ISO/IEC 27001 Internal Audit Checklist (Downloadable)
By the IgeraIndustria Quality & Compliance Team · October 2026 · 11 min read
A complete ISO/IEC 27001:2022 internal audit checklist covers the seven management-system clauses (4 Context, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement) plus a risk-based sample of the 93 Annex A controls that appear in your Statement of Applicability. For each item it records the question, the evidence seen and a grading of Conform, Minor or Major nonconformity. Clauses 4 to 10 cannot be excluded from a conformity claim; Annex A controls can be excluded only with justification.
In short: the organization must run an ISMS built on its own risk assessment, and prove through audits and management review that it keeps working.
— Paraphrased core intent of ISO/IEC 27001:2022
Why an ISO 27001 checklist must be risk-driven
ISO/IEC 27001:2022 follows the harmonized Annex SL structure shared with ISO 9001, ISO 14001 and ISO 45001, so clauses 4 to 10 will feel familiar if you already run other management systems. What makes it different is clause 6: the controls you implement are not a fixed list but the outcome of your own information security risk assessment and treatment, recorded in the Statement of Applicability (SoA). An audit checklist that only ticks off Annex A, without testing the chain from risk to treatment to control to evidence, misses the point of the standard.
Two recent changes matter for auditors. First, the 2022 revision reduced Annex A from 114 controls in 14 groups to 93 controls in four themes, and added a clause 6.3 on planning of changes. Second, Amendment 1:2024 added climate change wording to the context clauses: the organization must decide whether climate change is a relevant issue for its ISMS and record that decision, even if the answer is no. The checklist below reflects both.
How to use the grading column
- Conform: the requirement is met and evidence is available and consistent.
- Minor: an isolated lapse or partial gap that does not undermine the ISMS's ability to achieve its intended outcomes.
- Major: a requirement is missing or systematically not met, or a minor issue is repeated enough to call the system's effectiveness into question.
The checklist: clauses 4 to 10
Print each table, record the evidence you actually inspected, and grade each line. Sample records rather than only reading procedures.
Clause 4 — Context of the Organization
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Has the organization identified external and internal issues relevant to its ISMS, including whether climate change is a relevant issue (Amendment 1:2024)? | Context analysis (e.g. PESTLE/SWOT), documented climate-relevance decision, review date | ☐ C ☐ Min ☐ Maj |
| Are interested parties and their information security requirements (legal, regulatory, contractual) identified and kept current? | Interested-parties register, legal and contractual requirements register, evidence that climate-related requirements of parties were considered | ☐ C ☐ Min ☐ Maj |
| Is the ISMS scope documented, with boundaries, interfaces and dependencies stated? | Scope statement, site and system lists, outsourced-service boundaries | ☐ C ☐ Min ☐ Maj |
| Is the ISMS established, implemented, maintained and continually improved as a process-based system? | ISMS process map, documented information index, links to operating processes | ☐ C ☐ Min ☐ Maj |
Clause 5 — Leadership
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Does top management demonstrate leadership, e.g. by integrating ISMS requirements into business processes and providing resources? | Management minutes, budget decisions, objectives linked to strategy | ☐ C ☐ Min ☐ Maj |
| Is there an information security policy that is approved, communicated, available to interested parties and appropriate to the organization's purpose? | Signed policy, version history, communication records, intranet publication | ☐ C ☐ Min ☐ Maj |
| Does the policy provide a framework for objectives and commit to meeting requirements and to continual improvement? | Policy text mapped to objectives, commitment statements | ☐ C ☐ Min ☐ Maj |
| Are ISMS roles, responsibilities and authorities assigned and communicated, including who reports ISMS performance to top management? | Role descriptions, RACI, appointment letters, reporting lines | ☐ C ☐ Min ☐ Maj |
Clause 6 — Planning
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Is there a defined, repeatable information security risk assessment process with risk acceptance criteria that yields comparable results? | Risk methodology, criteria for likelihood, impact and acceptance | ☐ C ☐ Min ☐ Maj |
| Have risks been identified, analysed and evaluated, with risk owners named? | Risk register, owner assignments, dated assessment records | ☐ C ☐ Min ☐ Maj |
| Is there a risk treatment process, with options selected and a risk treatment plan approved by risk owners, including acceptance of residual risk? | Risk treatment plan, signed residual-risk acceptance | ☐ C ☐ Min ☐ Maj |
| Were the controls necessary for treatment compared against the Annex A reference set to check that none was overlooked? | Control comparison record, gap notes | ☐ C ☐ Min ☐ Maj |
| Does the Statement of Applicability list necessary controls, justify inclusion, state implementation status and justify every Annex A exclusion? | Current SoA with version and approval, traceability to the risk treatment plan | ☐ C ☐ Min ☐ Maj |
| Are measurable information security objectives set, with owners, resources, timelines and evaluation methods? | Objectives register, KPI definitions, action plans | ☐ C ☐ Min ☐ Maj |
| Are changes to the ISMS planned and carried out in a controlled manner (clause 6.3, added in 2022)? | Change plans, change approvals, impact assessments | ☐ C ☐ Min ☐ Maj |
Clause 7 — Support
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Are the resources needed for the ISMS determined and provided? | Resource plans, staffing and tooling records | ☐ C ☐ Min ☐ Maj |
| Is competence defined for people affecting information security performance, with training or other action and evidence it worked? | Competence matrix, training records, effectiveness reviews, certificates | ☐ C ☐ Min ☐ Maj |
| Are people aware of the policy, their contribution and the implications of not conforming? | Awareness campaign records, induction material, test or phishing-exercise results | ☐ C ☐ Min ☐ Maj |
| Are internal and external communications about the ISMS planned (what, when, who, how)? | Communication plan, sample communications, contact lists | ☐ C ☐ Min ☐ Maj |
| Is documented information required by the standard and by the organization created, updated and controlled (identification, approval, access, retention)? | Document register, version control logs, access permissions, retention schedule | ☐ C ☐ Min ☐ Maj |
Clause 8 — Operation
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Are operational processes planned, implemented and controlled to meet requirements and deliver the risk treatment plan, with outsourced processes controlled? | Operating procedures, supplier control records, process evidence | ☐ C ☐ Min ☐ Maj |
| Are information security risk assessments performed at planned intervals or when significant changes occur, with results retained? | Assessment schedule, reassessment records after changes | ☐ C ☐ Min ☐ Maj |
| Is the risk treatment plan actually implemented, and are results retained as documented information? | Treatment task tracking, completion evidence, status reports | ☐ C ☐ Min ☐ Maj |
| Are unplanned changes reviewed, with unintended consequences mitigated? | Emergency change records, post-change reviews | ☐ C ☐ Min ☐ Maj |
Clause 9 — Performance Evaluation
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Has the organization determined what to monitor and measure, the methods used, timing, and who analyses the results (9.1)? | Metrics definitions, dashboards, analysis reports | ☐ C ☐ Min ☐ Maj |
| Is the internal audit programme (9.2) planned, does it cover the whole ISMS, use defined criteria and scope, and use objective, impartial auditors? | Audit programme, audit plans, auditor independence declarations, audit reports | ☐ C ☐ Min ☐ Maj |
| Are audit results reported to relevant management and retained as documented information? | Reports, distribution records, finding log | ☐ C ☐ Min ☐ Maj |
| Does management review (9.3) occur at planned intervals and consider prior actions, changes in issues, nonconformities, monitoring results, audit results, objectives, feedback, risk results and improvement opportunities? | Management review agenda, minutes, input pack | ☐ C ☐ Min ☐ Maj |
| Do management review outputs include decisions on improvement opportunities and any need for ISMS change, and are they retained? | Minutes with decisions, action tracker with owners and dates | ☐ C ☐ Min ☐ Maj |
Clause 10 — Improvement
| Audit question | Expected evidence | Conform / Minor / Major |
|---|---|---|
| Is the ISMS continually improved in suitability, adequacy and effectiveness (10.1)? | Improvement log, trend analysis, before and after metrics | ☐ C ☐ Min ☐ Maj |
| When a nonconformity occurs (10.2), is it reacted to, evaluated for cause, corrected, and checked for similar cases elsewhere? | Nonconformity records, root cause analyses | ☐ C ☐ Min ☐ Maj |
| Is the effectiveness of each corrective action reviewed, and is the ISMS changed where needed? | Effectiveness verification, closure evidence, updated documents | ☐ C ☐ Min ☐ Maj |
| Are nonconformities and corrective actions retained as documented information? | Corrective action register with full history | ☐ C ☐ Min ☐ Maj |
Annex A spot-checks by theme
Annex A (aligned with ISO/IEC 27002:2022) contains 93 controls grouped in four themes: 37 organizational, 8 people, 14 physical and 34 technological. You do not audit all of them every time. Use the SoA to select the controls marked as applicable, weight the sample towards the highest risks and any areas with recent incidents or changes, and make sure every theme is covered across the audit cycle.
| Theme | Typical coverage | Spot-check to run | C / Min / Maj |
|---|---|---|---|
| Organizational controls (37) | Policies, roles, asset inventory and acceptable use, access control, supplier relationships, incident management, business continuity, legal compliance, threat intelligence, cloud services. | Pick 3 controls from the SoA marked as implemented. Trace each to its policy, owner and a dated record produced in the last 12 months. | ☐ C ☐ Min ☐ Maj |
| People controls (8) | Screening, terms of employment, awareness and training, disciplinary process, leaving or changing roles, confidentiality agreements, remote working, event reporting. | Sample two recent joiners and two leavers. Check screening, signed agreements, access granted on time and access removed on exit. | ☐ C ☐ Min ☐ Maj |
| Physical controls (14) | Perimeters and entry controls, securing offices, physical security monitoring, equipment siting and protection, secure disposal, clear desk and screen. | Walk one site. Compare visitor logs, badge lists and equipment disposal records against the documented procedure. | ☐ C ☐ Min ☐ Maj |
| Technological controls (34) | Endpoint security, privileged access, authentication, malware protection, vulnerability management, configuration, backup, logging and monitoring, network security, cryptography, secure development, data leakage prevention. | Pick one critical system. Verify patch status, privileged access review, backup restore test and log review for the last quarter. | ☐ C ☐ Min ☐ Maj |
Also check that each Annex A exclusion in the SoA has a justification that still holds, and that implemented controls match the status the SoA claims. A SoA that says "implemented" for a control nobody can evidence is one of the most common Major findings.
Where NIS2 fits in
If your organization is in scope of the EU NIS2 Directive, an ISO 27001 ISMS gives you a strong base for many of its risk-management measures, but it does not automatically satisfy every obligation (incident reporting deadlines and management accountability, for example, need explicit attention). See our NIS2 vs ISO 27001 correspondence table to map your audit findings to NIS2 measures.
What auditors actually probe
Experienced auditors follow threads. They pick a risk from the register and trace it to a treatment decision, to the SoA, to the control and finally to a record of the control operating. They compare the management review minutes with the audit reports and incident log to see whether the inputs were genuinely discussed. A break anywhere in that chain is where findings come from.
Common mistakes that surface in audits
- A SoA copied from a template: controls are marked applicable or excluded without link to the actual risk assessment.
- Risk assessments that are never refreshed: the register predates major system, supplier or organizational changes.
- Audits by the people who run the process: impartiality is not demonstrated, so the audit loses credibility.
- Management review as a formality: minutes lack the required inputs or contain no decisions.
- Awareness measured by attendance only: no evidence that staff understand their responsibilities.
- Corrective actions closed without checking effectiveness: the same incident type recurs.
- Climate change relevance never documented: a simple omission since Amendment 1:2024.
- Outsourced services out of scope in practice: cloud and managed-service providers are used but not controlled.
Turning the checklist into an audit-ready habit
The slow part of an ISMS audit is rarely deciding what to check. It is finding the record: the right version of the SoA, the review minutes, the supplier assessment, the evidence that a control ran last quarter. When these live across shared drives, ticketing tools and email, auditors wait and findings multiply.
IgeraIndustria lets your security and quality team ask direct questions, such as "which Annex A controls did we exclude and why?" or "when was the last management review and what did it decide?", and get an answer sourced from your own ISMS documents, with the exact source cited. If you also run other standards, the same approach works across our ISO 17025, ISO 13485 and ISO 45001 checklists, so one audit method covers your integrated management system.
Make your ISMS evidence searchable before the auditor arrives
IgeraIndustria connects your policies, risk registers, SoA and audit history so any question about your security management system gets an answer with an exact source.
Discover IgeraIndustriaFrequently asked questions
How often must an ISO 27001 internal audit be carried out?
The standard requires internal audits at planned intervals, without prescribing a frequency. Most organizations run an annual programme that covers the full ISMS across the certification cycle, with higher-risk areas and recently changed processes audited more often. Certification bodies expect the programme to be well advanced before surveillance and recertification audits.
Do I have to audit all 93 Annex A controls every year?
No. The audit programme must cover the whole ISMS over time, but you can sample controls based on risk, past incidents and changes. What matters is that the sampling logic is documented and every theme gets coverage within the cycle.
Can the information security manager audit their own work?
Auditors must be objective and impartial, so they should not audit their own work. Smaller companies often use staff from another department, a peer from a partner organization or an external auditor for areas where independence is otherwise impossible.
What is the Statement of Applicability and why do auditors focus on it?
The SoA lists the controls you consider necessary, justifies including them, states whether they are implemented, and justifies any Annex A control you exclude. It is the link between your risk treatment and your actual controls, so it is the first document many auditors ask for.
What changed with Amendment 1:2024 on climate change?
The amendment added wording to the context and interested-party clauses (4.1 and 4.2) so that organizations consider whether climate change is a relevant issue and whether interested parties have climate-related requirements. You should document your conclusion, even if you decide it is not relevant.
Does this checklist replace the standard or my certification body's criteria?
No. It is a self-assessment aid. Clause references are summarized for readability, and the licensed text of ISO/IEC 27001:2022 and your certification body's requirements take precedence.
What is the difference between a Minor and a Major nonconformity?
Definitions vary slightly between certification bodies, but a Minor is generally an isolated or partial lapse that does not prevent the ISMS achieving its outcomes, while a Major is a missing or systematically unmet requirement. Agree your internal grading rules in the audit programme.
Important notice
This article is a practical self-assessment aid. It does not constitute certification, legal or regulatory advice and is not a substitute for the full text of ISO/IEC 27001:2022 (including Amendment 1:2024) or for your certification body's audit criteria. Requirements are paraphrased, not reproduced; always verify exact wording against the current standard. For guidance specific to your organization, consult a qualified information security consultant or your certification body.
Summary
- An ISO/IEC 27001:2022 audit checklist covers clauses 4 to 10 in full and samples the 93 Annex A controls (37 organizational, 8 people, 14 physical, 34 technological) based on risk.
- Trace the chain risk, treatment, Statement of Applicability, control, evidence; breaks in that chain produce most findings.
- Document the climate change relevance decision required since Amendment 1:2024.
- Use the same method alongside NIS2 mapping and your other management system audits, and keep evidence instantly searchable.
Last updated: October 2026 | Reference: ISO/IEC 27001:2022 — Information security, cybersecurity and privacy protection — Information security management systems — Requirements, with Amendment 1:2024 | Author: IgeraIndustria Quality & Compliance Team | IgeraIndustria. This checklist is a summary aid; where it differs from the current published standard or your certification body's requirements, those sources take precedence.