The evidence an ISO/IEC 27001 auditor will ask for
Policies describe intent; records prove the security system operates. Here are the practical evidence categories to prepare before Stage 1 and Stage 2.
The short answer
Good audit evidence is current, traceable and connected to a risk or control — not a folder of screenshots assembled at the last minute.
Stage 1 checks whether the system is designed
The auditor reviews scope, risk assessment, treatment decisions, the Statement of Applicability, core policies and readiness for the main assessment. Gaps here can delay Stage 2.
Stage 2 checks whether it operates
The auditor samples records and interviews people to verify that the written controls are used.
How Amprovia removes the evidence chase
We create an evidence list for each applicable control, assign a clear owner, review what already exists and close missing records before the mock audit. Your team supplies operational facts; we organise them into an auditable system.
We handle the path to certification.
Gap analysis, documents, implementation, evidence and audit preparation — managed with your team from start to certificate.
Book a free gap analysis