This article uses ISO-specific terms that can be found in our glossary.

After Stage 1

At the conclusion of your Stage 1 audit, your Assessor will meet with you to review their findings. Their goal is to ensure you are ready for your Stage 2 audit. Immediately after the Stage 1 audit, there are a handful of activities you will need to complete:

1. Address any findings from your Assessor:

   • If they have identified any nonconformities (regardless of ‘major’ or ‘minor'), you must complete a Corrective Action Plan (CAP) template for each finding. Your Assessor will send you one template for each nonconformity (NC), with their section completed. They will ask for these back ~2 weeks after they have held their closing meeting.

   • If present, address any Areas of Concern (AoC) that might lead to a NC during your Stage 2 audit. These must be addressed prior to the Stage 2 audit kick-off.

   • If your Assessor has identified any Opportunities for Improvement (OFIs), you may address these prior to Stage 2 if you have time and available resources to do so. If you do not have time or resources, consider addressing these later on.

2. Address any nonconformities identified from your Internal Audit:

   • If you use the Nonconformity and Corrective Actions Log template provided by Strike Graph, the corrective actions will be documented there.

3. Maintain your Nonconformity and Corrective Action Plan (NCA) Log:

   • Add all NCs, AoCs, and OFIs to your NCA Log. This should include Internal Audits findings, any findings from stakeholders, or any findings from the ISMS Team.

     • You do not need to repeat any of the content on the Assessor’s version of the Corrective Action Plan - that data can live there. In other words, for the Assessor-identified findings, you can add a link on your NCA Log to their document.

     • If an Internal Audit finding is identical to an Assessor’s finding, you can reference it to the Assessor’s line item and address both simultaneously.

4. Hold an ISMS (+PIMS) Team Meeting:

   • Present any auditor/assessor findings and their corrective actions at this meeting.

   • Review the status of each item on your NCA Log. Discuss all NCs, AoCs, and OFIs and ensure that they are addressed. This review should also be a standing agenda item for ISMS (+PIMS) meetings - don't forget to document, document, document!

5. Prepare for Stage 2:

   • Continue to upload all evidence items into Strike Graph.

   • When the Assessor sends you their Stage 2 document request list, compare it with the active evidence in Strike Graph. It's common for the Assessor to add a few more items that are likely unique to your organization.

     • You can search for and activate additional evidence items that already exist within the Strike Graph library, or you may create custom evidence items and link them to the relevant control(s).

After Stage 2

At the conclusion of your Stage 2 audit, your Assessor may also provide you with additional findings. These findings must be addressed and then re-assessed for you to become Certified. In addition:

1. Expect Internal Audit to return to re-test any of their findings that arose from their audits. You can set this cadence with them.

2. Consider the scope and timing of your next internal audit. Internal Audits are required to maintain your Certification.

3. If you have not done so already, set up a cadence to monitor your ISMS (+PIMS). We suggest the ISMS (+PIMS) team meet monthly until you get into the swing of things, then transition to quarterly.