What happens in a stage 1 and stage 2 ISO 37001 audit?

ISO 37001 audits commonly separate work into stage 1 and stage 2 activities. The course agenda highlights both stages and places them within a broader audit lifecycle that includes preparation, execution, and closing.Stage 1 is part of initiation and preparation. It is used to confirm the audit scope and approach, clarify how the ABMS is structured, and determine whether the organization is ready for the next stage. In practical terms, stage 1 aligns expectations on what will be audited and how evidence will be evaluated. It also helps the audit team plan stage 2 activities more precisely.Stage 2 is where on-site audit activities take place. The agenda for Day 3 includes preparing for stage 2, executing stage 2, maintaining communication during the audit, applying audit procedures, and creating audit test plans. Test plans are important because they translate audit objectives into targeted checks and sampling strategies, which supports evidence-based conclusions.The course also emphasizes audit principles such as evidence-based auditing and risk-based auditing. Evidence-based auditing requires clear linkage between observed facts and the requirements being assessed. Risk-based auditing helps prioritize audit effort toward areas where bribery exposure or control weaknesses are more likely to matter.After stage 2, the audit moves into closing activities, including drafting findings and nonconformity reports, performing documentation and quality review, and evaluating action plans. The course includes “beyond the initial audit” and managing an internal audit program, reinforcing that audit work should feed ongoing oversight rather than end with a report.