 2 and keep the notes. A tested plan with imperfect results is stronger evidence than an untested plan that reads beautifully. Teams that run the audit process well tend to treat these exercises as routine rather than as audit preparation.

Who gets interviewed during an ISO 27001 audit?

Auditors interview the people who own and operate controls. That typically means the ISMS manager, senior leadership, IT and engineering, HR, and a sample of regular employees who have no compliance role at all.

The last group surprises people. The auditor isn't trying to catch anyone out. They're testing whether security awareness reaches beyond the project team, which is the difference between a management system and a documentation exercise.

How auditors choose interview subjects

Selection follows the audit plan, which you'll receive in advance. The auditor maps controls to owners and builds a schedule around the areas carrying the most risk, the parts of the scope that changed recently, and anything flagged at Stage 1.

Three patterns repeat across SMB audits:

• Top management gets its own session. Clause 5 requires demonstrated leadership, so a founder or executive will be asked about objectives, resourcing, and the management review. Delegating this slot is a mistake.

• Control owners are chosen from the Statement of Applicability. If a control names you, expect a conversation about it.

• Frontline staff are sampled, sometimes on the day. The auditor may ask to speak with whoever is available in a given team.

Preparing control owners and staff for auditor questions

Brief people, but don't script them. A rehearsed answer that doesn't match the evidence creates a far worse impression than an honest "I'd check our policy page for the exact timeline, but here's how we handle it."

Questions asked of general employees are usually straightforward: how would you report a suspected phishing email, where do you store customer data, what happens when you get a new laptop, have you completed security training. Those answers depend entirely on whether awareness training actually landed, and training coverage remains uneven across smaller firms: 33% of UK small businesses had provided cybersecurity training or awareness sessions in the previous 12 months in 2025/2026 (UK Department for Science, Innovation and Technology).

A practical briefing takes fifteen minutes per team. Explain what the audit is, who the auditor is, that honest answers are expected, and that "I don't know, but I know who does" is a perfectly good response. Then make sure control owners can find their own evidence without asking the ISMS manager for every file.

How do multi-site certification audits work?

The certification body samples sites. It doesn't necessarily visit all of them. Under the accreditation rules governing multi-site certification, the auditor selects a representative subset based on risk, and the sample is generally based on the square root of the number of sites, adjusted for risk. Your certification body determines the actual sample.

For an SMB with a headquarters, a satellite development office, and a sales presence in another country, that often means headquarters plus one other location in the initial certification, with the rotation covering the rest across the three-year cycle.

Site sampling criteria

Several factors push a location into or out of the sample:

• Risk profile. A site that hosts infrastructure, handles regulated data, or runs customer support with production access ranks higher than a shared coworking desk.

• Headcount and activity type. Larger sites and sites performing distinct functions get selected more often.

• Degree of centralization. If every site runs the same processes administered centrally, sampling can be lighter. If local teams run their own variations, each variation needs coverage.

• Audit history. A site with prior nonconformities is likely to reappear in the sample.

• Recent change. New offices, acquisitions, or newly in-scope teams attract attention.

Central functions vs. local operations

Central functions are always audited, regardless of which sites get sampled. If your IT, HR, security, and ISMS management sit in one place, that place is audited every cycle.

This is good news for most SMBs. A company that administers identity centrally, manages devices through one MDM, and runs a single HR onboarding process has very little site-specific variation to examine. The local part of the audit reduces to physical security and local awareness, which is quick. Where it gets heavier is when a local office maintains its own supplier relationships, its own network, or its own hiring process. Those are genuinely separate control implementations, and the auditor will treat them that way.

Cloud-native and remote-first companies

If your workforce is distributed and your infrastructure is in the cloud, "site" becomes a thin concept. There's often no server room, no local file store, and no physical perimeter worth sampling.

That reflects how European businesses now operate: 52.74% of EU enterprises used paid cloud computing services in 2025, an increase of 7.42 percentage points from 2023 (Eurostat). In these organizations, the audit concentrates on cloud configuration, identity, endpoint management, and the controls that follow employees home: device encryption, screen locks, home network guidance, and secure handling of printed material.

Be explicit about this in your scope statement. Define whether home offices are in scope, how remote workers are covered by policy, and what physical controls apply. An auditor who has to infer your remote working model will ask many more questions than one who reads it clearly stated.

Can ISO 27001 audits be done remotely?

Yes, and for cloud-native SMBs it's now routine. The certification body makes the call, weighing whether the evidence can be examined reliably over video and screen share, and accreditation rules set limits on how much of an audit can be conducted this way.

Stage 1 is remote more often than not. Stage 2 is frequently hybrid: a remote block for documentation, evidence, and most interviews, plus an on-site day if physical controls carry meaningful risk.

When remote audits are appropriate

Remote works well when the evidence is digital and the physical risk is low. A software company running on a major cloud provider, with managed laptops and no on-premise servers, is close to the ideal case. Small EU firms are moving in exactly that direction, with 49.3% of small EU businesses using paid cloud computing services in 2025, up 7.48 percentage points from 2023 (Eurostat).

On-site attendance becomes more likely when you operate a data center or server room, handle physical media or paper records at scale, manufacture something, or run facilities where visitor control and physical access are substantive controls rather than formalities.

What changes in a remote audit day

The content doesn't change. The logistics do, and they need more deliberate management.

• Evidence moves through screen share. Decide in advance who drives, and make sure that person can navigate your systems without fumbling through tabs.

• Interviews are scheduled tightly. There's no corridor conversation, so every session needs a calendar slot and a confirmed attendee.

• Days are often shorter and more numerous. Video fatigue is real, and auditors frequently split remote audits across more calendar days.

• Technical failure costs time. Test the conferencing setup, screen sharing permissions, and any guest access to your compliance tooling beforehand.

• A clean host matters. Whoever shares their screen should close everything unrelated. Auditors notice what they see.

What happens during surveillance audits after certification?

Surveillance audits are shorter, narrower checks conducted in years one and two of the three-year cycle. The auditor doesn't re-examine the entire ISMS. They sample different clauses, controls, departments, and sites each time, so that the full scope is covered across the cycle.

Certain items appear every single time: internal audit results, management review, corrective actions from the previous audit, changes to scope, and your continued use of the certification mark. Beyond that fixed core, the focus rotates. Year three brings recertification, which looks much more like a full Stage 2.

Rotation of focus areas

Predicting the rotation is less useful than it sounds, because auditors deliberately vary it. What you can predict is that anything you struggled with last time will come back, and that a department untouched in the first surveillance will likely feature in the second.

Material change pulls focus too. A new product line, a cloud migration, a first office outside your home country, or a sizeable acquisition will draw the auditor's attention regardless of where the rotation had landed. Tell your certification body about significant changes rather than letting them surface during the audit. Understanding what maintaining certification involves between audits is what keeps surveillance visits uneventful.

Keeping evidence current between audits

The sprint model collapses here. You cannot reconstruct twelve months of access reviews the week before a surveillance audit, because the records are supposed to carry dates.

The organizations that find surveillance easy are those collecting evidence continuously: access reviews on a fixed quarterly cadence, supplier assessments triggered by renewal dates, risk register reviews tied to a recurring meeting, training assigned automatically at onboarding. The administrative weight drops dramatically once these run on schedule rather than on memory.

There's a security argument too, not just an audit one. Among small and medium-sized EU enterprises with 10 to 249 employees, 21.0% experienced ICT security incidents with consequences in 2024 (Eurostat). Controls that only operate in audit season aren't protecting you for the other ten months.

How can SMBs with limited security staff prepare efficiently?

Most certified SMBs don't employ a full-time CISO. They assign a part-time ISMS owner, usually a technical founder, head of engineering, or operations lead, distribute control ownership across existing roles, and buy tooling or advisory support for the parts that don't justify a hire.

That model works, but only if ownership is genuinely distributed. The common failure is one person carrying everything: writing the policies, gathering the evidence, running the internal audit, and then facing every auditor question alone. It's fragile, and auditors can tell.

Assigning control owners across the organization

Map each applicable control to a named person whose day job already touches it. Engineering owns change management, secure development, and logging. IT or whoever administers your identity provider owns access control and endpoints. HR owns screening, onboarding, offboarding, and training records. Finance or operations owns supplier management. Leadership owns objectives, resourcing, and the management review.

Then give each owner three things: the procedure that governs their control, the place their evidence lives, and a recurring reminder. That's the whole mechanism. During the audit, each owner speaks to their own area, the ISMS manager coordinates rather than performs, and the load stays proportionate.

The stakes justify the structure. Mastercard reported that 46% of SMB leaders had experienced a cyberattack at their current business, rising to 65% when attacks at previous employers were included (Mastercard). Confidence in the response, meanwhile, lags the effort: 86% of SMBs had conducted an active cybersecurity risk assessment and had a prevention plan, but only 23% were very satisfied with that plan (Mastercard). Smaller organizations also face a different attack mix: Verizon found that ransomware was involved in 88% of breaches affecting SMBs, compared with 39% of breaches at larger organizations (Verizon).

Using compliance software to organize evidence and track gaps

Compliance platforms don't issue certificates, and no tool removes the need for an accredited certification body. What this category of software does is reduce the manual work around the standard: mapping Annex A controls, pulling evidence automatically from cloud and identity systems, maintaining the Statement of Applicability, assigning owners and due dates, and flagging when evidence goes stale.

For most SMBs, the question is less which tool to buy and more how much of the work you want to automate and how much guidance you need along the way. Secfix, the compliance automation platform, connects to your cloud, identity and HR systems, collects evidence automatically and maps it to your ISMS. Built in Europe, Secfix covers the frameworks European organizations tend to need alongside ISO 27001, such as NIS 2, GDPR and TISAX, on one platform, and combines the software with expert support for the audit. When you plan your budget, look at the full cost of tools, consultants and internal time rather than license fees alone, since certification body fees come on top of any platform.

Set expectations honestly about what automation reaches. Readiness is widely overestimated: only 4% of organizations reached Cisco's Mature stage of cybersecurity readiness in 2025, while 71% said a cybersecurity incident was likely to disrupt their business within the next 12 to 24 months (Cisco). Software organizes the proof. It doesn't make the decisions about scope, risk appetite, or control design, and auditors will ask you about all three.

Die wichtigsten Erkenntnisse

• Complete your first internal audit and management review before Stage 2. Your certification body will check that both have been performed.

• Assign every applicable control to a named owner in the role that already performs the work, then let that person answer the auditor directly.

• Ask your certification body early which sites it intends to sample and whether the audit will be remote, hybrid, or on site, so you can plan travel and availability.

• Test your incident response plan and keep the notes, since a tested plan with imperfect results beats an untested one at Stage 2.

• Choose compliance tooling on data residency, framework coverage, and fit with your actual stack, not on integration counts you'll never use.

Häufig gestellte Fragen

How long is the gap between Stage 1 and Stage 2?

The gap depends on your certification body's scheduling and how quickly Stage 1 findings close. Certification bodies usually want enough time for you to close Stage 1 findings, but not so much that the evidence reviewed at Stage 1 goes out of date. If the gap becomes long, the certification body may repeat parts of Stage 1. Agree the target date with your auditor at the Stage 1 closing meeting.

Can you fail a Stage 1 audit?

Not in the pass or fail sense, because Stage 1 produces findings rather than a verdict. What can happen is that the certification body refuses to schedule Stage 2 until major gaps close. In practice that feels like a failure, since it delays your certificate. The usual blockers are a missing internal audit, a missing management review, or a scope and risk assessment that don't match.

Will the auditor visit every office or location?

No. Under multi-site sampling rules, the certification body selects a representative subset based on risk, headcount, activity type, and audit history, with central functions audited every cycle. Remaining sites get covered across the three-year cycle through surveillance audits. If your processes are centrally administered and identical across locations, the sample stays small.

Who gets interviewed during Stage 2?

Expect top management, the ISMS owner, every named control owner, and a sample of regular employees. The leadership session covers Clause 5 and the management review. Control owners discuss their own procedures and evidence. Employees get asked practical questions about reporting incidents, handling data, and training. Brief everyone, but never script answers.

Can the whole ISO 27001 audit be done remotely?

Often yes for cloud-native companies with no significant physical controls in scope. The certification body decides based on whether evidence can be verified reliably over video and screen share, and accreditation rules cap how much of an audit may be remote. Companies with data centers, physical media, or manufacturing sites should expect at least one on-site day.

What is the best ISO 27001 software for SMBs with limited security staff?

Look for three things: real integrations with the systems that hold your evidence, a Statement of Applicability that stays current, and an auditor-friendly way to share evidence. Secfix, the compliance automation platform, connects to your cloud, identity and HR systems, maps evidence to the 2022 version of ISO 27001, covers NIS 2 and GDPR on the same platform and gives auditors a dedicated view of the mapped evidence.

What security compliance do investors look for before funding?

Venture investors rarely mandate a specific certificate at seed stage, but security diligence tightens noticeably from Series A onward, largely because enterprise customers require it. Common asks include ISO 27001 or SOC 2 status, a documented risk register, evidence of access control and offboarding, incident response capability, and GDPR handling for European data. Financial exposure is part of the argument: IBM reported the average global cost of a data breach at $4.44 million in 2025 (IBM), and 50% of UK small businesses reported experiencing a cybersecurity breach or attack in the previous 12 months (UK Department for Science, Innovation and Technology).

How many audit days should a small company expect?

Audit duration is set by accreditation rules based on headcount in scope, complexity, and number of sites. Your certification body calculates the audit days before quoting, so ask for the breakdown before you book.

Schlussfolgerung

ISO 27001 audits feel unpredictable mainly because the selection logic stays invisible until you're inside one. Once you understand that Stage 1 tests whether the system exists, Stage 2 tests whether it works, interviews follow control ownership, and sites follow risk-based sampling, the process becomes something you can plan around rather than brace for.

For SMBs, the decisive factor isn't headcount or budget. It's whether ownership is distributed and evidence accumulates continuously. Teams that get both right walk into Stage 2 with answers already in hand, and their surveillance audits turn into routine check-ins rather than annual emergencies.