ISO 27001 LI Domain 7: Preparing for an ISMS Certification Audit (6.25%)

Overview

Domain 7 looks at certification from the implementer's side of the table. Its nine knowledge statements cover the evidence-based approach to auditing, types of audit, differences between Stage 1 and Stage 2, the requirements and activities of each stage, documented information review criteria, audit follow-up, surveillance and recertification audits, and developing action plans after a certification audit.

Certification audits follow ISO/IEC 17021-1 and ISO/IEC 27006-1, with ISO 19011 and ISO/IEC 27007 as audit guidance. The implementer's role is to make sure the ISMS is complete, operating and evidenced before the auditors arrive, and to respond well to their findings. The domain is the smallest on the paper, with 5 of the 80 questions.

Why it matters on the exam

Five questions is a small share, but the stakes for a real project are high: a failed Stage 2 delays certification and costs money. The exam tests whether you know what each stage checks, so you can prepare the organization correctly. Common errors include booking Stage 2 before an internal audit and management review have been completed, expecting the certification body to advise on fixes, and confusing surveillance with recertification. Candidates also forget that action plans after the audit need root cause analysis and that major nonconformities must be resolved before certification can be granted. Because this domain closes the PECB course and builds on Domains 5 and 6, it is efficient to study last and links several earlier topics together.

How it's tested

Questions put you in the implementer's seat as certification approaches. You decide whether the organization is ready for Stage 1 or Stage 2, what the auditors will examine, how to respond to findings, and what happens during surveillance and recertification. Distractors often blur the roles of auditor, consultant and certification body.

Which stage

An activity, such as reviewing the Statement of Applicability or interviewing staff about controls, is assigned to Stage 1 or Stage 2.
Ready or not

A status report is given and you judge whether certification can proceed, usually by checking internal audit, management review and SoA completion.
After the findings

Audit findings are listed and you choose the right action plan or the timing of follow-up and surveillance.

Reasoning it through

An organization finished implementing controls last month and wants its Stage 1 next week. No internal audit or management review has taken place. The question asks the implementer's advice. Reason: certification bodies expect evidence that clauses 9.2 and 9.3 have operated before granting certification, and gaps found in Stage 1 may delay Stage 2. Advise completing an internal audit and management review first.

Knowledge statements 9

Official knowledge statements from the PECB outline, in outline order.

7.1 The evidence-based approach to an auditReaching audit conclusions from verifiable evidence.

What it means: Evidence-based approach is one of the ISO 19011 audit principles: conclusions must rest on verifiable information gathered through sampling. Audit evidence includes records, statements of fact and other information relevant to the audit criteria.
What to understand: Evidence comes from interviews, observation, document and record review, and technical checks. Because audits sample, the organization should keep records complete and retrievable across the whole period. Implementers prepare by ensuring that controls leave evidence, such as logs, signed approvals or review records.
How it shows up: Expect questions asking what auditors rely on, with verifiable records preferred over verbal assurance.
Common confusion: Expecting an auditor to accept management's word without records.

7.2 The types of audit and their differencesFirst-, second- and third-party audits.

What it means: First-party audits are internal audits the organization performs on itself. Second-party audits are performed by customers or others with an interest, such as supplier audits. Third-party audits are performed by independent certification bodies or regulators.
What to understand: Only third-party audits by an accredited certification body lead to accredited ISO/IEC 27001 certification. Combined audits cover several management systems at once; joint audits involve several audit organizations. Each type has a different purpose, independence level and reporting line.
How it shows up: Questions describe an audit, such as a bank auditing its outsourcing provider, and ask its type.
Common confusion: Labelling a customer audit of a supplier as third-party.

7.3 The differences between Stage 1 and Stage 2 auditsHow the two initial certification stages differ.

What it means: Stage 1 reviews the ISMS design and documented information, assesses readiness, confirms scope and plans Stage 2. Stage 2 evaluates implementation and effectiveness of the ISMS on site or remotely, including interviews, observation and sampling of records.
What to understand: Stage 1 findings may be classed as concerns that could become nonconformities at Stage 2. The gap between stages allows the organization to resolve issues. Stage 2 results form the recommendation to the certification body about granting certification.
How it shows up: Expect an activity to be matched with the stage in which it normally occurs.
Common confusion: Thinking Stage 1 tests control effectiveness in depth.

7.4 The Stage 1 audit requirements, steps, and activitiesWhat happens at Stage 1.

What it means: Stage 1 typically reviews the scope, policy, risk assessment and treatment methodology and results, the Statement of Applicability, objectives, internal audit and management review planning or results, and the organization's understanding of requirements. It checks site-specific conditions and readiness.
What to understand: Auditors confirm the information needed to plan Stage 2: processes, locations, legal requirements and resources. They report concerns in writing. For ISO/IEC 27001, ISO/IEC 27006-1 requires that Stage 1 obtains documentation on the ISMS design, including the SoA and risk outputs.
How it shows up: Questions ask what the organization should have ready for Stage 1.
Common confusion: Bringing only policies to Stage 1 without risk assessment and SoA results.

7.5 The documented information review criteriaHow auditors judge the ISMS documentation.

What it means: Documented information is reviewed for conformity with ISO/IEC 27001 requirements, completeness, consistency, adequacy for the scope and risks, appropriate approval and version control, and alignment with how the organization actually works.
What to understand: Auditors check that mandatory documented information exists, that the SoA is consistent with risk treatment, and that documents are current and controlled. Implementers should run their own review against these criteria before Stage 1 and remove contradictions between documents.
How it shows up: Expect a question on which document problem would most likely concern auditors, such as an SoA inconsistent with the risk treatment plan.
Common confusion: Assuming more pages make documentation more acceptable.

7.6 The Stage 2 audit requirements, steps, and activitiesWhat happens at Stage 2.

What it means: Stage 2 includes an opening meeting, collecting evidence on implementation of every requirement and selected controls, performance monitoring against objectives, internal audits and management review, operational control, and leadership commitment, followed by a closing meeting with findings and a recommendation.
What to understand: Implementers prepare guides, staff availability, records and access for auditors. Staff should be ready to explain their roles truthfully. The organization can dispute findings with evidence but should not argue opinions. Any nonconformities need action plans afterwards.
How it shows up: Questions ask how the organization should prepare staff or what the auditors will sample.
Common confusion: Coaching staff with scripted answers rather than ensuring real understanding.

7.7 The audit follow-up requirements, steps, and activitiesClosing findings after the audit.

What it means: After the audit, the organization submits corrections and corrective action plans within the certification body's deadline. For major nonconformities, the certification body verifies correction and corrective action before certification, sometimes through a follow-up visit. For minors, it reviews and accepts the plans.
What to understand: Under ISO/IEC 17021-1, if majors cannot be verified within the time limit, often six months after Stage 2, another Stage 2 may be required. Minor plan implementation is checked at the next surveillance audit. The certification decision is made by the certification body after review.
How it shows up: Expect questions on what must happen before certification when a major nonconformity was raised.
Common confusion: Believing the lead auditor issues the certificate at the closing meeting.

7.8 The surveillance audits and recertification audit requirements, steps, and activitiesKeeping certification over the three-year cycle.

What it means: Certificates are valid for three years. Surveillance audits take place at least once a year, with the first within twelve months of the certification decision. A recertification audit before expiry evaluates the whole ISMS for continued conformity and effectiveness.
What to understand: Surveillance covers internal audits, management review, action on previous findings, complaints, changes and use of the certificate, plus a sample of other areas. Recertification reviews performance over the cycle and may include Stage 1 if significant changes occurred. Failure to correct nonconformities can lead to suspension or withdrawal.
How it shows up: Questions ask how often surveillance occurs or what recertification evaluates.
Common confusion: Thinking surveillance audits re-examine every clause and control each year.

7.9 The requirements, guidelines, and best practices for developing action plans following an ISO/IEC 27001 certification auditResponding to certification audit findings.

What it means: For each finding the organization defines the correction, analyses root cause, plans corrective action with owners and dates, and plans effectiveness review. Plans are submitted to the certification body and tracked internally through the clause 10.2 process.
What to understand: Good plans are specific, address the cause, consider whether similar issues exist elsewhere, and are realistic within the certification body's deadlines. Opportunities for improvement are considered but are not mandatory. The organization owns its plans; the auditor may evaluate but not design them.
How it shows up: Expect a plan to evaluate for completeness, or a question on who writes it.
Common confusion: Asking the certification auditor to write the corrective action plan.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

Evidence-based approach

Audit conclusions rely on verifiable evidence from sampling.

Remember
ISO 19011 audit principle.

Tested as
Audit basics items.

Trap
Accepting verbal claims.
Third-party audit

Audit by an independent body such as a certification body.

Remember
Only route to accredited certification.

Tested as
Audit type items.

Trap
Calling customer audits third-party.
Stage 1

Review of ISMS design, documents and readiness.

Remember
Plans Stage 2 and raises concerns.

Tested as
Stage assignment items.

Trap
Expecting deep effectiveness testing.
Stage 2

Evaluation of implementation and effectiveness.

Remember
Ends with the recommendation on certification.

Tested as
Stage assignment items.

Trap
Booking it before internal audit and review.
Certification decision

Made by the certification body after audit review.

Remember
Not made by the audit team.

Tested as
Roles items.

Trap
Certificate expected at closing meeting.
Surveillance audit

At least annual audit of part of the ISMS.

Remember
First within twelve months of certification decision.

Tested as
Cycle timing items.

Trap
Assumed to cover everything.
Recertification audit

Full evaluation before the three-year certificate expires.

Remember
Reviews performance over the cycle.

Tested as
Cycle items.

Trap
Confused with surveillance.
ISO/IEC 27006-1

Requirements for bodies certifying ISMSs.

Remember
Supplements ISO/IEC 17021-1 for ISO/IEC 27001.

Tested as
Reference standard items.

Trap
Confused with ISO/IEC 27007 audit guidance.
Follow-up audit

Visit to verify actions on major nonconformities.

Remember
Used when document evidence is insufficient.

Tested as
After-findings items.

Trap
Expected for every minor.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Stage 1 vs. Stage 2

Concept	Meaning	Key difference	Common trap
Stage 1	Design, documentation and readiness review	Checks whether the ISMS is ready	Treated as optional
Stage 2	Implementation and effectiveness evaluation	Checks whether the ISMS works	Scheduled before records exist

First-, second- and third-party audits

Concept	Meaning	Key difference	Common trap
First-party	Internal audit by or for the organization	Self-assessment	Thought to lack value
Second-party	Customer or interested party audit	Contractual interest	Called third-party
Third-party	Independent certification or regulatory audit	Leads to certification	Assumed to give advice

Surveillance vs. recertification

Concept	Meaning	Key difference	Common trap
Surveillance	At least yearly sample of the ISMS	Maintains certification	Assumed to be full scope
Recertification	Full review before expiry	Renews the three-year cycle	Scheduled after expiry

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

Certificate at closing

What candidates pick
The lead auditor confirms certification at the closing meeting.

Why it looks right
The audit seems complete.

Why it's wrong
The audit team recommends; the certification body decides after reviewing the audit through independent staff.

Clue to watch for Option names the lead auditor as granting certification.
Stage 2 too early

What candidates pick
Proceed to Stage 2 immediately after controls are deployed.

Why it looks right
Implementation is finished.

Why it's wrong
Without operating records, internal audit and management review, Stage 2 cannot confirm effectiveness and majors are likely.

Clue to watch for Scenario mentions no internal audit yet.
Customer audit as third-party

What candidates pick
A client's audit of its supplier is a third-party audit.

Why it looks right
The client is external to the supplier.

Why it's wrong
Audits by customers or interested parties are second-party; third-party audits are by independent bodies.

Clue to watch for Auditor has a business relationship with the auditee.
Auditor as consultant

What candidates pick
Ask the certification auditor to propose corrective actions.

Why it looks right
The auditor understands the gap.

Why it's wrong
Certification bodies must not provide consultancy; the organization designs its own actions.

Clue to watch for Option involves the auditor designing solutions.
Surveillance covers all

What candidates pick
Each surveillance audit reviews the entire ISMS.

Why it looks right
It sounds thorough.

Why it's wrong
Surveillance samples areas plus mandatory items such as internal audit, management review and previous findings; the full review happens at recertification.

Clue to watch for Question contrasts annual and three-year audits.

Answer framework

For certification questions, check readiness, identify the audit stage, assign the correct role and follow findings to closure.

Confirm the ISMS has operated long enough to produce records, including at least one internal audit and one management review covering the full scope.
Identify which audit is involved, Stage 1, Stage 2, follow-up, surveillance or recertification, and recall what that audit examines.
Prepare documented information against review criteria so it is complete, consistent, approved and aligned with actual practice.
Keep roles clear: the audit team gathers evidence and recommends, the certification body decides, and the organization designs its own actions.
After findings, submit corrections and corrective action plans with root cause analysis within the deadline, and track them through clause 10.2.

Practice question

During Stage 2, auditors raise one major nonconformity because no risk treatment plan exists for a newly added data centre, plus two minor nonconformities. What must happen before the certification body can grant certification?

Nothing further, because the lead auditor can recommend certification with open findings The organization must schedule a full new Stage 1 audit Only the two minor nonconformities need accepted action plans Correction and corrective action for the major must be verified, and plans for the minors accepted

Show the answer

Answer D. Under ISO/IEC 17021-1, the certification body must review, accept and verify the correction and corrective action for a major nonconformity before granting certification, and review and accept plans for minors. A recommendation alone is not enough while a major is open. A new Stage 1 is not normally needed unless deadlines lapse or scope changes significantly, and ignoring the major is not permitted.

Want more like this? The ISO 27001 LI practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Read ISO 19011 clause 4 on audit principles and clause 6 on conducting audits, then skim ISO/IEC 17021-1 clause 9 on certification process requirements and ISO/IEC 27006-1 on ISMS-specific additions. Summarize the certification cycle as a timeline: Stage 1, Stage 2, decision, surveillance in years one and two, recertification before year three ends.

Next, build a readiness checklist for a fictional organization. Include mandatory documented information, operating records for key controls, a completed internal audit, a management review with decisions, closed or planned corrective actions and staff briefed on their roles. Use it to judge three short scenarios as ready or not ready.

Then practise responding to findings. Take one major and two minor findings, write corrections, root causes, corrective actions, owners, deadlines and effectiveness checks, and test each against clause 10.2. Since the domain has only five questions, spend proportionate time, but revisit it after Domains 5 and 6 because the ideas overlap. Finish with short mixed sets of questions on audit stages and roles.

FAQ

How many exam questions cover Domain 7, Preparing for an ISMS Certification Audit?

Five of the 80 questions, or 6.25% of the exam, according to the PECB handbook. It is the smallest domain.

Must an internal audit be completed before certification?

Certification bodies expect evidence that clause 9.2 internal audit and 9.3 management review have been performed for the ISMS before Stage 2, since these are requirements of the standard.

How long is an ISO/IEC 27001 certificate valid?

Three years, with surveillance audits at least annually and a recertification audit before expiry.

Can the certification auditor help us fix nonconformities?

No. Certification bodies must remain impartial and cannot provide consultancy. They evaluate your plans and evidence but do not design solutions.

Does an implementer need to know audit standards?

Yes, at a practical level. Knowing ISO 19011 principles and the certification process helps implementers prepare evidence and respond to findings, though detailed audit management is a Lead Auditor topic.

What happens if a major nonconformity is not resolved in time?

The certification body may not grant certification. If correction cannot be verified within its time limit, a new Stage 2 audit may be required. For certified organizations, suspension is possible.

Related domains

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

ISO 27001 LI Domain 7: Preparing for an ISMS Certification Audit

Overview

How it's tested

Which stage

Ready or not

After the findings

Knowledge statements 9

High-yield concepts

Evidence-based approach

Third-party audit

Stage 1

Stage 2

Certification decision

Surveillance audit

Recertification audit

ISO/IEC 27006-1

Follow-up audit

Side by side

Stage 1 vs. Stage 2

First-, second- and third-party audits

Surveillance vs. recertification

Exam traps

Certificate at closing

Stage 2 too early

Customer audit as third-party

Auditor as consultant

Surveillance covers all

Answer framework

Practice question

Checklist

Study strategy

FAQ

Other Cybersecurity certifications

Test your Domain 7 knowledge

Keep going