Unified Startup Enablement & Growth Platform

ISO 27001 Audit — Gap Analysis, Certification Bodies & Stage 1/2 Prep

ISO 27001 Readiness builds your ISMS. ISO 27001 Audit is the discrete event: choosing an accredited certification body, closing every remaining gap before Stage 1, and getting through Stage 2 with zero major non-conformities.

This page covers what actually happens during the certification audit itself — not how to build the management system, which is covered on the ISO 27001 Readiness page.

Certification Roadmap — Stage 1 & Stage 2

MONTH 1

Scoping & Gap

Define ISMS scope, asset inventory, initial gap analysis against all 93 controls.

MONTH 2–3

Risk Assessment

ISO 27005 risk methodology, risk register, risk treatment plan, Statement of Applicability (SoA).

MONTH 3–5

Control Implementation

Implement all applicable Annex A controls; draft policies, procedures, and evidence artefacts.

MONTH 5–6

Internal Audit

Internal audit against ISO 27001 requirements; management review; corrective actions.

MONTH 6–7

Stage 1 Audit

Certification body reviews documentation and readiness; issues Stage 1 report.

MONTH 7–9

Stage 2 & Certificate

On-site/remote Stage 2 audit; non-conformity closure; certificate issued.

            Stage 1 vs Stage 2 — What Each Actually Tests
            Stage 1 (Documentation Review): 1–2 days, often remote. Auditor reviews your ISMS scope, SoA, Information Security Policy, and mandatory procedures — checking design completeness, not whether controls work in practice.
Stage 2 (Certification Audit): 2–5 days on-site. Auditor interviews staff across departments and samples evidence for every applicable Annex A control — access logs, training records, backup restore tests, change tickets, incident register.
Outcome: Conformities, Observations, Minor Nonconformities (fix within 90 days), Major Nonconformities (must fix before certificate issued).

        

UKAS/DAkkS-Accredited Certification Bodies in India

Only use accredited certification bodies — unaccredited certificates are not accepted by enterprise procurement or government tenders.

BSI Group India

UK-based, UKAS accredited. Most recognised globally. Preferred for multinational enterprise sales.

Bureau Veritas India

French multinational, DAkkS accredited. Strong presence in manufacturing and government sector.

TÜV SÜD India

German, DAkkS accredited. Highly respected in automotive, fintech, and critical infrastructure.

KPMG India

Big-4 advisory with ISO 27001 audit practice. Strong for combined DPDPA + ISO 27001 engagements.

DNV India

Norwegian, DAkkS accredited. Growing presence in Indian startup and healthcare sectors.

Costs — Stage 1, Stage 2, Surveillance & Recertification

Audit Stage	Typical Cost (India)	Notes
Stage 1 Audit	₹15–25K	Documentation review — desk audit
Stage 2 Audit	₹35–60K	On-site certification audit
Annual Surveillance Audit (Years 1 & 2)	₹15–25K each	Confirms ISMS remains operational
Recertification Audit (Year 3)	₹25–45K	Full re-audit to renew the 3-year certificate
3-year certification maintenance total	₹90–155K	Excludes internal team time and implementation cost

Frequently Asked Questions

Can we use unaccredited certification bodies to save cost?+

No — unaccredited certificates are routinely rejected. Enterprise procurement teams and government tender evaluators verify whether your certification body is accredited by an IAF member (UKAS, DAkkS, NABCB). In India, BSI, Bureau Veritas, TÜV SÜD, and DNV are all IAF-accredited.

Some local bodies offer "ISO 27001 certificates" for ₹50,000–1,00,000 total — these are not accredited and will not pass enterprise or government procurement scrutiny. The cost saving is not worth a rejected certification during a high-stakes deal.

How does the ISO 27001 audit process work — Stage 1 vs Stage 2?+

ISO 27001 certification requires TWO audit stages conducted by the same certification body.

Stage 1 — Documentation Review (Desk Audit):

Typically 1–2 days, conducted remotely or on-site.
Auditor reviews: ISMS scope document, Statement of Applicability, Information Security Policy, Risk Assessment and Risk Treatment Plan, Mandatory procedures (internal audit, management review, corrective action, document control).
Auditor is NOT testing whether controls work — only whether your ISMS design is complete and coherent.
Timeline gap between Stage 1 and Stage 2: Typically 4–8 weeks (time to address Stage 1 findings).

Stage 2 — Certification Audit (On-Site):

Typically 2–5 days on-site (longer for larger scope).
Auditor interviews staff across departments: ask engineers how they request access, ask HR how background checks work, ask managers how incidents are reported.
Auditor samples evidence for each applicable Annex A control: access logs, training records, backup restore tests, change tickets, incident register, supplier contracts.
Auditor may test controls directly: "Show me how you would revoke access for a terminated employee right now."

After Stage 2: If no Major nonconformities (or all addressed), certification body issues ISO 27001:2022 certificate within 4–8 weeks. Certificate is valid 3 years from date of issue, subject to annual surveillance audits.

What happens after certification — is it a one-time process?+

No — ISO 27001 requires ongoing maintenance:

Annual surveillance audits (years 1 and 2) — shorter audits confirming your ISMS is operational
Recertification audit (year 3) — full re-audit to renew the 3-year certificate
Internal audits — at least once a year, conducted by someone independent of the area audited
Management reviews — at least annually with documented minutes covering incidents and improvement actions

What if a Stage 2 audit finds a Major Nonconformity?+

A Major Nonconformity blocks certificate issuance until resolved — it signals a control area is not operating at all, or the ISMS has a systemic gap (e.g., no evidence of any internal audit ever being conducted).

Resolution path: the certification body gives a corrective action deadline (typically 90 days). You submit evidence the gap is closed; the auditor reviews remotely rather than re-visiting on-site in most cases. Certificate is issued once closed.

Minor Nonconformities don't block issuance — the certificate is issued with a documented corrective action plan due within 90 days, verified at the next surveillance audit.

Key Takeaways — ISO 27001 Audit for Indian Startups

Budget 4–8 weeks between Stage 1 and Stage 2, not zero:

Startups routinely underestimate the gap needed to close Stage 1 findings before Stage 2 can proceed. Treat Stage 1 as a real checkpoint, not a formality — significant concerns raised there must be resolved before booking Stage 2.

Accreditation is non-negotiable — verify before signing:

An unaccredited "ISO 27001 certificate" is worthless for enterprise and government procurement. Always confirm the certification body's IAF accreditation (UKAS, DAkkS, NABCB) before engaging them.

Certification is a 3-year commitment, not a one-time event:

Annual surveillance audits and a full recertification at year 3 mean the audit relationship with your certification body is ongoing. Factor ₹90–155K over 3 years into your compliance budget from day one.

Inside Corpfy ISO 27001 Audit

Corpfy's ISO 27001 Audit dashboard reads live from your ISO 27001 Readiness control register and turns it into a gap-analysis and audit-prep workspace — computing an audit-readiness score, surfacing every open gap with a resolution note field, and tracking the PBC (provided-by-client) documents your certification body will request at Stage 1.

Capability	What it does	Audit output
Live Gap Analysis	Reads your Annex A control register and flags Not Started, Planned, In Progress, and missing-evidence controls	Audit-readiness % score, updated in real time
PBC Checklist	Pre-built list of documents certification bodies typically request, editable per engagement	Complete PBC log ready to hand to your auditor
Gap Resolution Notes	Attach a remediation plan to every open gap before Stage 1	Exportable gap report shared with your ISMS owner
Target Audit Date Tracker	Set your Stage 1/Stage 2 target date and see days remaining	Countdown visible across the dashboard