ISO 27001 Internal Audit Checklist Template

The first task records the audit type. A full ISMS audit switches on the management system clause task in Phase 4.

• Open the audit from its programme slot — record the ISMS areas, sites, dates, programme owner, lead auditor and whether this is a full or partial ISMS audit
• Note the risk reasoning behind this slot — how important the processes are, what earlier audits found, and incidents or risk changes since the last audit (clause 9.2.2)
• Fix the objectives, criteria and scope before planning — the clauses, the Annex A controls marked applicable, your own policies, and contractual or legal security requirements
• Confirm which versions of the ISMS documents are in force — the scope statement, risk treatment plan and Statement of Applicability this audit will test against
• Pull every open finding against this area — from earlier internal audits, the certification body and customer audits, with the status of each action

The last task is an approval assigned to the programme owner named in Phase 1. Planning and fieldwork stay locked until it is approved.

• Choose the lead auditor and any technical specialist — for example someone who can read cloud IAM policies or firewall rules when technological controls are sampled
• Record each auditor’s competence — ISMS audit training, audit experience and knowledge of the technology in scope (clause 7.2)
• Check each auditor against the scope for conflicts — nobody audits a control they designed, operate or manage, including the ISMS manager’s own processes
• Agree read-only access and evidence handling — console, log and ticket access for the auditor, and where exports containing sensitive data are kept
• Approve the audit team’s objectivity and impartiality — the programme owner approves, or replaces an auditor before any fieldwork starts (clause 9.2.2)

• Read the ISMS records for the scope — risk register, risk treatment plan, Statement of Applicability, relevant policies and the last management review minutes
• Select the Annex A controls to sample — weight towards high risks, recent incidents, controls changed this year and controls not yet tested in this certificate cycle
• Define each population and sample size — for example leavers in the audit period, change tickets, privileged accounts or new supplier contracts
• Decide how each sampled control will be tested — its design against the policy, then its operation over the period by inspection, re-performance or observation
• Send the audit plan to auditees — timetable, interviews, systems to be demonstrated and which sessions run remotely

The management system clause task appears only when Phase 1 records a full ISMS audit.

• Open fieldwork with the auditees — walk through the plan, the grading scale, how evidence and screenshots will be handled, and the closing meeting slot
• Full ISMS audit: test the management system clauses 4 to 10 — including the decision on whether climate change is a relevant issue (clause 4.1), risk treatment, objectives, monitoring and management review
• Trace a sample of risks through to evidence — from the risk register through the treatment plan and Statement of Applicability to a control that is working
• Test each sampled control’s operation over the period — tickets, logs, review sign-offs and configuration exports dated in the period, not screenshots taken on the day
• Interview the people who operate the controls — service desk, developers, HR and facilities staff, not only the ISMS manager
• Log every observation with an evidence reference — record ID, system, date and the clause or control it relates to, so a reviewer could re-perform the test

The grading task asks whether any nonconformity was raised. A yes opens Phase 6.

• Draft each finding against its criterion — the clause or control, the sampled evidence and exactly what was missing or failed
• Assign a grade to every finding — major or minor nonconformity, observation or improvement opportunity, on the scale your audit procedure defines
• Run the closing meeting — take auditees through each finding, settle disputed facts and agree a response date with every finding owner
• Send the report to the managers who own the audited areas — findings, a conclusion on conformity and effectiveness, and any limits on the sample (clause 9.2)
• Pass the results to the next management review — audit results and trends in nonconformities and corrective actions are required inputs (clause 9.3.2)
• Feed the results back into the programme — re-weight when this area is next audited and file the plan, evidence and report as programme records

Shown only when Phase 5 records a nonconformity. The re-test is assigned to the lead auditor, not to the control owner.

• React to each nonconformity — contain and correct it and deal with the consequences, such as removing access that should already have gone (clause 10.2)
• Find the root cause — for example a missing leaver trigger rather than one late account removal, then look for the same failure in other systems
• Agree the corrective action, owner and due date — and update the risk assessment or Statement of Applicability if the cause sits there
• Put the action in place — fix the procedure, configuration or tooling that let the failure happen, not only the instance the audit found
• Re-test once the fix has had time to operate — the lead auditor samples records created after the change
• Close the finding — keep a record of what the nonconformity was, what was done about it and whether it worked (clause 10.2)