If your organization is pursuing ISO 27001 certification, understanding the difference between internal and external audits — and how to prepare for both — is the single most important step you can take. Failing to prepare properly is the most common reason organizations delay certification or face costly non-conformities.

This guide breaks down exactly what each audit involves, what auditors look for, and how to walk into every audit with confidence.

What Is an ISO 27001 Audit?

An ISO 27001 audit is a formal review of your Information Security Management System (ISMS) to verify that it meets the requirements of the ISO/IEC 27001 standard. The audit assesses whether your organization has implemented appropriate controls to protect the confidentiality, integrity, and availability of information assets.

There are two primary types of ISO 27001 audits you will need to prepare for:

• Internal audits (conducted by your own team or a third-party consultant)

• External audits (conducted by an accredited certification body)

Understanding the purpose and scope of each is critical before you begin preparing documentation or evidence.

Internal ISO 27001 Audits: What to Expect

What Is an Internal Audit?

An internal ISO 27001 audit is a self-assessment your organization conducts to evaluate how well your ISMS is functioning before the external certification audit. It is a mandatory requirement under Clause 9.2 of the ISO 27001 standard.

Internal audits must be planned, documented, and carried out by personnel who are objective and impartial — meaning they should not audit their own work.

What Do Internal Auditors Check?

Internal auditors typically review the following areas:

• ISMS scope and boundaries

• Risk assessment and risk treatment documentation

• Statement of Applicability (SoA)

• Policies, procedures, and controls in Annex A

• Evidence of control implementation

• Incident management records

• Training and awareness records

• Corrective action logs

How to Prepare for an Internal ISO 27001 Audit

1. Build and maintain an audit schedule. Create a documented internal audit program that covers all areas of your ISMS at least once per audit cycle. ISO 27001 requires you to define the frequency, methods, responsibilities, and reporting requirements.

2. Complete your risk assessment before auditing. Your risk assessment and risk treatment plan must be finalized and approved before the internal audit. Auditors will cross-reference your risk register against your Statement of Applicability.

3. Gather evidence for every control For each control in your Annex A that you have marked as applicable, you need documented evidence it is in operation. This includes policies, configurations, screenshots, training logs, and vendor contracts.

4. Train your internal auditors. Assign qualified personnel to conduct the audit. If your team lacks experience, engaging an ISO 27001 consultant for the first audit cycle is a common and effective approach.

5. Document findings formally. All non-conformities and observations must be recorded and tracked through to resolution. This audit trail will be reviewed during your external certification audit.

External ISO 27001 Audits: What to Expect

External audits are conducted by an accredited certification body (CB). ISO 27001 certification involves two stages of external auditing.

Stage 1 Audit (Documentation Review)

The Stage 1 audit is typically a desk review. The external auditor will assess:

• Whether your ISMS documentation is complete

• Whether your scope is clearly defined

• Whether your risk assessment methodology is sound

• Whether you are ready to proceed to Stage 2

Stage 1 is not a pass/fail audit in the traditional sense. It is designed to identify gaps so you can address them before the full assessment. Most organizations receive a list of observations after Stage 1 that they use to strengthen their ISMS before Stage 2.

Stage 2 Audit (Certification Audit)

The Stage 2 audit is the full certification assessment, either on-site or remote. The auditor will:

• Verify that your ISMS is fully implemented and operational

• Interview key personnel across departments

• Review evidence for controls listed in your Statement of Applicability

• Assess whether your internal audit and management review processes have been completed

• Look for major and minor non-conformities

If the auditor finds no major non-conformities, your organization will be recommended for ISO 27001 certification.

How to Prepare for an External ISO 27001 Audit

1. Complete at least one full internal audit cycle. You must be able to demonstrate that your ISMS has been operating for a defined period. Most certification bodies require evidence of at least 3 months of operation before Stage 2.

2. Conduct a formal management review. Clause 9.3 requires management to review the ISMS at planned intervals. This review must be documented and cover inputs such as audit results, risk assessments, and performance metrics.

3. Resolve all internal audit findings. Any non-conformities identified during your internal audit must be documented and closed with root cause analysis and corrective actions before the external audit.

4. Prepare your team for interviews. External auditors will speak with employees across your organization — not just the IT or compliance team. Ensure staff can explain their role in information security, how they handle incidents, and where to find relevant policies.

5. Organize your evidence library. Auditors move fast. Having all evidence organized and accessible by control reference saves significant time during the Stage 2 audit and demonstrates operational maturity.

Common ISO 27001 Audit Failures — and How to Avoid Them

How DSALTA Helps You Prepare for ISO 27001 Audits

At DSALTA, we specialize in AI-powered compliance solutions that make ISO 27001 audit preparation faster, more accurate, and far less stressful.

Our platform helps organizations:

• Build and manage a structured ISMS aligned to ISO 27001 requirements

• Generate and maintain audit-ready documentation automatically

• Track control implementation against your Statement of Applicability

• Manage risk registers and risk treatment plans in one place

• Prepare evidence packages for both internal and external audits

Whether you are pursuing certification for the first time or preparing for a surveillance audit, DSALTA gives your compliance team the tools to stay audit-ready year-round — not just in the weeks before the auditor arrives.

Final Thoughts

ISO 27001 audits — both internal and external — are structured, predictable processes when you know what to prepare. The organizations that pass the first time are not the ones with the most resources. They are the ones who treat their ISMS as a living system, maintain continuous evidence, and promptly close non-conformities.

Start your internal audit program early, document everything, and make sure your team understands their role in information security. With the right preparation — and the right tools — ISO 27001 certification is well within reach.

Ready to simplify your ISO 27001 audit preparation? Book a demo with DSALTA today.