Which one of the following options best describes the main purpose of a Stage 1 third-party audit?

The Stage 1 audit is a high-level review primarily focused on the Information Security Management System (ISMS) documentation. Its main purpose is to evaluate if the organization's documented system meets the requirements of the ISO/IEC 27001 standard and to confirm its readiness for the more detailed Stage 2 certification audit. This includes reviewing the scope, policies, objectives, and the results of the risk assessment. It ensures that the organization is prepared for a full assessment of its ISMS implementation and effectiveness.

A. Introducing the team is an activity during the audit, not its main purpose.
B. Procurement is only one small part of the ISMS; the Stage 1 audit reviews the entire documented system.
D. The audit checks the process for legal compliance, but it is not a legal compliance audit itself.
E. An audit report is an output of the audit process, not the primary purpose for conducting it.
F. The organisation's customers are generally outside the scope of the ISMS audit's main purpose.

1. ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1: Requirements, Section 9.3.1.2.1 states the objectives for the stage 1 audit are to "determine the conformity of the client's management system... and its readiness for stage 2."

2. ISO/IEC 27006:2015, Information technology — Security techniques — Requirements for bodies providing audit and certification of information security management systems, Section 9.3.1.2, directly references the Stage 1 objectives outlined in ISO/IEC 17021-1.