Practical guide / United Kingdom
ISO 27001 internal audit checklist: Clauses 4 to 10 and Annex A, with evidence to sample
Every mandatory clause with the audit question, the evidence to sample and the finding UK certification auditors raise most often; sample tests for the four Annex A themes; a worked record; and the plan and checklist template as a spreadsheet.
Researched 18 October 2026, expanded 26 October 2026. Examples are original fictional learning aids, not client results or legal advice. Clause and control references follow ISO/IEC 27001:2022; buy the standard for the normative text.
How to use this checklist
This checklist lists what an ISO/IEC 27001:2022 internal audit has to look at: every mandatory clause from 4 to 10, with the audit question, the evidence to sample and the finding that most often appears, followed by sample tests for the four Annex A themes. It is a planning aid for Clause 9.2. It is not the audit. The audit is the sample you justify, the evidence you examine, the interviews you hold and the finding you write with the criterion and the evidence beside it. A checklist with ticks and no evidence references will not satisfy a UK certification body, and it should not satisfy you.
Use the clause table to build the audit plan and the evidence request list, use the Annex A table to choose the controls for this cycle from your Statement of Applicability, and use the worked record at the end to see what a completed line looks like. The plan and checklist template below is the same structure as a spreadsheet. The seven-step how-to guide explains the method around it, and the ISO 27001 internal audit service page is the outsourced version if your impartiality test cannot be met in-house.
Clauses 4 to 10: the mandatory requirements
Every line is in scope every time, because the management-system clauses cannot be excluded. The typical finding column comes from what UK certification auditors raise most often; use it to decide where to spend the sampling time.
| Clause | Audit question | Evidence to sample | Typical finding |
|---|---|---|---|
| 4.1 Context | Have internal and external issues relevant to the ISMS been determined and kept current? | Context register or analysis; management-review inputs; evidence of review after change. | Context written once at implementation and never revisited. |
| 4.2 Interested parties | Are interested parties, their requirements and which ones the ISMS addresses recorded? | Interested-party register; contracts and legal obligations list; customer security requirements. | Regulators and key customers listed with no requirements against them. |
| 4.3 Scope | Does the documented scope describe the services, locations, systems and interfaces, with exclusions justified? | Scope statement; service map; supplier interfaces; certificate scope wording. | Scope statement that does not match what customers are told or what the certificate says. |
| 4.4 ISMS | Are the processes needed for the ISMS and their interactions established and maintained? | Process map or ISMS manual; ownership assignments. | Documents exist; the processes that connect them do not. |
| 5.1 Leadership | Does top management demonstrate commitment: resources, integration, direction, review? | Management-review records; budget decisions; policy approval; objectives sign-off. | Commitment asserted in the policy, absent from any decision record. |
| 5.2 Policy | Is the information security policy approved, communicated and available to interested parties as appropriate? | Approved policy with version and date; communication evidence; availability to staff and, where relevant, customers. | Policy approved by the ISMS manager rather than top management; staff unaware of it. |
| 5.3 Roles | Are responsibilities and authorities for the ISMS assigned and communicated, including reporting on performance? | RACI or role descriptions; appointment records; performance reporting to management. | Roles named in a document but not communicated to the people holding them. |
| 6.1.1 Risk and opportunity | Are actions to address risks and opportunities to the ISMS itself planned and evaluated? | ISMS-level risk and opportunity record; evidence actions were taken and evaluated. | Confused with the information security risk assessment and left blank. |
| 6.1.2 Risk assessment | Is there a defined, repeatable risk assessment process with criteria, owners, analysis and evaluation? | Risk methodology; risk register with owners, likelihood, consequence and evaluation against criteria; evidence of repetition. | Scores with no criteria; risks without owners; no re-assessment after change. |
| 6.1.3 Risk treatment | Do treatment options, selected controls, the SoA and the treatment plan line up, with risk-owner approval and residual-risk acceptance? | Risk treatment plan; SoA with justifications for inclusion and exclusion; owner approvals. | SoA marks controls applicable with no link to any risk; residual risk never formally accepted. |
| 6.2 Objectives | Are measurable information security objectives set, resourced, monitored and updated? | Objectives with measures, owners and dates; monitoring results; management-review discussion. | Objectives are activities (“complete training”) rather than measurable outcomes. |
| 6.3 Planning of changes | Are changes to the ISMS carried out in a planned manner? | Change records for ISMS changes; impact assessment; approvals. | Scope or process changes made without any record of planning. |
| 7.1 Resources | Are the resources needed for the ISMS determined and provided? | Resource decisions; staffing; tooling; budget. | One person doing everything, with no record that management decided that was enough. |
| 7.2 Competence | Is competence determined, achieved and evidenced for people doing ISMS work, including auditors? | Competence matrix; training records; certificates; evaluation of effectiveness. | Training delivered, competence never evaluated; auditor competence not recorded. |
| 7.3 Awareness | Are people aware of the policy, their contribution and the implications of not conforming? | Awareness programme; completion records; sampled interviews. | Annual e-learning with no evidence anyone absorbed it; contractors excluded. |
| 7.4 Communication | Are internal and external communications on information security determined: what, when, with whom, how? | Communication plan or matrix; examples of communications issued. | No defined process for communicating incidents to customers or regulators. |
| 7.5 Documented information | Is documented information controlled: identification, format, review, approval, availability, protection, retention? | Document register; version control; access controls on the repository; retention rules. | Superseded versions in circulation; documents without owners or review dates. |
| 8.1 Operational planning | Are the processes needed to meet requirements and implement risk treatment planned, controlled and documented, including outsourced processes? | Operating procedures; control records; supplier controls for outsourced processes; change control. | Outsourced processes outside the ISMS with no controls on the supplier. |
| 8.2 Risk assessment in operation | Is the risk assessment performed at planned intervals and when significant change occurs, with results retained? | Risk-review schedule; dated re-assessments; triggers after incidents or changes. | Risk register last updated at certification. |
| 8.3 Risk treatment in operation | Is the risk treatment plan implemented, with results retained? | Treatment plan status; evidence controls were implemented; closure of planned actions. | Treatment plan actions overdue with no decision to accept the risk. |
| 9.1 Monitoring and measurement | Is it defined what is monitored and measured, how, when, by whom, and are results analysed and retained? | Measurement plan; KPIs with results; analysis presented to management. | Metrics collected but never analysed or acted on. |
| 9.2 Internal audit | Is there an audit programme with planned intervals, defined criteria and scope per audit, objective and impartial auditors, reporting to management and retained results? | Audit programme; audit plans; reports; competence and impartiality records; trail into corrective action. | ISMS manager auditing their own work; audit of documents only; report never tabled at management review. |
| 9.3 Management review | Does top management review the ISMS at planned intervals against the required inputs and record decisions and actions? | Review minutes covering every required input; decisions with owners; follow-up on previous actions. | A status meeting recorded as a management review, missing inputs such as interested-party changes or audit results. |
| 10.1 Continual improvement | Is the suitability, adequacy and effectiveness of the ISMS continually improved? | Improvement log; changes traced to audit, review, incidents or metrics. | No evidence the ISMS has changed since certification. |
| 10.2 Nonconformity and corrective action | Are nonconformities reacted to, causes evaluated, actions taken, effectiveness reviewed and records retained? | Nonconformity register; root-cause analysis; corrective-action records; effectiveness checks. | Corrections recorded as corrective actions; effectiveness never reviewed; recurrence. |
Annex A: sample tests by theme
The 2022 edition groups 93 controls into four themes. Only the controls your SoA marks applicable are criteria, and most organisations audit a risk-based subset each cycle so that every applicable control is covered within the three-year certification cycle. The tests below are the ones that most often find something; each names the control reference so you can map it to your SoA.
Organisational (5.1 to 5.37)
- 5.9 Inventory of information and other associated assets: sample assets from the inventory and from a system scan; test that owners are assigned and the two lists reconcile.
- 5.15 to 5.18 Access control, identity, authentication, access rights: sample joiners, movers and leavers against approvals and the identity console; test the last access review and what it changed.
- 5.19 to 5.23 Supplier relationships and cloud services: sample suppliers from the register against contracts, security requirements, and the last review; include the cloud providers.
- 5.24 to 5.28 Incident management: sample incidents from the log against the procedure; test classification, response times, evidence handling and lessons learned.
- 5.29 to 5.30 Continuity and ICT readiness: test the last continuity exercise and what was changed afterwards.
People (6.1 to 6.8)
- 6.1 Screening: sample recent joiners against the screening procedure, including contractors.
- 6.2 and 6.6 Terms and conditions, confidentiality agreements: sample signed agreements for staff and contractors with access to confidential information.
- 6.3 Awareness, education and training: sample completion records and interview people on what they know of the policy and incident reporting.
- 6.5 Responsibilities after termination: sample leavers for the return of assets and continuing obligations; link to 5.18 access removal.
- 6.7 Remote working: test the remote-working rules against device configuration and sampled home-working arrangements.
Physical (7.1 to 7.14)
- 7.1 to 7.3 Perimeters, entry controls, securing offices: observe entry controls, sample visitor records, and test who holds keys or access cards.
- 7.7 Clear desk and clear screen: observe during a walk-through; test screen-lock configuration on sampled devices.
- 7.9 and 7.10 Security of assets off premises and storage media: sample laptop encryption and the media register; test disposal records.
- 7.14 Secure disposal or re-use of equipment: sample disposals against certificates of destruction or wipe records.
Technological (8.1 to 8.34)
- 8.1 and 8.5 User endpoint devices and secure authentication: sample devices for configuration baseline, encryption and MFA enforcement in the identity provider.
- 8.7 and 8.8 Malware protection and technical vulnerability management: sample vulnerability scan results, patch timelines against the policy, and exceptions.
- 8.9 Configuration management: sample production configurations against the documented baseline; test change control for a sample of changes.
- 8.13 and 8.14 Backup and redundancy: sample backup jobs and the last restore test; check retention matches the policy.
- 8.15 and 8.16 Logging and monitoring: test that the logs the policy promises exist, are protected and are reviewed; sample alerts and the response.
- 8.24 Cryptography and 8.32 Change management: test key management records and a sample of changes through approval, testing and release.
- 8.25 to 8.29 Secure development: sample releases for code review, security testing and separation of environments.
Four rules that keep the checklist honest
- Agree the audit before collecting records. Document the objectives, scope, criteria, reporting arrangements and access restrictions. Check auditor competence and impartiality, including any implementation work performed by the proposed auditor. Agree how confidential evidence will be handled and retained.
- Select evidence that can answer the question. Sampling is a reasoned choice, not a universal fixed percentage. Reconcile the population before drawing a sample where completeness matters, and explain what the sample does not cover. Distinguish what someone describes from records demonstrating what happened.
- Connect a finding to a requirement. A useful finding separates the criterion, the sampled evidence, the observed condition and the conclusion. Missing evidence may call for further investigation; it does not automatically prove every activity failed. Avoid turning a personal preference into a nonconformity.
- Follow up the cause and the effect. The process owner investigates the cause, agrees correction and corrective action, and records responsibility and timing. Follow-up evaluates implementation and effectiveness, not simply whether a new policy was uploaded. Internal audit does not issue an organisation’s certificate.
A completed line: the worked record
This is what five lines of the checklist look like once the audit has been done, taken from an original fictional working record for a small hosted-service company. Each line has an evidence reference and a follow-up, which is the difference between a checklist and an audit.
| Audit question | Possible evidence | Follow-up if evidence is incomplete |
|---|---|---|
| Does the scope describe the service being sold? | Service map, ISMS boundary, supplier interfaces and customer requirement. | Resolve contradictory boundaries and document relevant dependencies. |
| Do selected controls address the treatment decisions? | Risk decisions, SoA, owners and operating records. | Trace the gap from decision to implementation; do not rely on a policy title. |
| Are access changes carried out as agreed? | Approved access rules, a complete leaver population and sampled removal records. | Investigate exceptions and test whether the population omitted contractors. |
| Do management reviews support decisions? | Review inputs, recorded decisions, assigned actions and follow-up. | Identify decisions not made, owners not assigned or actions not evidenced. |
| Have corrective actions worked? | Cause analysis, action records and subsequent operating evidence. | Check recurrence and whether the action addresses the identified cause. |
Starter example only. Adapt it to the agreed scope and use the applicable standards and qualified judgement.
What a checklist cannot do
It cannot establish impartiality: that is a decision about who audits, recorded before fieldwork. It cannot decide a sufficient sample: that depends on the population, the risk and the previous results. It cannot evaluate evidence: a leaver account that remains active needs comparison with the agreed access-removal requirement and a review of the whole sample, and one exception does not prove every account failed any more than a missing record proves the task was never done. And it cannot write the report, which is where the information Clause 9.2 exists to provide actually appears.
Downloads
ISO 27001 internal audit plan and checklist template (CSV)
Opens in Excel or Google Sheets · Clauses 4 to 10 and ten Annex A controls · criterion, population, method and findings columns
Download the plan and checklist templateWorked internal audit record (CSV)
The five completed lines above, as a spreadsheet to extend
Download the worked recordStarter files only. The agreed scope, criteria and sample decide the final plan.
Questions readers ask.
Is there an official ISO 27001 internal audit checklist?
No. ISO publishes the standard, not a checklist, and ISO 19011 gives auditing guidance rather than a list. Every checklist, including this one, is an interpretation; the criteria that count at a certification audit are the clauses of ISO/IEC 27001:2022 and your own Statement of Applicability and policies.
Does the checklist cover ISO 27001:2022 or 2013?
The 2022 edition. The clause numbers follow the 2022 structure, including 6.3 Planning of changes and the split of 9.2 into 9.2.1 and 9.2.2, and the Annex A references use the four 2022 themes and 93 controls. The transition deadline from the 2013 edition passed on 31 October 2025, so an audit against the 2013 Annex A domains is no longer valid for certification.
Do we have to audit every Annex A control every year?
No. Clause 9.2.2 requires planned intervals that consider process importance and previous results. All of Clauses 4 to 10 should be audited each year; applicable Annex A controls can be sampled on a risk basis as long as every applicable control is covered within the three-year certification cycle and the coverage decision is recorded in the audit programme.
Can I download the checklist as a spreadsheet?
Yes. The plan and checklist template is a CSV with Clauses 4 to 10 and ten Annex A controls, each with criterion, population to sample, method and a findings column, which opens in Excel or Google Sheets. The worked record is a second CSV with five completed lines.
What evidence should we have ready before the internal audit?
The scope statement, the risk assessment and treatment plan, the Statement of Applicability, the policies and procedures, the objectives and their measurements, the audit programme and previous audit reports, management-review minutes, the nonconformity and corrective-action register, and exportable populations for the operational controls in scope: joiners and leavers, changes, incidents, access reviews, supplier reviews and backups.
How is a checklist different from the audit itself?
The checklist says what to look at. The audit is the justified sample you draw, the evidence you examine against each criterion, the interviews you hold, the findings you write with criterion and evidence beside them, and the report you table at management review. Clause 9.2 is met by the second set of things, not the first.
Who should complete the checklist?
An auditor who is competent in ISO 27001 and auditing and who did not design or operate the controls being audited. If the only available person built the ISMS, the impartiality requirement in Clause 9.2.2 is not met and the audit should be assigned elsewhere or outsourced.
Can the same checklist be used for ISO 9001 or ISO 45001 internal audits?
Only the management-system structure carries across: Clauses 4 to 10 share the harmonised structure, so the audit questions on context, leadership, planning, support, performance evaluation and improvement have close equivalents. The operational clauses and the control content are specific to each standard, so each needs its own criteria and sample tests.