Your security policies may be documented. But can you prove they’re actually being followed?
This is one of the biggest challenges organizations face during an ISO/IEC 27001 audit.
Having an Information Security Management System (ISMS) policy is important, but auditors also look for objective evidence that the organization’s security processes are implemented, monitored, and maintained.
If you’re preparing for an ISO 27001:2022 audit, here are 10 essential areas to review.
1. ISMS Scope and Information Security Policy
What to prepare: Approved ISMS scope, information security policy, and evidence that the policy has been communicated appropriately.
What auditors check: Whether the organization’s ISMS boundaries, responsibilities, and security direction are clearly defined.
Relevant clauses: 4.3 and 5.2.
2. Information Security Risk Assessment
What to prepare: Risk assessment methodology, risk register, assessment results, and risk evaluation criteria.
What auditors check: Whether risks are identified and evaluated using a consistent, defined approach.
Relevant clauses: 6.1.2 and 8.2.
3. Risk Treatment Plan and Statement of Applicability (SoA)
What to prepare: Risk treatment decisions, treatment plan, and current Statement of Applicability.
What auditors check: Whether the organization has justified its control selections and exclusions and can demonstrate their implementation status.
Relevant clauses: 6.1.3 and 8.3.
4. Access Control Evidence
What to prepare: Examples of approved access requests, user access reviews, account removal records, and privileged-access approvals, as applicable.
What auditors check: Whether access is granted, reviewed, and removed according to documented requirements.
Relevant Annex A controls include 5.15, 5.16, 5.18 and 8.2.
5. Security Awareness and Competence Records
What to prepare: Relevant training records, competence assessments, and evidence of security awareness activities.
What auditors check: Whether personnel understand their security responsibilities and have the competence required for their roles.
Relevant clauses: 7.2 and 7.3.
6. Incident Management Evidence
What to prepare: Incident records, investigation notes, escalation evidence, and documented response actions.
What auditors check: Whether applicable incident management processes are followed, not merely described in a policy.
Relevant Annex A controls include 5.24–5.28.
7. Backup and Recovery Evidence
What to prepare: Backup schedules, backup execution records, recovery-test results, and documented exceptions.
What auditors check: Whether relevant backup and recovery measures are implemented and operating as intended.
Relevant Annex A controls may include 8.13 and 5.30.
8. Internal Audit Records
What to prepare: Internal audit programme, scope and criteria, audit reports, identified findings, and follow-up records.
What auditors check: Whether internal audits are conducted at planned intervals and whether their results are reported and documented.
Relevant clause: 9.2.
9. Management Review Evidence
What to prepare: Management review records covering ISMS performance, audit findings, risk treatment, decisions, and improvement actions.
What auditors check: Whether top management evaluates the ISMS and makes decisions about its continued effectiveness and improvement.
Relevant clause: 9.3.
10. Nonconformities and Corrective Actions
What to prepare: Nonconformity records, root-cause analysis where appropriate, corrective actions, and evidence that action effectiveness was reviewed.
What auditors check: Whether problems are addressed systematically rather than simply marked as closed.
Relevant clause: 10.2.
A Practical ISO 27001 Audit Scenario
Consider an organization that has a documented Access Control Policy requiring quarterly user access reviews.
During an audit, the auditor asks:
“Can you show evidence that these reviews were actually performed?”
The organization provides its policy but cannot produce review records, reviewer decisions, or evidence of follow-up actions.
What’s the issue?
The policy defines an expectation, but the organization cannot demonstrate that the process was carried out.
Depending on the audit criteria and other available evidence, this could lead to an audit finding.
The lesson: A documented policy is not a substitute for evidence of implementation.
Quick ISO 27001 Audit Readiness Checklist
Before your next audit, ask:
- Is the ISMS scope current and approved?
- Are risk assessment and treatment records available?
- Is the Statement of Applicability up to date?
- Can we demonstrate that applicable controls are operating?
- Are competence and awareness records available?
- Have required internal audits been completed?
- Are management review results documented?
- Can we demonstrate corrective action and follow-up?
Important: This is a practical preparation checklist, not an exhaustive list of all ISO 27001 requirements. The specific evidence required depends on the ISMS scope, risks, applicable controls, and audit criteria.
Final Thoughts
Successful ISO 27001 audit preparation is not about collecting the largest number of documents.
It’s about maintaining an effective ISMS and demonstrating that security responsibilities, controls, monitoring, and improvement processes are actually working.Remember: A policy tells the auditor what should happen. Evidence helps demonstrate what did happen.
