Free resource · ISO/IEC 27001:2022
ISO 27001 Internal Audit Checklist
Clause 9.2 requires an internal audit before you certify. Work through the questions clause by clause, note the evidence you saw, and close nonconformities before the Stage 1 audit. Download the CSV to record findings.
Clause 4 — Context of the organization
- Internal and external issues relevant to the ISMS are identified and reviewed
- Interested parties and their security requirements (customers, regulators, staff) are listed
- ISMS scope is documented, with boundaries, interfaces and justified exclusions
Clause 5 — Leadership
- Top management has approved the information security policy and it is communicated
- ISMS roles, responsibilities and authorities are assigned and documented
- Leadership can show commitment: resources, objectives and attendance at management review
Clause 6 — Planning
- A repeatable risk assessment method defines criteria for acceptable risk
- The risk register is current, with owners, likelihood and impact scores
- The risk treatment plan maps each risk to a treatment and to Annex A controls
- The Statement of Applicability covers all 93 controls with justification and status
- Risk owners approved the plan and accepted residual risk
- Security objectives are measurable, owned and tracked
Clause 7 — Support
- Resources and budget for the ISMS are adequate
- Competence records exist for people with security responsibilities
- Awareness training is complete and policy acknowledgements are recorded
- Internal and external communication about security is defined
- Documented information is version-controlled, approved and access-controlled
Clause 8 — Operation
- Risk assessments are repeated at planned intervals and after significant change
- Risk treatment actions are implemented, with dated evidence
- Outsourced processes and suppliers are identified and controlled
- Changes to the ISMS are controlled and reviewed
Clause 9 — Performance evaluation
- Metrics for ISMS performance are defined, measured and reported
- An internal audit programme exists with criteria, scope and independent auditors
- Previous audit findings are tracked to closure
- Management review minutes cover the required inputs and record decisions and actions
Clause 10 — Improvement
- Nonconformities are recorded with root cause and corrective action
- Corrective actions are verified as effective
- There is evidence of continual improvement: lessons learned from incidents and audits
Annex A — sample across the four themes
- Organizational: policies, access control, supplier security, incident management, ICT continuity
- People: screening, training, disciplinary process, remote working
- Physical: secure areas, equipment and media disposal
- Technological: MFA, endpoint protection, logging and monitoring, vulnerability management, backups, secure development, cryptography
Based on ISO/IEC 27001:2022 clauses 4–10 and Annex A. This is a working aid, not a substitute for the standard (see iso.org). Internal auditors must be independent of the area they audit.
ISO 27001 internal audit FAQ
- Is an internal audit required for ISO 27001?
- Yes. Clause 9.2 requires you to run internal audits at planned intervals and keep the programme and results as documented information. Certification bodies expect to see at least one completed internal audit before the Stage 2 audit.
- Who can perform an ISO 27001 internal audit?
- Anyone competent and independent of the process being audited. That can be a trained employee from another team, a consultant or a vCISO. You cannot audit your own work.
- How often should we run internal audits?
- At planned intervals, typically once a year covering the whole ISMS, with higher-risk areas audited more often. Many teams split the programme across quarters so evidence stays current.
- What happens to the findings?
- Each nonconformity needs a recorded root cause, a corrective action with an owner and a due date, and verification that it worked. The results feed the management review (clause 9.3).
Keep the evidence ready all year
CATAAM collects Annex A evidence from AWS, GitHub, Okta and more on a schedule, so audit day is a report, not a scramble.