ISO 27001: present unfinished controls with confidence

Walking into a Stage 2 audit with controls still in progress feels like sitting an exam with half the syllabus unread. It isn't. Partially implemented controls are common in first certifications, and what the auditor assesses is not whether you finished everything. It's whether you know exactly what is open, who owns it, and when it lands. In the first year, the auditor accepts that your evidence history is short: they look at the state of your ISMS on audit day plus a credible work plan for the year ahead. This guide shows you how to use your Statement of Applicability and risk treatment plan to disclose open work, assign ownership, and present progress an auditor can verify.

What you'll need before audit day

Three artifacts carry most of the weight here. Get them straight before the opening meeting and the rest of the conversation becomes much calmer.

• A current Statement of Applicability with an honest implementation status for every applicable control, plus justifications for anything excluded.

• A risk treatment plan that lists each incomplete control with a named owner, a target date, and whatever interim measure is already in place.

• Management sign-off on the residual risk you're carrying while that work finishes.

If you run your ISMS in Secfix, the compliance automation platform, check the live control status shortly before the audit instead of relying on an older snapshot. Stale status is one of the easiest findings to avoid.

Step 1: Classify findings the way your auditor will

Before you can present a gap well, you need to know which bucket it lands in. Certification bodies work with three outcomes, and the differences are practical, not academic.

A major nonconformity means something has failed outright. The requirement is missing or has broken down entirely, or a cluster of small lapses in one area points to a systemic problem. Classic examples are no risk register or risk assessment at all, or no internal audit at all. Certification stops, you fix it, the auditor verifies the fix, then the process continues.

A minor nonconformity is an isolated lapse inside a system that does work: one control not implemented, or implemented without the right evidence. It does not break your certification. A documented gap with a plan beats a hidden one every time.

An opportunity for improvement is a recommendation with no obligation attached. Take it seriously anyway, because it tells you what the auditor will look at next year.

Incident response is a useful reality check on which category you're in. The UK Department for Science, Innovation and Technology found that 45% of businesses had none of the surveyed measures in place for dealing with cyber security incidents, including assigned roles, written notification guidance, or a formal incident response plan (UK Department for Science, Innovation and Technology). Complete absence of a process like that is the shape of a major. A single incident that wasn't logged properly is not. This breakdown of common ISO 27001 nonconformities walks through more examples.

Step 2: Audit your own Statement of Applicability for accuracy

Go control by control and ask one question: would the evidence behind this status survive a sample? Never mark a control as implemented when work remains. An overstated status is the fastest way to turn a manageable gap into a credibility problem, because the auditor now has to question every other line in the document.

Two areas are commonly optimistic. Supplier and vendor controls are one: KPMG reported that 80% of internal audit professionals polled described their third-party risk management audit program as basic or nonexistent (KPMG). Governance over newer technology is the other. IBM and the Ponemon Institute found that 63% of breached organizations either had no AI governance policy or were still developing one, and only 34% of organizations with a policy performed regular audits for unsanctioned AI (IBM and Ponemon Institute).

Where a control genuinely doesn't fit your scope, say so and justify it specifically. "Not applicable because it makes sense" fails. "No physical server rooms in scope; infrastructure runs entirely on managed cloud services" passes.

Step 3: Document incomplete controls in your risk treatment plan

Every control you've marked as partially implemented or planned belongs in the risk treatment plan with four things attached: the named owner, a realistic target date, what is already in place today, and the residual risk management has accepted in the meantime.

That interim measure matters more than teams expect. If single sign-on isn't rolled out yet, document the manual access review you're running until it is. If your vulnerability process is still maturing, show what you're already patching and on what cadence. Patching deserves that attention: Verizon's 2026 analysis found 31% of breaches began with vulnerability exploitation, the leading initial breach entry point (Verizon).

Then get leadership to sign the acceptance. Risk ownership sitting visibly with management is what turns a gap from an oversight into a decision. A signed risk acceptance is where leadership attention becomes visible in your ISMS. It also helps to agree internally on realistic deadlines for audit findings before you commit them to paper.

Step 4: Prepare to walk the auditor through your progress

The audit is a conversation, not a cross-examination. Gaps get discussed in context, alongside how you plan to close them, so prepare the narrative rather than hoping the topic doesn't come up. Lead with what's done and evidenced, then move to what's open and the plan behind it.

What smooth audits have in common is an owner behind every control, and those owners presenting their own controls. In a small company one or two people covering everything is perfectly fine. A typical split: the engineering lead or CTO owns software development, cloud and IT; a leadership person such as the CEO or COO owns policies, governance, risk and the audit itself; whoever leads hiring owns HR. Schedule their time in advance.

Bring the supporting material with you: partial logs, policy drafts in review, tooling configurations, vendor onboarding tickets. PwC found that 64% of companies said technology investment has improved visibility of risks and risk management activities (PwC). In the audit room, that visibility helps most when the control status you present and the evidence behind it come from the same source. These notes on habits of successfully certified teams cover how that preparation usually runs.

Step 5: Build a corrective action plan the auditor will accept

After the audit you submit a plan within a deadline set by your certification body, and the auditor approves it. Three elements belong in every entry: the root cause, the corrective action, and the action itself with a date and a responsible person.

A worked example. The finding is no multi-factor authentication because there's no identity provider yet. Root cause: authentication was never centralized as the team grew. Corrective action: roll out an identity provider with enforced MFA across all company accounts. Evidence of momentum: proof that you are already in contact with the identity provider vendor. Date: specific, and one you can hold. The auditor verifies effectiveness at next year's audit.

Once the plan is approved, certification proceeds. That's the part first-time candidates rarely believe until they see it. If you're unsure what to record immediately after a finding is raised, the guide on the first actions after a nonconformity sets out the sequence.

Troubleshooting: what turns a small gap into a bigger one

• Hiding a gap instead of documenting it. Auditors treat a concealed gap far more seriously than an open one, because it calls your whole management system into question rather than one control.

• Leaving controls without a named owner. Unassigned work reads as weak governance, and several unowned controls in the same area can start to look like a pattern rather than isolated lapses.

• Overcommitting on dates. A target you miss can create a second finding next year. Pick dates your team can actually hit, including the quarter when everyone is busy.

• Letting documents drift apart. If your Statement of Applicability says implemented and your risk treatment plan says in progress, the inconsistency itself becomes the finding.

Key takeaways

• Mark every control honestly in your Statement of Applicability, even when the honest answer is "partially implemented".

• Give each open control a named owner and a date you can defend, then have that owner present it in the audit.

• Ask management to formally accept residual risk before audit day so the auditor sees a decision, not an oversight.

• Disclose every gap you know about rather than waiting to see whether the sample finds it.

• Confirm corrective action deadlines directly with your certification body once the findings are issued, since they vary.

Frequently asked questions

How long do I have to fix a major nonconformity?

Timelines depend on your certification body, so confirm yours in writing. In practice you demonstrate the correction and submit it for verification, sometimes through a short follow-up audit, before the certificate can be issued. The certification decision is put on hold until the major nonconformity is closed.

Can I still get certified with minor nonconformities?

Yes. You submit a corrective action plan covering root cause, action, owner and date. Once the auditor approves it, certification moves forward, and the auditor checks that the action worked at the next audit.

What evidence do auditors examine most closely in a Stage 2 audit?

Operational evidence that controls actually run: access lists and the reviews behind them, onboarding and offboarding records, incident records, backup restore tests, and progress against your risk treatment plan. They also check consistency between what your Statement of Applicability claims and what the systems show.

Can I be certified with controls still in progress?

Often, yes, provided the gap is disclosed, owned, dated and risk-accepted. What usually blocks certification is a requirement that is missing entirely, not work that is visibly underway.

Next steps

Set aside time before your audit to reconcile three documents: the Statement of Applicability, the risk treatment plan, and your evidence repository. Where they disagree, fix the record rather than the story. Own your activities, bring the owners into the room, and let the auditor see a team that knows precisely where it stands.