How to Prepare for Your ISO 27001 Audit

Prepare for your ISO 27001 certification audit in ten steps

A successful ISO 27001 certification audit starts well before the opening meeting. The aim is not to produce a convincing folder for an auditor. It is to show that your information security management system, or ISMS, operates consistently, addresses relevant risks and improves when weaknesses emerge.

In November 2026, prepare against ISO/IEC 27001:2022, including its applicable amendment. The transition from the 2013 edition ended on 31 October 2025, according to IAF MD 26. A preparation plan still built around the old edition needs updating before you assess readiness.

Understand what the two stages establish

Initial certification normally involves two stages. Stage 1 evaluates readiness: the ISMS scope, documented information, understanding of requirements and arrangements for the next stage. It is broader than a document-format check.

Stage 2 evaluates implementation and effectiveness through interviews, sampling, observation and review of records. Agree delivery arrangements with the certification body rather than assuming every activity must happen physically on site.

Neither stage is a promise that every system will be technically tested. Certification concerns the management system within its stated scope; it does not guarantee the absence of vulnerabilities or incidents.

The ten preparation steps

1. Choose a suitable certification body

Check that the body has appropriate accreditation for ISO/IEC 27001 certification and understands your operating environment. Discuss the proposed scope, sites, remote working, outsourced activities and relevant technical complexity.

Agree scheduling early, based on actual availability and readiness. Avoid treating a generic booking window as a requirement. Clarify the audit plan, confidentiality arrangements, evidence access and how findings will be communicated.

2. Define a scope you can explain

Describe the services, organisational boundaries, locations and information systems included in the ISMS. Explain relevant interfaces and dependencies, including those outside your direct control.

A narrow scope is not automatically a good scope. If an excluded team administers an included service, that relationship still needs addressing. Ensure sales materials and internal communications do not suggest that certification will cover activities outside the agreed boundaries.

3. Finalise coherent, usable documentation

Prepare the information required by the standard and the records your own processes need. Core material includes the scope, security policy, risk assessment and treatment arrangements, Statement of Applicability, objectives, and evidence of evaluation and improvement.

Check consistency rather than volume. Does the risk treatment plan match the SoA? Do named owners still hold those responsibilities? Can employees find the current procedure?

Use documentation maintenance to organise policies and versions, but make content review a human responsibility. A controlled document can still describe an ineffective process.

4. Complete an objective internal audit

Plan an internal audit that covers the relevant requirements and implementation across the scope. Select auditors so the work is objective and impartial; avoid having someone simply approve their own activities.

Sample real records and follow transactions across processes. For example, trace a new starter from approval to account creation and access assignment. Record findings clearly, assign corrective actions and retain evidence of follow-up. A mock external audit does not automatically replace the internal audit programme.

5. Hold a meaningful management review

Give management a clear view of performance, changing context, audit results, risks, corrective actions and improvement opportunities. Present decisions needed, not just a collection of charts.

Record the resulting decisions, resource needs and responsibilities. Track follow-up so you can explain what changed because of the review. Also check consideration of climate relevance: ISO’s 2024 amendment requires an assessment of whether climate change is a relevant issue, rather than an automatic environmental programme.

6. Prepare people for their actual responsibilities

Employees should understand relevant security rules, their contribution to the ISMS and how to report concerns. Process owners need a deeper understanding of the risks, controls and evidence they manage.

Tailor preparation to the role. Ask a service desk analyst to explain identity checks, a developer to demonstrate secure development practices, and a manager to describe access approval. Awareness is not established solely by a training attendance record.

7. Build an evidence trail, not a screenshot archive

Create an evidence index linking requirements or controls to owners, source systems and records. Useful evidence can include access reviews, restore tests, supplier evaluations, incident handling records and completed corrective actions.

Check dates, scope and provenance. One successful example should not be presented as proof of universal compliance. Protect confidential information and agree how sensitive records will be reviewed.

Domyno’s controls and compliance module supports evidence, action plans and the SoA in a shared control library. This can organise preparation, but the evidence still needs to reflect real activity.

8. Rehearse interviews without scripting answers

Practise explaining a process and showing the supporting records. Useful prompts include: what can go wrong, what do you do, how do you know it happened, and what happens when it fails?

Encourage honest answers. If a record is missing, acknowledge it and explain the response. Coaching people to recite policy language can conceal gaps without helping anyone operate the process better.

9. Verify technical controls through representative checks

Select checks based on risk and applicable controls. Review access removal, privileged accounts, configuration baselines, vulnerability handling, logging and backup restoration where relevant.

A backup completion message is not the same as evidence that restoration works. Likewise, a deployed security tool does not demonstrate that alerts are reviewed. Trace exceptions and failures into decisions, actions and follow-up rather than hiding them until after certification.

10. Organise logistics and the response to findings

Confirm interview availability, site access, meeting arrangements and secure evidence sharing. Nominate a coordinator and a substitute. Give process owners enough context to participate without interrupting essential operations unnecessarily.

Agree how findings will be handled with the certification body. For each nonconformity, distinguish immediate correction from action addressing its cause. Retain implementation evidence and evaluate effectiveness; do not assume a revised document alone closes an operational weakness.

A final readiness check

Before the audit, use this short sequence:

1. Confirm that scope and responsibilities match current operations.
2. Sample the links between risks, controls, evidence and decisions.
3. Check internal audit and management review records.
4. Review unresolved findings and their treatment with accountable owners.
5. Confirm the audit plan and secure access arrangements.

Do not invent records or backdate approvals to make the evidence look complete. An honest gap with a controlled response is more useful than an unreliable audit trail.

Domyno combines SaaS with a dedicated human expert: agents prepare work and a human validates it. To organise your ISO 27001 preparation around responsibilities and usable evidence, request a demo.