All services Every engagement has a fixed, published price. Book a strategy call
The whole road from gap analysis to certificate: the seven steps, who performs each one, the evidence stage everyone underestimates, and where certifications fail.
Most descriptions of the ISO 27001 certification process are written by people selling one stage of it, so the map always ends where their service does. This guide walks the whole road from first gap analysis to the certificate on the wall, including the stage everyone underestimates, the audits nobody explains properly, and what happens after the certificate arrives. Every fee is a published floor and every step says who performs it, because the most misunderstood fact about ISO 27001 is that your consultant is never allowed to certify you.
The short answer. The path to ISO 27001 certification runs: gap analysis, build the ISMS, operate it and gather evidence, internal audit and management review, then a Stage 1 and Stage 2 audit by an independent accredited certification body. The certificate is valid for three years with annual surveillance audits. End to end the journey commonly takes four to nine months depending on size and starting maturity. With Intelance, a gap analysis starts from £8,500 + VAT and a full ISMS build from £25,000 + VAT. The certification audit itself is bought separately from a certification body, which is how the standard keeps auditors independent.
| Step | Who does it | What comes out |
|---|---|---|
| 1. Gap analysis | You, or an independent adviser | An honest picture of the distance to the standard and a sequenced plan |
| 2. Build the ISMS | You, with or without an adviser | Scope, risk assessment, controls, policies and owners that match how you work |
| 3. Operate and gather evidence | You | Weeks of real records proving the system runs: reviews held, risks treated, incidents handled |
| 4. Internal audit and management review | Someone independent of the ISMS build | Clause 9.2 and 9.3 satisfied, findings fixed before the certifier sees them |
| 5. Stage 1 audit | Accredited certification body | Documentation review and readiness verdict, with areas of concern to fix |
| 6. Stage 2 audit | Accredited certification body | The real audit: evidence that the ISMS operates. Pass, or nonconformities to close |
| 7. Certificate and surveillance | Certification body, annually | A certificate valid three years, surveillance audits each year, recertification at year three |
Everything starts with an honest measurement of the distance between how you run today and what ISO/IEC 27001:2022 requires. A good gap analysis covers the management clauses and the Annex A controls, scores each against evidence rather than intention, and ends in a sequenced plan with owners. This is also where scope gets decided, and scope is the biggest cost lever in the whole journey: certifying one service line or site first is often the intelligent move, and certifying everything at once is often ambition dressed as strategy. Our readiness assessment and gap analysis runs from £8,500 + VAT.
The build turns the plan into a working management system: the risk assessment and treatment plan, the Statement of Applicability, the policies people will follow, and the controls with named owners. The trap here is the template pack. Bought documentation describes an imaginary company, and Stage 2 auditors read imaginary documentation for a living. A system built around how you genuinely work is faster to operate and far safer in the audit room. Our ISMS Foundations build runs from £25,000 + VAT, and the full practice is on the ISO 27001 consulting page.
This is the stage everyone underestimates. Certification bodies audit evidence that the system runs, and evidence takes time to exist: access reviews held, incidents logged and closed, risks treated, training delivered. Auditors commonly expect to see around three months of operating records before Stage 2, and organisations that book the audit before the evidence exists buy themselves a postponement. Plan the calendar backwards from the evidence rather than forwards from enthusiasm.
Before the certifier arrives, the standard requires you to audit yourself under clause 9.2 and hold a management review under clause 9.3. The internal audit must be independent of the people who built and run the ISMS, which is why organisations without a spare qualified auditor buy it in. Done well, it finds the problems while they are still cheap and private. Our internal audit runs from £4,500 + VAT and is performed by people who had no hand in the build, because an audit of your own homework convinces nobody.
Certification is bought from a certification body, and in the UK the mark of a meaningful one is UKAS accreditation. Stage 1 is a documentation and readiness review: the auditor checks the ISMS design, confirms scope, and lists areas of concern to fix before Stage 2. Stage 2 is the real examination: days of interviews, sampling and evidence checks proving the system operates as written. Findings come as minor nonconformities, which you fix on a plan, or major nonconformities, which block the certificate until resolved. A clean internal audit and a genuine evidence trail make Stage 2 an inspection rather than an ordeal.
The certificate arrives valid for three years, and the certification body returns every year for surveillance audits, with full recertification at year three. This is where unsupported ISMSs quietly decay: the champion who built it moves on, reviews stop, and the year two surveillance becomes an emergency. Running the system as a rhythm rather than an annual panic is what our Managed ISMS does from £2,500 + VAT per month. The full market pricing picture, including what certification bodies charge, is in our guide to what ISO 27001 costs in the UK.
The same five failures recur. Scope drawn too wide, so the audit surface dwarfs the team maintaining it. Template documentation describing a company that does not exist. Booking Stage 2 before the operating evidence does. Skipping or rubber stamping the internal audit, which converts cheap private findings into expensive public ones. And treating surveillance as optional after the certificate arrives, which is how certificates get suspended. Every one of these is avoidable with an honest gap analysis and a calendar planned backwards from the evidence.
Commonly four to nine months end to end, depending on organisation size and starting maturity: weeks for a gap analysis, a build measured in months, around three months of operating evidence, then the Stage 1 and Stage 2 audits. The evidence period is the part that cannot be compressed by spending more.
Stage 1 is a documentation and readiness review that confirms the ISMS design and scope and lists concerns to fix. Stage 2 is the full audit of operation: interviews, sampling and evidence checks. The certificate is awarded after a successful Stage 2.
An independent certification body, and in the UK the meaningful ones are UKAS accredited. Consultants prepare you and are never allowed to certify their own work, so the audit is always bought separately from the advice.
No, because the certificate is awarded by an independent body after its own audit. What a good consultant can do is measurable: an honest gap analysis, a system built on how you work, evidence in place, and an internal audit that finds problems before the certifier does.
Three years, with surveillance audits each year and full recertification at year three. Letting the system decay between audits is the most common way organisations lose the certificate they worked for.
Minor nonconformities are fixed on an agreed corrective action plan and rarely block certification. Major nonconformities must be resolved and verified before the certificate is issued or retained. A genuine internal audit beforehand exists precisely to find these while they are still private.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
