Common ISO 27001 Audit Issues and How to Fix Them

Before looking at the problems, it helps to understand the ISO 27001 audit process itself, since the type of audit changes what the auditor is actually checking.

• Stage 1 audit: The auditor reviews your documentation, risk assessment, and Statement of Applicability (SoA) to see if you are ready to move forward.
• Stage 2 audit (ISO 27001 certification audit): The auditor checks whether your ISMS is actually implemented and working, not just written down.
• Surveillance audit: Conducted annually after certification. An ISO 27001 surveillance audit does not review everything again; it samples parts of your ISMS to confirm you are still compliant.
• Recertification audit: Every three years, a full ISO 27001 external audit is carried out to renew your certificate.
• Internal audit: Carried out by your own team, or a hired consultant, before the certification body ever shows up. Many organisations assign this to someone trained as a Certified ISO 27001:2022 Lead Auditor internally, since the role is built around spotting gaps before an external assessor does. 

Since the 2022 revision reorganised Annex A into 93 controls across four themes (organisational, people, physical, and technological), auditors now check your ISO 27001 audit requirements against this newer structure, which has created some fresh confusion for teams still working from older templates.

The following issues are widely reported by certification bodies and ISO consultants as the ones auditors raise most often, whether it is a first certification audit or a routine surveillance visit. Exact frequency varies by industry and certification body, but these are the patterns that come up repeatedly across audit reports.

These gaps come up so often that they now shape how ISMS training itself is designed. Programs such as those from the Global Skill Development Council (GSDC) are structured around this exact list, risk assessment, access control, internal audits, and corrective action handling, because these are the areas where auditors consistently find real-world practice falling short of the documentation.

A quick way to read your audit findings:

• Major nonconformity: A required element is missing entirely, or the system has broken down completely. This must be fixed before certification is granted.
• Minor nonconformity: A single lapse in an otherwise working process. You get time to submit a corrective action plan.
• Observation: Not a failure yet, but a signal the auditor wants addressed before it becomes one.

A well-built ISO 27001 checklist is the most reliable way to avoid the issues listed above. Break it into three parts.

Documentation checklist

• Information security policy and objectives
• Risk assessment methodology and current risk register
• Statement of Applicability, mapped to specific risks
• Internal audit reports and results
• Management review minutes with decisions recorded
• Corrective action log with root cause analysis
• Business continuity and incident response plans, tested and dated

Process checklist

• Access rights reviewed on a fixed schedule
• Asset inventory kept current
• Supplier and third-party risk assessed
• Awareness training refreshed at least annually

Evidence checklist

• A clear evidence trail for every control listed in the SoA
• Records that show controls are followed, not just documented
• Dates and owners attached to every review, test, and training record

If you want a structured starting point, an ISO 27001 gap analysis checklist run six to eight weeks before your audit is one of the most effective ways to catch gaps while there is still time to close them.

Your ISO 27001 internal audit checklist should mirror what the external auditor will actually check: sampling evidence, interviewing staff, and testing whether controls work in practice, not just whether they exist on paper. A few habits that make internal audits more useful:

• Assign a different reviewer than the person who owns the process, where possible
• Sample real evidence (logs, tickets, access records) instead of only reviewing policy documents
• Log findings the same way an external auditor would, using major, minor, and observation categories
• Track every internal finding through to a documented fix before the external audit

After every audit, whether internal or external, you should receive an ISO 27001 audit report that lists the scope reviewed, nonconformities found, evidence referenced, and the timeline for corrective action. Keep past reports on file. Repeated findings across multiple reports are one of the fastest ways to turn a minor nonconformity into a major one at the next audit.

ISO 27001 audit cost is one of the most common questions, and it depends on a few factors: number of employees and sites covered by the ISMS, complexity of your IT environment, which audit stage you are booking, and the certification body and country you work with. Beyond the certification body's fees, budget for internal costs too, staff time, gap analysis, and remediation of findings, which often add up to more than the audit fee itself.

A lot of the issues in the table above come down to one thing: nobody in the organisation is trained to audit the ISMS the way a certification body will. This is where having a Certified ISO 27001:2022 Lead Auditor on your team, or working with one, makes a real difference. They know how to test controls the way an external auditor does, spot the gap between documented policy and actual practice, and write findings the business can act on before the real audit ever starts.

For organisations or individuals looking to build this capability in-house, the Global Skill Development Council (GSDC) offers ISO 27001 lead auditor training as one of its certification programs.

No ISO 27001 audit is ever completely clean, and that is fine. What separates organisations that sail through recertification from those that struggle is not perfection. It is whether they treat their ISMS as a living system that gets reviewed, tested, and improved between audits, rather than a folder of documents dusted off once a year.

Build your checklist early, run your internal audits honestly, and treat every finding, major or minor, as a chance to close a real gap rather than just satisfy an auditor.

The best time to find an ISO 27001 audit gap is before your external auditor does. Keep your ISMS active throughout the year, test controls with real evidence, and use internal audits to challenge your processes honestly.