Yes, and for many companies it is the more useful order. An audit run while some controls are still being built shows which gaps matter most, while there is still time to close them.
Missing or half-finished controls become findings. If the supplier security policy is approved but no supplier has been assessed yet, the report records it, and the fix goes on the corrective action log.
Two conditions apply. Before certification, the audit programme has to cover the whole ISMS: clauses 4 to 10 and every Annex A control in your Statement of Applicability. The certification auditor will also want to see that the gaps were closed before Stage 2.
A practical approach is to run the main internal audit once the core of the ISMS is in place and the remaining controls have firm dates. A short follow-up audit of those late controls then follows a few weeks before Stage 2. For example, a company with everything in place except business continuity testing might audit the full ISMS in March, run its first continuity test in April and have that one control audited in May.
One early audit of a half-built system with no follow-up works badly. The certification auditor sees a report full of gaps and no sign that anyone checked them again.