ISO 27001 Certification Audit: Complete UK Business Guide 2025

What we'll cover:

• What Is an ISO 27001 Certification Audit?
• Stage 1 Audit: Documentation Review
• Stage 2 Audit: On-Site or Remote Assessment
• Preparing for Your ISO 27001 Certification Audit
• What Auditors Look For
• Common Audit Findings and Non-Conformities
• After the Certification Audit
• ISO 27001 Audit Costs in the UK
• Choosing an Accredited Certification Body
• How Reflective IT Supports Your Audit Success
• FAQs

UK businesses face mounting pressure to prove their security credentials.

Customers want assurance. Regulators demand compliance. And partners need proof that you're protecting their data.

The ISO 27001 certification audit is how you demonstrate all three.

This standard, recognised around the world, proves you care about security. It means you’ve put systems in place to keep sensitive data secure.

But many UK companies struggle with the ISO 27001 certification check itself.

It's not just going through the motions. The check is a careful look at your whole Information Security Management System (ISMS). Auditors look at your paperwork, test your security measures, talk to your people, and see how security works every day in your business.

This guide walks you through the whole certification audit process. You’ll learn what auditors want, how to get ready, and how to pick the right certification partners. No matter if it's your first time with ISO 27001 or you're getting ready to renew, you'll find the advice you need.

At Reflective IT, we act as the Lead Implementor for UK businesses, managing the entire ISO 27001 project from initial planning through certification and ongoing ISMS management. We've supported many organisations through the audit process, and we've distilled that experience into this comprehensive guide.

Let's start with the fundamentals: what exactly is an ISO 27001 certification audit, and why does it matter?

What Is an ISO 27001 Certification Audit?

An ISO 27001 certification audit is when an organisation checks if your Information Security Management System follows the rules of the ISO/IEC 27001:2022 standard.

It’s like a checkup to see how healthy your security is.

The audit looks at if you're using the right ways to keep your data safe. It checks if your rules work in real life. It makes sure you're carefully handling security risks, instead of just fixing problems when they pop up.

There are three kinds of ISO 27001 audits:

• Internal audits: are done by your own people (or experts you hire). These help you spot problems before the real audit. You get to pick when and how they do it.
• Certification audits: are carried out by approved organisations. If you pass, you get your ISO 27001 certificate. They do it in two steps that we'll talk about later.
• Surveillance audits: happen every year after you get certified. They make sure you're still following the rules and getting better at security.

Stage 1 Audit: Documentation Review

Stage 1 is where auditors examine your paperwork.

This is a readiness assessment. Auditors want to make sure you have all your ISMS paperwork in order before they spend time checking how well it works. It's like a pre-flight check before the real thing.

What auditors review during Stage 1:

• Your scope statement says which parts of your business the ISMS covers. Auditors check that it's clear, realistic, and properly justified.
• Your risk assessment and plan show how you've found security risks and chosen ways to handle them. This is super important for ISO 27001 - everything is based on understanding your risks.
• Your Statement of Applicability (SoA) lists which of the 93 Annex A controls you've put in place and why. Auditors make sure your SoA fits with your risk assessment.
• Your policies and procedures explain how security works in your company. Auditors check that you've covered all the required stuff in the standard (Clauses 4-10).
• Your management review records prove leadership is actively involved in the ISMS. ISO 27001 requires top management engagement, not just IT department ownership.

Stage 1 audits usually happen online. The auditor looks at your documents and then gives you a report that says if anything is missing. If there are big problems, you'll have to fix them before Stage 2 can start.

Pass Stage 1 and you can go on to Stage 2 - where they really test if your ISMS works.

Stage 2 Audit: On-Site or Remote Assessment

During Stage 2, auditors check if your ISMS is really working.

Your paperwork might look great, but now auditors want to make sure your security measures are actually doing their job every day. They’ll look at some of your processes, talk to your staff, and see if what you’re doing matches what you’ve written down.

What happens during Stage 2:

Auditors sample your controls across different areas. For example, they might look at how you handle requests to get access to systems, check your software update logs, or test how you respond to security incidents. They don’t check everything, but they do take samples to see if your ISMS is working consistently.

They’ll interview your staff at all levels of your company, like IT staff, managers, and regular employees. Auditors want to be sure everyone knows what they need to do for security and that they’re following the rules.

They interview your staff at different levels of your organisation. Expect questions for your IT team, management, and end users. Auditors want to confirm people understand their security responsibilities and follow documented procedures.

They observe your environment if conducting an on-site visit. How do staff handle visitor access? Are screens locked when people leave their desks? Do physical security controls match your documentation?

Since the pandemic, many Stage 2 audits are now done remotely or as a mix of remote and on-site visits. Auditors can talk to staff through video calls and review documents by sharing screens. Remote Stage 2 audits are fine for smaller companies with simple IT setups.

Post-pandemic, many Stage 2 audits now happen remotely or as hybrid assessments. Auditors conduct interviews via video calls and review evidence through screen sharing. For smaller organisations with straightforward IT environments, remote Stage 2 audits work perfectly well.

The Stage 2 audit normally takes 2-5 days for small to medium-sized businesses, depending on the scope, how complicated things are and how many locations there are. Auditors will schedule the assessment to cause as little disruption as possible.

At the end of Stage 2, auditors will tell you what they found. You’ll learn about any problems that need to be fixed before you can get certified.

Preparing for Your ISO 27001 Certification Audit

Good prep work is key to getting ISO 27001 certification without wasting money.

Companies that pass the first time don't just write up an ISMS and hope it's enough. They have a plan to ensure everything the auditors want to see is ready, working, and proven.

Conduct a Gap Analysis

Before you start, see where you stand. A gap check looks at your current security and what ISO 27001 needs. It shows what you have, what to build, and what to write down. Think about it as your project plan.

Define Your ISMS Scope

Your range states which parts of your work the ISMS covers. Be realistic. Covering too much for your first certification can make it too hard. Most small to medium-sized enterprises (SMEs) begin with core business and important info, then grow the range when they recertify.

Complete Your Risk Assessment

This is key for an ISO 27001 certification audit. Know your info, look at dangers and weak spots, figure out risks, and write down how to handle them. A structured IT risk register helps track and prioritise these risks — and serves as key audit evidence.

Build Your Documentation

You need rules, steps, and records covering all needed items. This has your info security rule, risk plan, Statement of Applicability, and how to handle your chosen controls. The documents don't have to be perfect, but they must be correct and helpful.

Implement Your Controls

Just writing things down won't get you past Stage 2. Your controls must work. This could mean new tools, changed steps, training people, or updated settings. Give yourself time to make changes before the audit.

Run an Internal Audit

Check your ISMS before the auditors do. Practice checks show holes in the documents, missing proof, and controls that don't work as written. It's like a net, catch problems before they stop your certification.

Conduct Management Review

Leaders must check the ISMS and show they are involved. This isn't just a formality. Managers must know risks, agree to the risk plan, and put resources into the ISMS.

Generate Evidence

Auditors need proof that controls work. This means logs, tickets, meeting notes, training records, access checks, anything that shows security happens all the time. Start getting proof at least three months before your audit.

Related security frameworks like Cyber Essentials and disaster recovery planning often overlap with ISO 27001 requirements. If you've already implemented these, you're further along the preparation journey than you might think.

Preparation typically takes 3-6 months for SMEs starting from scratch, depending on existing security maturity and available resources.

What Auditors Look For

Auditors don't always go over every minor detail when conducting an ISO 27001 certification audit.

They pay close attention to the areas that show if your info security setup is for real or just for show. Some rules and checks are good signs of a mature system. If you handle these well, auditors will trust your whole approach more.

Leadership Commitment and Involvement

ISO 27001 says the top management need to care about security and not just leave it to the IT people. Auditors will see if leadership knows the risks, sets aside money, and checks how the system is doing. They'll look at meeting notes, policy approvals, and where the money goes.

If your Managing Director has never looked at your risk assessment, auditors will notice.

Context of the Organisation

You need to understand what's going on inside and outside your business that affects security. Who are your stakeholders? What do they expect for security? What laws apply? Auditors will check that you've written down this stuff and that it guides how you set up your system.

Risk Assessment and Treatment

This is foundational. Auditors will check if you've found your assets, figured out the risks carefully, and picked the right controls. Your plan to deal with risks needs to make sense. The controls you've implemented should fix your actual risks, not just be a generic security list.

Documentation Control

Can you show that your documents are up-to-date, approved, and easy to find? Auditors will check version control, approval steps, and when documents are reviewed. If policies are old or employees can't find them, that's a bad sign.

Operational Planning and Control

Your controls need to work as written. Auditors will look at access logs, change records, backup reports, and incident tickets. They are checking if what you say you do matches what you actually do.

Supplier Relationships

Outside companies that handle your data cause risks. Auditors will check if you've looked at their security, added the right contract terms, and keep an eye on how they're doing. If you use outside help like managed security services, expect questions about how you ensure those providers maintain adequate security.

Monitoring, Measurement, and Analysis

How do you know your security system is working? Auditors want to see security numbers, performance checks, and analysis.

Continuous monitoring through a Managed Security Operations Center (SOC) gives you 24/7 visibility into threats and provides the evidence auditors expect during an ISO 27001 certification audit.

Internal Audit Programme

Your internal checks show you're checking your system regularly. Auditors will look at your check schedule, findings, and fixes. A good internal check system finds problems before the main auditors do.

Continual Improvement

ISO 27001 isn't a one-time thing. Auditors want to see that you're always trying to get better. This could be from fixing things after incidents, improving controls based on checks, or updating things after tech changes. If your documents never change, it suggests you aren't really managing security.

Common Audit Findings and Non-Conformities

Even the most prepared companies can receive audit findings.

Think of these issues as chances to improve. They just mean the auditors found things that don't quite line up with what ISO 27001 wants. Knowing about common issues can help you avoid them or know what to do when they pop up.

Major vs Minor Non-Conformities 

Major non-conformities are serious gaps. Maybe you're missing key documents, your security measures aren't working, or there are problems throughout your security system. You have to fix these before you can get certified.

Minor non-conformities are isolated lapses or partial implementations. Like a missing paper, a security measure without recent proof it works, or a process that's mostly followed but has some holes. These don't stop you from getting certified, but you need to fix them within a set time frame (usually about 90 days).

Most Common ISO 27001 Audit Findings 

Here are some of the most frequent issues that keep showing up with companies in the UK:

Incomplete or missing management reviews

The leaders need to check on the ISMS often. Auditors often see companies that planned these reviews but never did them. Or they did them but didn't write down what they decided or what actions they would take. 

Inadequate risk assessment

Copying risk assessments from templates isn't going to cut it. Auditors want to see risks that are specific to your company, your situation, and your data. If all your risks are medium or your assessment hasn't been checked since you started, expect issues. 

Poor supplier and third-party management

A lot of companies don't check their suppliers' security well enough. You need contracts with the right security stuff in them, proof you checked your suppliers, and a way to watch how they're doing. 

Untested disaster recovery and business continuity plans

Having a disaster recovery plan on paper means nothing if you've never tested it. Auditors look for test records, test results, and improvements made following tests. 

Missing or inconsistent evidence

Your security measures might be great, but if you can't prove it, the auditors can't see it. Common missing pieces include: 

• Access reviews without documentation 

• Training completion without records 

• Incident response without logged tickets 

• Change management without approval trails 

Inadequate internal audit coverage

Your internal audit plan needs to check the whole ISMS over time. Auditors see companies that check the easy stuff over and over but skip the harder parts. 

Documentation that doesn't match reality

Procedures that describe processes nobody actually follows create findings. If staff work around documented procedures, your ISMS isn't operating effectively. 

How to Respond to Audit Findings

1. Understand the root cause - investigate why this happened, not just what happened.
2. Fix the immediate issue - address the specific finding the auditor identified
3. Prevent recurrence - change processes or controls to stop it happening again
4. Provide evidence - prove you've taken corrective action with documentation

After the Certification Audit

So, the Stage 2 audit is done. What now?

The auditors won't give you a certificate right away. First, they put together what they found, write down any issues, and create a report. What happens next depends on what they found.

Three Possible Outcomes

• Certification recommended with no non-conformities — This doesn't happen often, but it's possible. The auditor decided your ISMS follows every rule. The group that gives out the certificate will send it to you, usually in 2-4 weeks. The certificate is good for three years, but you'll have yearly check-up audits.
• Certification recommended with minor non-conformities — This is most likely. Your ISMS is generally good, but a few things need work. You'll get the thumbs up as long as you fix those small things. You'll need to show that you've taken care of those points within the time they give you (usually about 90 days), and then you'll get your certificate.
• Certification not recommended due to major non-conformities — There are some real problems that are stopping you from getting certified. You have to sort those problems out and have another audit before you can get certified. This will take more time and cost more money.

Addressing Non-Conformities

Speed matters. The quicker you fix what they found, the quicker you get certified.

For each non-conformity:

• Acknowledge the finding - Understand what the auditor identified and why it's a problem
• Investigate root cause - Don't just fix the symptom, understand why it occurred
• Implement corrective action - Make the necessary changes to close the gap
• Document evidence - Provide proof that you've resolved the issue
• Submit to certification body - Send your evidence for auditor review

Receiving Your Certificate

Once everything's fixed and approved, the people giving the certificate will send you your ISO 27001 certificate.

Your certificate includes:

• Your company name and address
• Scope of certification (what your ISMS covers)
• Standard reference (ISO/IEC 27001:2022)
• Certification body details and UKAS accreditation mark
• Issue date and expiry date (three years from issue)

Now you can put the ISO 27001 badge on your website, marketing collateral, and offers. It tells people that you're serious about keeping information safe.

Maintaining Your Certification

Getting certified isn't the end – it's just the start of staying compliant.

Annual surveillance audits: Every year, they'll do audits to check you're keeping your ISMS going and getting better at security. These are shorter checks (usually 1-2 days) that look at different parts of your ISMS each year.

Recertification audits: Every three years, you'll have to get re-certified. This is like the first Stage 2 audit all over again. You'll need to show that you've been running, improving, and making your ISMS work for three years.

Between audits, you must:

• Maintain your documentation and keep it current
• Continue internal audits according to your audit programme
• Hold regular management reviews
• Monitor security metrics and act on results
• Address any incidents or issues that arise
• Update your risk assessment when circumstances change

Ongoing security monitoring and managed security helps maintain the security controls underpinning your ISO 27001 certification.

ISO 27001 Certification Audit Costs in the UK

Understanding the costs can help you make a realistic budget.

Most guides don't tell you that the audit fee is only part of the total cost. Getting ready, putting the system in place, keeping watch over time, and staying compliant all add to the real cost of ISO 27001.

What Determines Certification Audit Costs

ISO 27001 certification audit bodies figure out their fees based on a number of factors. Knowing these things will help you understand quotes and see how providers compare.

• Organisation size and complexity — Bigger companies need more audit time. A certification group has to check controls across your setup, talk to workers at different levels, and look over more documents. More audit days means higher fees.
• Scope of your ISMS — A narrow scope covering specific services at a single location costs less to audit than a broad scope spanning multiple sites, diverse operations, and complex technology environments.
• Number of locations — Organisations with several locations will see higher costs. Auditors must check that your ISMS works the same at each place. Even if some site visits are done online, this adds to the work and audit time.
• Your sector and regulatory requirements — Highly regulated industries often require deeper examination of specific controls. Financial services, healthcare, and critical infrastructure organisations typically see longer, more detailed audits.
• Your preparation quality — Companies that are ready with good security practices get through audits faster. If you are not well-prepared, you'll find issues, need to fix them, and maybe need more audit days – all of which raise costs.

Cost Components Beyond the Audit

The audit itself is usually less than half of what you'll spend overall for ISO 27001 certification.

Preparation and readiness activities — Before auditors show up, you need to look for gaps, check risks, create documents, put controls in place, and do internal audits. Whether you do this yourself or hire helpers, it takes time and money.

Technology and security tools — ISO 27001 controls often need tech help – like access systems, monitoring, backups, and scanners. You might have some of these already, but you'll likely need more.

Staff time and training — Your team will spend a lot of time on ISMS work, internal audits, gathering proof, and fixing problems. Security training for everyone also costs money.

Ongoing compliance — You need annual check-up audits to keep your certification. Every three years, you'll have another full audit. Between audits, you're keeping documents up-to-date, doing internal checks, and always working to improve.

Getting Clear on Total Investment

When checking ISO 27001 costs, ask certification bodies and helpers to break down:

• Initial audit fees (Stage 1 and Stage 2)
• Check-up audit fees (every year for years 1 and 2)
• Renewal audit fees (year 3)
• Travel costs if they visit your site
• Any added fees for checking fixes

Ask preparation consultants to clarify:

• What's included in their scope (gap analysis, documentation, training, etc.)
• What you're expected to handle internally
• Timeline and resource requirements from your team
• Support provided during the actual audit

Benefits of ISO 27001 Certification

ISO 27001 delivers value beyond the certificate itself:

• Market access — Many tenders and partnerships require ISO 27001 certification. Without it, you can't compete for certain contracts.
• Customer confidence — Certification provides independent verification of your security practices. It answers customer security questions before they're asked.
• Risk reduction — Structured controls reduce your likelihood of breaches and their potential impact. Prevention costs less than incident response.
• Operational efficiency — Documented processes and clear responsibilities improve consistency and reduce errors.
• Insurance and liability — Some insurers recognise ISO 27001 certification in their risk assessments, potentially affecting premiums.

Choosing an Accredited Certification Body

Not all ISO 27001 certificates are equal.

The certification body you pick matters because it affects whether people trust your certificate. If you mess this up, your certificate might not mean anything.

Why UKAS Accreditation Matters

In the UK, UKAS (United Kingdom Accreditation Service) checks certification bodies to ensure they meet standards for being good at their job, fair, and consistent.

A UKAS-accredited certificate signals:

• The certification body operates to recognised standards
• Auditors possess appropriate qualifications and experience
• The assessment process was rigorous and impartial
• Your certificate is recognised internationally through mutual recognition agreements

If a certification body isn't UKAS-approved, people might doubt their certificates. Some customers and partners might not accept them, and some contracts require UKAS-approved certification.

What to Evaluate When Choosing a Certification Body 

Don't just go for the cheapest option. Saving money now could cause later problems.

Industry Experience and Expertise

Does the certification body know your industry? Auditors who get your industry can spot issues faster, give better advice, and audit faster.

Auditor Quality and Consistency

Who will actually conduct your audit? Some certification bodies use subcontracted auditors with varying skill levels. Others maintain in-house teams with consistent standards.

Responsiveness and Communication

You'll be working with this certification body for years, so make sure they're easy to reach.

Audit Scheduling Flexibility

Can they work with your schedule? Some certification bodies make you wait months for an audit, while others can do it in weeks.

Transparency Around Fees and Costs

Hidden fees damage trust. Quality certification bodies provide clear breakdowns showing:

• Stage 1 audit costs
• Stage 2 audit costs
• Surveillance audit costs (years 1 and 2)
• Recertification audit costs (year 3)
• Travel and expenses
• Any additional fees for corrective action reviews or re-audits

References and Track Record

Ask for references from organisations similar to yours in size and sector. Speak to their existing clients about:

• Audit quality and professionalism
• Finding severity (were auditors reasonable or overly harsh?)
• Post-audit support
• Surveillance audit consistency
• Overall satisfaction

Questions to Ask Certification Bodies

Before making your choice, ask:

• Are you UKAS-accredited for ISO 27001? (Verify this independently on the UKAS website)
• What's your experience auditing organisations in our sector?
• Who will conduct our audit, and what are their qualifications?
• What's your current lead time for Stage 1 and Stage 2 audits?
• What's included in your quoted price, and what costs extra?
• How do you handle corrective actions and follow-up reviews?
• Can you provide references from similar organisations?
• What's your process for surveillance and recertification audits?

How Reflective IT Supports Your Audit Success

ISO 27001 isn’t something businesses should try to tackle alone.

It requires structure, evidence, and consistent management - and most SMEs don’t have the internal capacity to run the whole process.

Reflective IT acts as Lead Implementor for your ISO 27001 programme. We manage the entire journey from the first planning session to certification day and beyond.

What we do as Lead Implementor 

• We handle every implementation activity needed for ISO 27001, including:
• Building the ISMS from the ground up
• Creating and maintaining all required documentation (policies, procedures, SoA, risk treatment plan)
• Running the risk assessment and translating it into appropriate controls
• Implementing or optimising technical security controls
• Designing new internal processes and embedding them into the business
• Preparing staff for auditor interviews
• Managing readiness for Stage 1 and Stage 2 audits

Support Through Certification and Beyond

Our involvement doesn’t stop once you receive the certificate. We continue managing and maintaining the ISMS into the annual surveillance audit cycle, helping you stay compliant year after year.

We focus on building an ISMS that works in practice. One that auditors can verify with confidence.

If you want a structured, end-to-end path to ISO 27001 certification, contact our team who can guide you through every step.

Frequently Asked Questions

What is an ISO 27001 certification audit?

An ISO 27001 certification audit is when an outside group checks if your business follows all the rules of the ISO 27001 standard. They look at your paperwork and how you actually do things. If you pass, it means your system for protecting data is good and meets worldwide standards.

Does ISO 27001 require audits?

Yes. You’ll also have an outside group check things out to get certified. Internal audits make sure your ISMS is doing its job. Certification audits show you're meeting ISO 27001 standards. Once you're certified, expect yearly check-ups and a complete do-over of the certification every three years.

How much does it cost to audit ISO 27001 certification?

In the UK, most companies can expect to pay between £9,000 and £15,000 for the ISO 27001 certification audit. The actual cost hinges on things like how big your business is, what your ISMS covers, how many locations you have, and which certification company you pick. Keep in mind there are also yearly check-up audits, which usually cost about 30% of what you paid initially.

Is ISO 27001 certification hard?

It can be tough, but it's doable if you get ready. You'll need to show you have good controls, assess risks, and have your leaders participate. Companies that plan ahead, give people clear responsibilities, and do practice audits usually pass without big problems. Working with a specialist like Reflective IT can make things easier and prevent expensive mistakes.

How long does ISO 27001 certification take?

For most SMEs, certification takes three to six months. The timeline depends on how mature your ISMS is and how quickly documentation and controls can be implemented. Larger organisations with multiple sites or complex infrastructures may need more time for testing and evidence collection.

Who conducts an ISO 27001 certification audit?

Certification audits are performed by independent, UKAS-accredited certification bodies such as BSI, SGS, or NQA. Each uses qualified lead auditors who assess your ISMS documentation and its real-world operation. Reflective IT helps you prepare for these external audits but does not perform them directly.

What happens if you fail the ISO 27001 audit?

If auditors find non-conformities, you’ll receive a report with corrective actions. Minor issues must be resolved before certification is issued. Major ones require re-audit after remediation. Failure doesn’t mean starting over — it’s an opportunity to strengthen your ISMS before resubmitting evidence. Reflective IT guides clients through this process.

---