ISO 27001 Compliance Audit Checklist: Complete ISMS Review
Achieving ISO 27001 certification demands thorough preparation across all 11 clauses of the standard and all 93 controls in Annex A. This ISO 27001 compliance audit checklist covers every stage of the audit lifecycle – from clause 4 context analysis through clause 10 continual improvement – so your organisation walks into the certification audit with confidence. Whether you are pursuing first-time certification or preparing for a surveillance audit, this guide gives you the definitive checklist for a compliant Information Security Management System (ISMS).
ISO 27001 Compliance Audit Checklist: Clauses 4 to 10
The core of the ISO 27001 audit rests on the Plan-Do-Check-Act (PDCA) cycle embedded in clauses 4 through 10. Every auditor will examine how your organisation addresses each clause systematically. Below is the clause-level audit checklist you need to satisfy.
Clause 4: Context of the Organisation
- External and internal issues relevant to information security identified and documented
- Interested parties (regulators, customers, suppliers, shareholders) identified with their requirements recorded
- Scope of the ISMS defined, justified, and documented with exclusions explained
- ISMS scope aligned with organisational strategic direction and business objectives
Clause 5: Leadership
- Top management demonstrates leadership and commitment through visible sponsorship
- Information security policy established, approved by top management, and communicated across the organisation
- Roles and responsibilities for information security assigned and communicated
- Management review meetings held at planned intervals with documented minutes and actions
Clause 6: Planning
- Risk assessment methodology defined, documented, and approved
- Information security risk assessment completed covering confidentiality, integrity, and availability
- Risk treatment plan developed with assigned owners, timelines, and residual risk acceptance
- Information security objectives established, monitored, and communicated at relevant functions and levels
- Change management process for the ISMS documented and implemented
Clause 7: Support
- Resources (financial, personnel, technology) for the ISMS determined and provided
- Competence of personnel performing work affecting ISMS performance assessed and recorded
- Information security awareness training delivered and effectiveness evaluated
- Internal and external communications relevant to the ISMS established and documented
- Documented information controlled through identification, storage, protection, retention, and disposal procedures
Clause 8: Operation
- Risk assessment and treatment processes executed as planned
- Operational planning and control of information security processes implemented
- Third-party service delivery and outsourcing agreements include information security requirements
- Project management incorporates information security risk assessment and controls
Clause 9: Performance Evaluation
- Information security performance monitoring and measurement criteria defined and applied
- Internal audit programme established, scheduled, and executed at planned intervals
- Internal audit results reported to relevant management with corrective actions tracked
- Management review inputs and outputs documented with action items assigned
- Evaluation of the effectiveness of information security controls conducted
Clause 10: Improvement
- Nonconformities identified, logged, and corrected with root cause analysis performed
- Corrective actions implemented, verified, and effectiveness reviewed
- Continual improvement of the ISMS demonstrated through updated objectives, processes, and controls
- Lessons learned from incidents and nonconformities incorporated into the ISMS
Annex A Controls Checklist
Annex A of ISO 27001:2022 defines 93 controls organised across 4 themes. The audit will sample controls proportionate to the size and risk profile of your organisation. The table below maps the control themes, the number of controls, and the key evidence auditors expect.
| Annex A Theme | Controls | Key Evidence Required |
|---|---|---|
| Organisational controls (clauses 5.1–5.37) | 37 | Information security policies, roles and responsibilities, access control policy, supplier agreements, threat intelligence, and incident management procedures |
| People controls (clauses 5.38–5.46) | 8 | Screening background checks, terms and conditions of employment, information security awareness training, disciplinary process, and confidentiality agreements |
| Physical controls (clauses 7.1–7.14) | 14 | Physical security perimeters, entry controls, equipment maintenance, clear desk and clear screen policy, secure disposal, and media sanitisation certificates |
| Technological controls (clauses 8.1–8.34) | 34 | Anti-malware logs, firewall rules, patch management records, vulnerability scan reports, cryptographic controls, backup logs, network segregation diagrams, and audit logs |
Evidence Requirements by Clause
Auditors are trained to follow the evidence trail. For every statement your organisation makes in the ISMS documentation, the auditor will seek objective evidence. The table below details exactly what evidence is required for each clause grouping.
| Clause | Documentation Required | Objective Evidence |
|---|---|---|
| 4 – Context | Context analysis register, interested party register, ISMS scope document | Meeting minutes showing context review, stakeholder communication records |
| 5 – Leadership | Information security policy (signed by top management), role descriptions, management review minutes | Signed policy, management review attendance records, evidence of policy communication (email, intranet) |
| 6 – Planning | Risk assessment methodology, risk assessment report, risk treatment plan, SoA (Statement of Applicability) | Risk register updates, treatment plan status reports, SoA approval signatures |
| 7 – Support | Training records, competence matrix, communication plan, document control procedure | Training attendance sheets, test results, document version history, approval workflows |
| 8 – Operation | Operational procedures, change management records, third-party agreements, business continuity plans | Change request tickets, signed SLAs, BCP test results, incident reports |
| 9 – Evaluation | Internal audit programme, audit reports, management review inputs/outputs, monitoring metrics | Completed audit checklists, nonconformity reports, trend analysis dashboards, review action items |
| 10 – Improvement | Nonconformity log, corrective action records, continual improvement plan | Closed corrective actions, root cause analysis documents, improvement initiative results |
Audit Methodology: What Auditors Look For
ISO 27001 certification audits follow a structured methodology comprising three core phases: document review, site inspection, and employee interviews. Understanding each phase helps you prepare the right artefacts and train your team appropriately.
Document Review
The document review (often called Stage 1 audit) evaluates whether your ISMS documentation meets ISO 27001 requirements. The auditor checks that your policies, procedures, risk assessment, SoA, and objectives are complete, consistent, and properly authorised. Expect the auditor to examine document version control, approval dates, review cycles, and cross-references between documents.
Site Inspection
The site inspection verifies that physical and environmental controls match the documented ISMS. The auditor will tour data centres, server rooms, office areas, and secure storage locations. They will check CCTV coverage, access control logs, visitor management, clear desk compliance, fire suppression systems, and equipment labelling. Any discrepancy between what your policy says and what the auditor observes becomes a nonconformity.
Employee Interviews
Employee interviews form a critical part of Stage 2 audit. Auditors select a representative sample of staff from different roles and departments. They test awareness of the information security policy, incident reporting procedures, and role-specific controls. An employee who cannot explain how to report a security incident or who is unaware of the clear desk policy represents a finding against clause 7.3 (awareness).
Reporting: Audit Findings and Nonconformities
At the conclusion of the audit, the lead auditor issues a formal report classifying findings into three categories.
| Finding Type | Definition | Impact on Certification |
|---|---|---|
| Major nonconformity | Significant failure to meet ISO 27001 requirements; systemic breakdown of the ISMS; no effective corrective action exists | Certification cannot be granted or must be withdrawn; 30–90 days to implement corrective action |
| Minor nonconformity | Isolated lapse that does not affect the overall ISMS; corrective action plan exists but implementation is incomplete | Certification may proceed; corrective action plan must be submitted within 30 days |
| Observation / opportunity for improvement | Auditor identifies potential risk or suggests enhancement; not a failure of compliance | No direct impact on certification; addressed during next surveillance audit |
The final audit report also includes a summary of strengths, areas for improvement, and recommendations for the next surveillance cycle. Your certification body will issue the ISO 27001 certificate once all major nonconformities are closed to the auditor’s satisfaction.
Frequently Asked Questions
What is an ISO 27001 compliance audit checklist?
An ISO 27001 compliance audit checklist is a structured tool used by internal auditors and certification auditors to verify that an organisation’s ISMS meets every requirement of the ISO 27001 standard, including all mandatory clauses and Annex A controls.
How long does an ISO 27001 certification audit take?
The duration depends on the size and complexity of your organisation. A typical small-to-medium enterprise (SME) can expect 2–4 days for Stage 1 (document review) and 3–6 days for Stage 2 (implementation audit). Larger organisations with multiple sites may require significantly longer audit days.
What happens if I fail an ISO 27001 audit?
If major nonconformities are identified, certification cannot be granted until they are resolved. You will receive a formal report detailing the findings and a deadline (usually 30–90 days) to implement corrective actions. Once the auditor verifies closure, certification proceeds.
How often is ISO 27001 surveillance conducted?
Surveillance audits are conducted annually (at least once per calendar year) by your certification body. The full recertification audit occurs every three years. Surveillance audits typically sample a portion of the ISMS rather than reviewing every clause and control.
Do I need to address all 93 Annex A controls?
You must consider all 93 controls documented in your Statement of Applicability (SoA). Controls that are not applicable must be justified with a clear rationale (e.g. the organisation does not use cryptography, so control 8.24 is excluded). An auditor will challenge any exclusion that lacks a valid justification.
What is the difference between internal and external ISO 27001 audits?
An internal audit (clause 9.2) is conducted by your own staff or a third party engaged by you to evaluate the ISMS before the certification audit. An external audit is performed by an accredited certification body and results in the official ISO 27001 certificate. Internal audits are mandatory; external audits are required for certification.
Ready to achieve ISO 27001 certification? Our compliance consultants help you prepare for every clause and control. Contact Bitrixme today for a gap assessment and tailored audit roadmap.
