ISO 27001:2022 audit readiness: what Stage 1 and Stage 2 actually test

Stage 1 is a documented-information review: scope, policy, risk process, Statement of Applicability, and whether you look prepared for sampling. A clean Stage 1 does not mean you will pass Stage 2. It means the auditor is willing to spend time in your systems.

Stage 2 tests operating controls. Auditors interview owners and follow evidence into ticketing, access reviews, supplier files, and change records. If you cannot show a period of operation — not a policy dated last Tuesday — Stage 2 will stall or produce major nonconformities.

Treat the ISMS as a management system with owners, metrics, and management-review minutes. If the CISO is the only person who can explain a control, you do not have a system; you have a bottleneck.

A useful readiness test: pick three Annex A themes that actually matter to your product (access, change, suppliers) and ask a non-security owner to show last quarter’s evidence without coaching. If they cannot, Stage 2 will not go better with a nicer SoA PDF.

Scope is a business decision disguised as a security one. “All products, all regions, all contractors” looks ambitious and wrecks sampling. Narrow to systems that actually process customer data, name the locations and suppliers in the boundary, then expand in a later cycle once you have a certificate to point at.

ISO 27001 does not replace SOC 2. Many companies keep both because US enterprise security reviews still want a Type II while EU and APAC procurement wants ISO. Decide that split before you staff two evidence factories that describe the same production environment in two dialects.

Annex A is not a shopping list. The SoA has to justify inclusions and exclusions against your risk assessment. Copying every control “just in case” creates procedures nobody runs. Excluding a control because it is inconvenient, with no residual-risk acceptance, is how Stage 2 findings are born.

Policies that describe weekly access reviews while Jira shows quarterly ones are more damaging than a missing policy. Registrars sample reality. Align the sentence with the ticket, or change the ticket.

Supplier and cloud clauses (A.5.19–A.5.23) fail when the ISMS talks about “AWS” and the contract pack has no security schedule, no shared-responsibility note, and no review cadence. Your hyperscaler’s ISO certificate is inheritance, not your control.

Internal audit that only walks the document set will not find the broken joiner-mover-leaver path. Use the same sampling logic the registrar will use: pick a control, pull a population, test a sample, write a nonconformity if it fails.

Certification-body shopping on price alone is another delay. A registrar who has never sampled a multi-tenant SaaS will burn days on diagrams you thought were obvious. Ask how they sample cloud scope before you lock the week.

Work the phases in order. Skipping to “Stage 2 readiness” while the SoA is still a draft is how you schedule an audit you cannot sit. Use the required-documents list as the pack index, not as decoration.

When a checkbox is ambiguous — “sufficient period of operation,” “interested parties” — that is a scope or evidence decision. Record the decision in the ISMS, then tick. The checklist stores progress in your browser; it does not store your SoA.