How do you prepare for an ISO 27001 audit?
Preparing for an ISO 27001 audit is all about demonstrability. Make sure the scope, risk analysis and Statement of Applicability are up to date and consistent, that policy lives on the work floor, and that the internal audit, management review and improvement actions have been carried out and recorded. The step-by-step plan below takes you to audit-ready, step by step.
The step-by-step plan
- Define the scope — what falls within the ISMS?
- Update the risk analysis — risks, owners, treatment plan.
- Statement of Applicability — link risks to Annex A controls.
- Policy & awareness — make sure staff know it and apply it.
- Internal audit — have this carried out independently.
- Management review — senior management evaluates and adjusts.
- Improvement actions — correct non-conformities and record evidence.
Common mistakes
- An SoA that does not match the risk analysis.
- Policy that does not live outside the folder.
- A management review that exists only on paper.
- Improvement actions without follow-up.
A gap analysis detects these gaps early.
ISO/IEC 27001 — official standard page (official source).
Frequently asked questions
Short, direct answers — written for people and for AI search functions alike.
For an organisation starting from scratch, setting up a working ISMS usually takes 3 to 9 months. If you already have many controls in place, preparing for the audit can take from a few weeks to a few months. A gap analysis gives you a realistic timeline.
The Statement of Applicability (SoA), because it links your risks to the controls and forms the core of the audit. In addition, the risk assessment, the policy and the evidence of internal audit and management review are crucial.
Yes. ISO 27001 requires at least one internal audit and one management review before you go for certification. These also provide the evidence that your improvement cycle works — exactly what the external auditor wants to see.
Yes. You can have the gap analysis, internal audit and pre-audit carried out by an independent party. The implementation itself and the ultimate responsibility remain with your organisation.
Want to know whether you are audit-ready?
Schedule a no-obligation audit scan and, within a single conversation, find out where you stand and what the next step is.
