ISMS Internal Audit Checklist Template (ISO/IEC 27001 clause 9.2)

Audit questions and evidence for clauses 4-10, Annex A audit trails and rotation, sample sizes, interview guide, finding grading (MAJ, MIN, OBS, OFI)

ISMS & ISO/IEC 27001FullISO/IEC 27001:2022 + Amd 1:2024 clause 9.2 (cited only); ISO 19011:2026; ISO/IEC 27007:2020internal audit checklistUpdated Nov 1, 2026

Open in editorDownload .md

How to use: Use it when you prepare and run an internal ISMS audit. Fill the scope, criteria and sampling plan first, then work the clause questions and Annex A trails. The main pitfall is reading policies instead of sampling records, which cannot show the ISMS is effective.

Preview

ISMS Internal Audit Checklist: [Organization name]

A working checklist for internal audits of an information security management system (ISMS) under ISO/IEC 27001:2022 + Amd 1:2024, clause 9.2 (internal audit). It gives audit questions and the evidence to sample for clauses 4 to 10, a sampling approach for the 93 Annex A controls by theme, an interview guide and a grading scheme for findings (major nonconformity, minor nonconformity, observation, opportunity for improvement). Method follows the guidance of ISO 19011:2026 and ISO/IEC 27007:2020. Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	DOC-ISMS-083
Version	[1.0]
Status	[Draft / In review / Approved / Superseded]
Owner	[@audit-programme-manager]
Approvers/reviewers	[@isms-manager], [@ciso or top management sponsor]
Last updated	YYYY-MM-DD
Classification	[Internal / Confidential when completed]
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024 clause 9.2; guidance ISO 19011:2026 and ISO/IEC 27007:2020
Next scheduled review	YYYY-MM-DD
Audit programme reference	DOC-ISMS-082, [programme period]
Audit reference (completed copy)	[IA-YYYY-NN]
Audit scope (completed copy)	[Clauses, Annex A themes, sites, processes]
Lead auditor (completed copy)	[@lead-auditor]

Approvals

Role	Name	Decision	Date
Audit programme manager	[@audit-programme-manager]	[Prepared]	YYYY-MM-DD
ISMS manager	[@isms-manager]	[Reviewed]	YYYY-MM-DD
Top management sponsor	[@ceo or delegate]	[Approved]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0 (Example)	2027-01-20	[@audit-programme-manager]	First approved master checklist for the 2027 programme
1.1 (Example)	2027-11-05	[@audit-programme-manager]	Added climate change question to 4.1 and 4.2 after Stage 2 feedback, adjusted sample sizes
[x.y]	YYYY-MM-DD	[@author]	[Change]

Purpose, scope and audit criteria
How to use the checklist
Auditor independence and conduct
Preparing the audit
Clause 4: Context of the organization
Clause 5: Leadership
Clause 6: Planning
Clause 7: Support
Clause 8: Operation
Clause 9: Performance evaluation
Clause 10: Improvement
Annex A sampling approach by theme
Sample sizes and selection
Interview guide
Grading findings
Closing meeting and handover
Summary of results
Size tiers
Records and evidence
References

1. Purpose, scope and audit criteria

This checklist supports one internal audit of the ISMS of [Organization name] as defined in the ISMS scope (DOC-ISMS-002). The audit determines whether the ISMS conforms to the organization's own requirements and to ISO/IEC 27001:2022 + Amd 1:2024, and whether it is effectively implemented and maintained.

Item	Value
Audit reference	[IA-YYYY-NN]
Audit objectives	[e.g. confirm conformity of clauses 4 to 10, test the operation of sampled Annex A controls, follow up findings from IA-YYYY-NN]
Clauses in scope	[4 to 10 / selected clauses]
Annex A themes in scope	[A.5 / A.6 / A.7 / A.8, with the control rotation set from section 12.2]
Sites, services and teams	[Head office, remote staff, cloud production, support team]
Record period sampled	YYYY-MM-DD to YYYY-MM-DD
Audit criteria	ISO/IEC 27001:2022 + Amd 1:2024; Statement of Applicability DOC-ISMS-011 version [x]; information security policy DOC-ISMS-001 and topic policies listed in DOC-ISMS-005; legal, regulatory and contractual requirements in DOC-ISMS-014
Method	[On site / Remote / Blended]
Planned dates	YYYY-MM-DD to YYYY-MM-DD

Annex A controls are audited against the Statement of Applicability and the organization's own policies and procedures. A control marked "Implemented" in the SoA that does not operate as described is a nonconformity against the organization's own requirements (which clause 9.2.1 makes part of every internal audit) and usually also against clause 8.1 or 8.3 (planned controls not operated, treatment plan not implemented).

2. How to use the checklist

Each row of sections 5 to 11 has five columns.

Column	What to write
ID	Fixed question ID (IAC-NNN). Keep IDs stable between audits so trends can be compared
Clause and question	The clause number and an audit question written in this template's words
Evidence to sample	Documents, records, systems and people that answer the question; what to look at, not only what to ask for
Result	C (conforms), MAJ (major nonconformity), MIN (minor nonconformity), OBS (observation), OFI (opportunity for improvement), N/S (not sampled in this audit)
Notes and evidence IDs	Record IDs, dates, sample identifiers, interviewee role (not name), screenshots referenced by file name

Work through the evidence, not the question. A "yes" from an interviewee is a lead; the confirmation is a record, a configuration or an observation. When evidence is not available during the audit, record what was requested and when, and grade it only after the agreed deadline.

3. Auditor independence and conduct

Confirm before the audit starts:

Check	Answer	Evidence
No auditor audits a process they operate, designed or manage	[Yes / No, mitigation]	Audit team table in the report
The person who manages the audit programme does not audit clause 9.2 alone	[Yes / No, mitigation]	[Second auditor or external reviewer named]
Each auditor has evidence of competence (training in ISO/IEC 27001 and audit technique, prior audits)	[Yes / No]	Competence matrix DOC-ISMS-026
Confidentiality of audit evidence agreed (where notes and screenshots are stored, who can read them)	[Yes / No]	Audit workspace location
Remote method agreed and tested when used (platform, screen sharing, no recording unless agreed)	[Yes / No / Not used]	Audit plan
Use of any AI-based tool to summarise evidence is agreed, outputs checked against source records	[Yes / No / Not used]	Audit plan

Conduct during the audit:

Ask open questions and ask to be shown, not told.
Record the role of each interviewee, not the name, in the completed checklist.
Do not suggest solutions during the audit; record an OFI when an improvement is worth noting.
Raise a potential nonconformity with the auditee when it is found, so facts can be confirmed before the closing meeting.
Stop and escalate to the ISMS manager if the audit uncovers an active security incident; incident handling comes first (DOC-ISMS-020).

4. Preparing the audit

4.1 Documents to request in advance

Document	ID	Received	Version and date
ISMS scope	DOC-ISMS-002	[Yes / No]	[vx, date]
Context and interested parties	DOC-ISMS-003	[Yes / No]	[vx, date]
Information security policy	DOC-ISMS-001	[Yes / No]	[vx, date]
Roles, responsibilities and RACI	DOC-ISMS-006	[Yes / No]	[vx, date]
Risk assessment methodology	DOC-ISMS-010	[Yes / No]	[vx, date]
Risk register and latest risk assessment report	DOC-ISMS-016, DOC-ISMS-017	[Yes / No]	[vx, date]
Risk treatment plan	DOC-ISMS-013	[Yes / No]	[vx, date]
Statement of Applicability	DOC-ISMS-011	[Yes / No]	[vx, date]
Objectives register	DOC-ISMS-024	[Yes / No]	[vx, date]
Documented information register	DOC-ISMS-028	[Yes / No]	[vx, date]
Measurement programme and latest performance report	DOC-ISMS-080, DOC-ISMS-081	[Yes / No]	[vx, date]
Previous internal audit report and findings register extract	DOC-ISMS-084, DOC-ISMS-086	[Yes / No]	[vx, date]
Latest management review minutes	DOC-ISMS-085	[Yes / No]	[vx, date]
Control evidence matrix	DOC-ISMS-033	[Yes / No]	[vx, date]

4.2 Desk review questions

Read the documents before the audit and note questions to test on site:

Does the scope match what the organization actually sells and runs?
Do the SoA decisions trace to risks in the register and to treatment items in the plan?
Which risks are High or Critical, and which controls treat them? Sample those controls first.
Which findings from the previous audit and from the certification body are still open or were closed without effectiveness verification?
What changed since the last audit (new services, suppliers, sites, systems, organisational changes, incidents)?

4.3 Sampling plan

Population	Size	Sample size	Selection method	Sample identifiers
Leavers in the record period (Example)	9	9 (all)	Whole population, small	HR leaver list rows 1 to 9
Changes to production (Example)	214	10	Random by change ID, plus 2 emergency changes chosen by judgement	CHG-0312, CHG-0388, [list]
Supplier records (Example)	31	5	Judgement: the 3 critical suppliers plus 2 random	SUP-004, SUP-011, [list]
[Population]	[n]	[n]	[Random / Judgement / Whole population]	[IDs]

5. Clause 4: Context of the organization

ID	Clause and question	Evidence to sample	Result	Notes and evidence IDs
IAC-001	4.1: Has the organization identified the internal and external issues that affect what the ISMS must achieve, and recorded whether climate change is a relevant issue?	DOC-ISMS-003 and its last review date; the climate change decision and its reasoning; two issues traced into the risk register	[ ]	[ ]
IAC-002	4.2: Are interested parties and their relevant requirements identified, with a decision on which are addressed through the ISMS (including any climate-related requirements)?	Interested parties table; legal register DOC-ISMS-014; one customer contract and one supplier contract checked against the register	[ ]	[ ]
IAC-003	4.3: Is the scope documented with its boundaries, interfaces and dependencies, and does it match reality?	DOC-ISMS-002; sample 3 systems from the asset inventory DOC-ISMS-012 and confirm they are in or out as the scope says; exclusions justified	[ ]	[ ]
IAC-004	4.4: Can the ISMS manager show how the ISMS processes fit together (for example a process map with owners), and is that picture kept current as processes change?	Process map DOC-ISMS-004; interview two process owners on inputs, outputs and handovers	[ ]	[ ]

6. Clause 5: Leadership

ID	Clause and question	Evidence to sample	Result	Notes and evidence IDs
IAC-005	5.1: Can top management give real examples from the record period of leading the ISMS: decisions that tie security to business plans, budget or people granted, managers backed when they enforced security, and improvements they pushed for?	Steering committee minutes DOC-ISMS-007 for the record period; budget approval DOC-ISMS-031; interview the CEO or delegate on objectives and recent security decisions	[ ]	[ ]
IAC-006	5.2: Is the top-level security policy approved, written for this organization rather than copied, used as the starting point for objectives, explicit about meeting obligations and improving over time, and known to staff and reachable by those who need it?	DOC-ISMS-001 approval record; publication location; communication record; ask 3 staff where to find it	[ ]	[ ]
IAC-007	5.3: Does everyone with a security role know it and what they may decide, and is it clear who tells top management how the ISMS is performing?	DOC-ISMS-006; two job descriptions or appointment letters; evidence of performance reporting to management	[ ]	[ ]

7. Clause 6: Planning

ID	Clause and question	Evidence to sample	Result	Notes and evidence IDs
IAC-008	6.1.1: Did ISMS planning start from the context and stakeholder analysis, and do the resulting actions on risks and opportunities sit inside normal processes, with a way to tell whether they worked?	Planning record or ISMS plan; link from DOC-ISMS-003 to the risk register; one opportunity with an owner and outcome	[ ]	[ ]
IAC-009	6.1.2: Is there a defined and applied risk assessment process, with written criteria for accepting risks and for running assessments, so that two assessments of the same situation would give the same answer; does each risk have an owner, a scored likelihood and impact, a resulting level and a priority?	DOC-ISMS-010 approval; DOC-ISMS-016; recompute the score of 5 sampled risks against the scale; confirm each has a named owner	[ ]	[ ]
IAC-010	6.1.3: Does risk treatment follow a written method: for each risk a chosen option, the controls it needs, a cross-check against Annex A so nothing is missed, an SoA that explains each decision, a plan the risk owners signed and their sign-off on what remains?	DOC-ISMS-013; DOC-ISMS-011; risk acceptance records DOC-ISMS-019; trace 5 risks to SoA rows and to treatment items; check acceptance authority against DOC-ISMS-015	[ ]	[ ]
IAC-011	6.2: Do objectives exist where they matter, trace back to the policy and the risk results, carry a measure where one makes sense, get tracked and shared, and come with a plan naming actions, resources, an owner, a date and how success will be judged?	DOC-ISMS-024; latest status of each objective; one objective traced to its measurement in DOC-ISMS-081	[ ]	[ ]
IAC-012	6.3: When the ISMS itself changed in the period, was the change thought through and scheduled in advance rather than discovered afterwards?	DOC-ISMS-025; one recent change to the ISMS (new site, new policy, reorganisation) and how it was planned. No documented information is required by this clause; ask for whatever shows the planning	[ ]	[ ]

8. Clause 7: Support

ID	Clause and question	Evidence to sample	Result	Notes and evidence IDs
IAC-013	7.1: Has the organization worked out what people, budget and tools the ISMS needs, and were they actually provided?	DOC-ISMS-031; staffing of the ISMS manager and security roles; any resourcing issue raised at management review and its outcome	[ ]	[ ]
IAC-014	7.2: For each role that affects security, is the needed skill level written down, are gaps closed by training, hiring or coaching, is it checked that this worked, and is there a record?	DOC-ISMS-026; sample 5 people in security roles and check the evidence of their competence and of training effectiveness	[ ]	[ ]
IAC-015	7.3: Do sampled staff know the policy exists, how their own work helps security and what the consequences are if they ignore the rules?	Interview 5 staff from different teams; awareness programme records; onboarding records for 3 recent joiners	[ ]	[ ]
IAC-016	7.4: Is there a communication plan for the ISMS that says what goes to whom, when and through which channel?	DOC-ISMS-027; two communications sent in the record period and their audience	[ ]	[ ]
IAC-017	7.5.1: Are all the records the standard calls for in place, plus the extra documents the organization chose to keep?	DOC-ISMS-028 checked against the list of required documented information; any gaps	[ ]	[ ]
IAC-018	7.5.2: Do new and revised documents carry an ID, owner and version, use a workable format and go through review and approval before release?	Sample 5 controlled documents: ID, version, owner, approval record (see `compliance/controlled-document`)	[ ]	[ ]
IAC-019	7.5.3: Can people find the current version when they need it, is it protected from loss and unauthorised change, are old versions withdrawn and records kept and destroyed on schedule, and are outside documents (contracts, vendor manuals) handled the same way?	Document repository permissions; superseded versions withdrawn; retention rules; one external document (contract or standard) under control	[ ]	[ ]

9. Clause 8: Operation

ID	Clause and question	Evidence to sample	Result	Notes and evidence IDs
IAC-020	8.1: Are ISMS processes run against set criteria, are planned changes managed, are unplanned changes looked at for side effects, and are outsourced activities that touch security kept under control?	Change records (sample from 4.3); supplier register DOC-ISMS-066; supplier assessments DOC-ISMS-067 for sampled suppliers; operating procedures DOC-ISMS-049	[ ]	[ ]
IAC-021	8.2: Were risk assessments run on schedule and again after significant changes, and are their results kept?	Dates of risk assessments in the period; DOC-ISMS-017; one significant change and evidence that its risks were assessed	[ ]	[ ]
IAC-022	8.3: Is the treatment plan moving forward as approved, with evidence of what has been done?	DOC-ISMS-013 status; 5 treatment items checked: due date, status, evidence of completion	[ ]	[ ]

10. Clause 9: Performance evaluation

ID	Clause and question	Evidence to sample	Result	Notes and evidence IDs
IAC-023	9.1: Is there a measurement plan saying what is measured, by whom, how often and when results are reviewed; are results kept; and does someone draw conclusions on how well the ISMS works?	DOC-ISMS-080; the last two DOC-ISMS-081 reports; evidence of analysis and decisions from the results	[ ]	[ ]
IAC-024	9.2.1: Were internal audits held when the programme said, and did they test both conformity (with our own rules and with ISO/IEC 27001) and whether the ISMS really works day to day?	Audit programme DOC-ISMS-082 versus audits performed; previous audit reports	[ ]	[ ]
IAC-025	9.2.2: Does the audit programme say how often, how and by whom audits are done and reported; does each audit have its criteria and scope; were auditors free of conflicts; did results reach management; and is the evidence kept?	DOC-ISMS-082; auditor independence for each audit; distribution of reports; DOC-ISMS-086	[ ]	[ ]
IAC-026	9.3.1: Did top management hold its ISMS review when scheduled?	Management review minutes DOC-ISMS-085; schedule in DOC-ISMS-032	[ ]	[ ]
IAC-027	9.3.2: Did the review cover the expected agenda: open actions from last time, what changed inside and outside, performance figures and trends, feedback from stakeholders, the state of risks and treatment, and ideas for improvement?	Agenda and minutes compared with the input list; supporting reports	[ ]	[ ]
IAC-028	9.3.3: Are the decisions from the review (improvements, changes to the ISMS) written down?	Decisions and actions in the minutes; status of actions in the action log	[ ]	[ ]

11. Clause 10: Improvement

ID	Clause and question	Evidence to sample	Result	Notes and evidence IDs
IAC-029	10.1: Is there evidence that the ISMS is getting better over time: improvements delivered, and trends in findings and incidents moving the right way?	DOC-ISMS-088; two improvements implemented in the period and their benefit; trend in findings and incidents	[ ]	[ ]
IAC-030	10.2: When something went wrong, was it contained and fixed, was the root cause found, were similar cases elsewhere checked, did the fix prevent a repeat, and is all of this recorded?	DOC-ISMS-086; 3 corrective action records DOC-ISMS-087 including at least one from an incident (DOC-ISMS-021, DOC-ISMS-022); effectiveness verification evidence	[ ]	[ ]

12. Annex A sampling approach by theme

12.1 Audit trails by theme

Each trail follows one piece of work through several controls. Control labels are this library's short descriptions, as in compliance/statement-of-applicability, not the official titles.

Trail	Theme	Controls covered	What to sample	Typical evidence
TR-01 Governance	A.5	A.5.1 policies, A.5.2 roles, A.5.3 segregation of duties, A.5.4 management responsibilities	Policy approvals and reviews, one role conflict check	Policy index DOC-ISMS-005, RACI DOC-ISMS-006
TR-02 Information lifecycle	A.5, A.8	A.5.9 inventory, A.5.12 classification, A.5.13 labelling, A.5.14 transfer, A.8.10 deletion	5 assets from the inventory: owner, classification, handling in practice	DOC-ISMS-012, DOC-ISMS-042, deletion records
TR-03 Joiner, mover, leaver	A.5, A.6, A.8	A.5.16 identity lifecycle, A.5.18 access rights, A.6.1 screening, A.6.2 terms of employment, A.6.5 duties after leaving, A.5.11 return of assets, A.8.2 privileged access	Joiners and leavers from the sampling plan, from HR record to account change and asset return	HR records, identity provider logs, DOC-ISMS-053 checklists
TR-04 Supplier and cloud	A.5	A.5.19 to A.5.22 supplier controls, A.5.23 cloud services	Critical suppliers: assessment, contract clauses, monitoring	DOC-ISMS-066, DOC-ISMS-067, DOC-ISMS-068
TR-05 Incident	A.5, A.6	A.5.24 to A.5.28 incident controls, A.6.8 event reporting	Two incidents and one minor event, from report to lessons learned	DOC-ISMS-021, DOC-ISMS-022
TR-06 Continuity	A.5, A.8	A.5.29 security during disruption, A.5.30 ICT readiness, A.8.13 backup, A.8.14 redundancy	Last restore test and last continuity exercise	DOC-ISMS-047, DOC-ISMS-071
TR-07 Compliance	A.5	A.5.31 legal requirements, A.5.34 privacy, A.5.35 independent review, A.5.36 compliance checks	Legal register entries, one privacy record, last independent review	DOC-ISMS-014, DOC-ISMS-048
TR-08 People	A.6	A.6.3 awareness and training, A.6.4 disciplinary process, A.6.6 confidentiality, A.6.7 remote working	Training records, signed confidentiality agreements, remote working rules in practice	DOC-ISMS-026, DOC-ISMS-051, DOC-ISMS-054
TR-09 Physical walk-through	A.7	A.7.1 to A.7.14 physical controls applicable to the sites in scope	Walk the office, server or network rooms, storage and disposal points; observe	Visitor log, badge records, DOC-ISMS-055, DOC-ISMS-057
TR-10 Endpoint and configuration	A.8	A.8.1 endpoints, A.8.7 malware, A.8.9 configuration, A.8.19 software installation	5 devices from the device inventory: compliance state, baseline, protection	MDM report, DOC-ISMS-058, DOC-ISMS-060
TR-11 Vulnerability and change	A.8	A.8.8 vulnerabilities, A.8.32 change management, A.8.31 environment separation	Changes from the sampling plan; 5 critical vulnerabilities and their remediation dates	DOC-ISMS-072, change records
TR-12 Logging and monitoring	A.8	A.8.15 logging, A.8.16 monitoring, A.8.17 clock synchronization	Alert-to-ticket trace for 3 alerts; log retention check	DOC-ISMS-064, SIEM or log platform
TR-13 Network and cryptography	A.8	A.8.20 to A.8.23 network controls, A.8.24 cryptography	Firewall rule review record, TLS and encryption settings, key register	DOC-ISMS-063, DOC-ISMS-070
TR-14 Development	A.8	A.8.25 to A.8.29 secure development, A.8.4 source code access, A.8.33 test information	3 releases: requirements, review, testing, approval	DOC-ISMS-065, pull request records
TR-15 Data protection technology	A.8	A.8.11 masking, A.8.12 leakage prevention, A.8.3 access restriction, A.8.5 authentication	DLP alerts, masked test data, MFA coverage report	DOC-ISMS-062, identity provider report

Controls that no trail covers in a given audit go into the rotation in section 12.2.

12.2 Rotation across the certification cycle

Cover every applicable control at least once in the three-year certification cycle, and re-sample the controls that treat High and Critical risks in every audit year. This is good practice and what certification bodies expect to see; the standard asks only that the programme takes into account the importance of the processes and the results of previous audits.

Before the initial certification audit, the rotation alone may not be enough. Certification bodies usually expect one full internal audit of the ISMS and one management review before Stage 2 (CB practice, not a clause); the full internal audit covers all of clauses 4 to 10 and a sample from every Annex A theme in the SoA, including A.7 where physical controls apply. Confirm the expected coverage with your certification body and, if needed, add a short readiness check of the themes the first-year rotation does not reach.

Year	Applicable controls covered (Example: Quillmere Analytics Ltd, 88 applicable of 93, 5 excluded)	Re-sampled every year
2027	30 (trails TR-01, TR-03, TR-04, TR-05, TR-10, TR-11 plus rotation)	A.5.15 to A.5.18, A.8.8, A.8.13, A.8.24
2028	29 (trails TR-02, TR-06, TR-08, TR-12, TR-13 plus rotation)	Same set, updated after the risk assessment
2029	29 (trails TR-07, TR-09, TR-14, TR-15 plus rotation)	Same set, updated after the risk assessment
Total	88

12.3 Per-control test record

Use one row per sampled control.

Control	SoA status	Test performed	Sample	Result	Evidence IDs
A.5.18 (Example)	Implemented	Leaver access removed within 1 business day, as the access control policy requires	9 of 9 leavers	MIN: 2 of 9 removed after 4 and 6 days	HR leaver list, identity provider audit log export
A.8.13 (Example)	Implemented	Restore test performed quarterly and results reviewed	4 of 4 quarters	C	DOC-ISMS-071 rows 2027-Q1 to Q4
[A.N.N]	[status]	[test]	[n of N]	[result]	[IDs]

13. Sample sizes and selection

Choose the method and write it in the sampling plan (section 4.3):

Whole population when it is small (for example under 10 items) or when every item is high risk.
Judgement-based when the auditor targets the items most likely to reveal problems: emergency changes, privileged accounts, critical suppliers, items from the period just after a reorganisation.
Random when the population is large and uniform; use a recorded random method (random number generator with the seed or list noted).
Data analytics when the full population is available as data, for example comparing the whole HR leaver list with the identity provider export.

The sizes below are an Example internal rule for judgement-based sampling. They are not taken from any standard; adjust them to your risk and record the rule in the audit programme.

Population size (Example rule)	Sample size	Increase when
1 to 9	All items
10 to 50	3 to 5	The control treats a High or Critical risk, or the last audit found a problem
51 to 250	5 to 10	As above, or a change in process during the period
Over 250	10 to 25, or full population by data analytics	As above

If the first sample shows an exception, extend the sample before grading to learn whether it is isolated or systemic, and record both counts.

14. Interview guide

Role	Purpose	Example questions
Top management (CEO or delegate)	5.1, 5.3, 6.2, 9.3	What are this year's security objectives and how do you know they are on track? What was the last security decision you made, and on what information? How did you decide the ISMS budget?
ISMS manager	4.4, 6.1, 7.5, 9.1, 10	Walk me through how a new risk gets into the register. Show me the last measurement report and what changed because of it. Which findings are overdue, and why?
Risk owner	6.1.2, 6.1.3, 8.3	Which risks do you own? Show me where you accepted a residual risk. What is the status of the treatment items for your risks?
Control owner (for each sampled control)	Annex A, 8.1	Show me how this control works today. What records does it produce? What happens when it fails?
HR	A.6.1, A.6.2, A.6.4, A.6.5	Show me the screening record for this joiner. How does IT learn that someone has left?
IT or cloud operations	A.8 trails	Show me the alert for this event and the ticket that followed. Show me the baseline for this server and how drift is detected.
Supplier or procurement owner	A.5.19 to A.5.23	How is a new supplier assessed? Show me the security clauses in this contract and the last review of this supplier.
Staff member (sample across teams)	7.3, A.6.3, A.6.8	Where is the security policy? What would you do if you clicked a suspicious link? How do you share a confidential file with a customer?

Technique: start with what the person does, then ask for the record. Use silence and follow-up questions instead of leading questions. Note the answer, then confirm it with evidence before grading.

15. Grading findings

Grade	Code	Use when (this library's working definitions)	Required response
Major nonconformity	MAJ	Something the ISMS depends on is missing or no longer works, so the auditor could not rely on the ISMS to deliver what it is for; a cluster of minor findings on the same requirement that point to a pattern also counts	Correction and corrective action record DOC-ISMS-087, root cause, plan approved by the ISMS manager, effectiveness verified by the auditor
Minor nonconformity	MIN	A requirement is not met in an isolated case that does not, on its own, undermine the ISMS	Corrective action record DOC-ISMS-087 with root cause and effectiveness check
Observation	OBS	The requirement is met at present, but the evidence shows a weakness that could lead to a nonconformity if left alone	Owner decides on action; reviewed at the next audit
Opportunity for improvement	OFI	The requirement is met; the auditor sees a way to make the ISMS more effective or efficient	Logged in DOC-ISMS-088 for evaluation

Write each nonconformity in three parts: the requirement (clause, control or policy section), the evidence (what was seen, with IDs) and the statement of nonconformity (what is missing). Add the extent: "2 of 9 sampled leavers" tells the reader more than "some leavers".

16. Closing meeting and handover

At the closing meeting:

Thank the auditees and restate the scope, criteria and sampling.
Present each finding with its grade and evidence; confirm the facts.
Present positive practices observed.
State any limits on the audit (evidence not available, systems not accessible, time lost).
Agree dates: report issue, corrective action plans, follow-up verification.
Record attendance by role.

Item	Agreed value
Closing meeting date	YYYY-MM-DD
Attendees (roles)	[ISMS manager, process owners, top management delegate]
Report due	YYYY-MM-DD (Example: 10 working days after closing)
Corrective action plans due	YYYY-MM-DD (Example: 30 days after report)
Follow-up verification	[Next audit / dedicated follow-up on YYYY-MM-DD]

17. Summary of results

Clause	Questions	C	MAJ	MIN	OBS	OFI	N/S
4 Context	4	[n]	[n]	[n]	[n]	[n]	[n]
5 Leadership	3	[n]	[n]	[n]	[n]	[n]	[n]
6 Planning	5	[n]	[n]	[n]	[n]	[n]	[n]
7 Support	7	[n]	[n]	[n]	[n]	[n]	[n]
8 Operation	3	[n]	[n]	[n]	[n]	[n]	[n]
9 Performance evaluation	6	[n]	[n]	[n]	[n]	[n]	[n]
10 Improvement	2	[n]	[n]	[n]	[n]	[n]	[n]
Total	30	[n]	[n]	[n]	[n]	[n]	[n]
Annex A controls sampled	[n]	[n]	[n]	[n]	[n]	[n]

A question can carry an OFI as well as a C, so record OFIs separately when you check the totals.

18. Size tiers

Aspect	Small: Quillmere Analytics Ltd (46 staff)	Medium: Quillmere Health Systems (320 staff)	Large or multi-site: Quillmere Group (2,400 staff, 6 sites)
Who audits	One external contract auditor, or a trained staff member from finance paired with them; the 0.5 FTE ISMS manager cannot audit their own work	Pool of 3 trained internal auditors from other departments, lead auditor from quality or internal audit	Group audit team in the security office plus site auditors from other sites; integrated with ISO 9001 and ISO 22301 audits
Audit pattern	One full audit per year covering clauses 4 to 10 and the year's Annex A rotation (Example: 3 auditor days)	Four audits per year by process area (governance and risk, people and suppliers, technology, performance and improvement)	Central clauses audited yearly at HQ; each site audited at least once in the cycle, sites with OT and higher risk every year
Sample sizes	Whole population common for small populations (9 leavers); rule in section 13 for larger ones (5 of 31 suppliers)	Rule in section 13	Rule in section 13 plus data analytics across sites
Interviews	Most staff are reachable; interview 5 across teams	10 to 15 across both offices and the colocation operations team	Per site, plus group functions; local language interviews where needed
Annex A focus	Cloud, endpoints, access, suppliers; A.7 limited to one office	Adds colocation (A.7), health customer contract requirements, privacy controls	Adds OT network controls, multi-country legal requirements, site physical security
Reporting	One report to the CEO and steering committee	Report per audit, summary to management review	Site reports, group consolidated report, CISO to group management review

19. Records and evidence

Record	Proves	Owner	Location	Retention (Example)
Completed checklist (this file, per audit)	Audit was performed against defined criteria with sampled evidence	Lead auditor	ISMS audit folder, read-only after report issue	Current certification cycle plus 3 years
Sampling plan and sample lists	Samples were selected by a stated method	Lead auditor	Same folder	Same
Evidence files (exports, screenshots) referenced by ID	Findings can be re-checked	Lead auditor	Same folder, access restricted	Same
Opening and closing meeting attendance	Auditees were informed and facts confirmed	Lead auditor	Same folder	Same
Auditor independence and competence check (section 3)	Objectivity and impartiality	Audit programme manager	DOC-ISMS-026 and audit folder	Same
Internal audit report	Results reported to relevant management	Audit programme manager	DOC-ISMS-084	Same
Findings register entries	Findings tracked to closure	ISMS manager	DOC-ISMS-086	Same

20. References

Reference	Edition and status (as of November 2026)	Use
ISO/IEC 27001:2022 + Amd 1:2024	Current; Amd 1 published 2024-02-23	Clauses 4 to 10, Annex A, clause 9.2
ISO/IEC 27002:2022	Current	Control guidance used to design control tests
ISO 19011:2026	Current, published 2026-05-27	Audit programme, conducting audits, auditor competence, sampling and remote methods
ISO/IEC 27007:2020	Current; a revision is in progress, check for a newer edition. Written against ISO 19011:2018	ISMS-specific audit guidance
ISO/IEC TS 27008:2019	Current; under revision	Assessing information security controls
ISO/IEC 17021-1:2015	Current	Major and minor nonconformity concepts in certification audits
`compliance/internal-audit-program`	DOC-ISMS-082	Programme this checklist serves
`isms/isms-internal-audit-report`	DOC-ISMS-084	Report format
`isms/audit-findings-register`	DOC-ISMS-086	Findings tracking
`compliance/capa-nonconformity`	DOC-ISMS-087	Corrective action records
`isms/continual-improvement-register`	DOC-ISMS-088	Opportunities for improvement
`compliance/statement-of-applicability`	DOC-ISMS-011	Control labels and applicability
`isms/control-evidence-matrix`	DOC-ISMS-033	Where control evidence lives

Official text (purchase or licensed access): ISO/IEC 27001 https://www.iso.org/standard/82875.html and Amd 1 https://www.iso.org/standard/88435.html; ISO/IEC 27002 https://www.iso.org/standard/75652.html; ISO 19011 https://www.iso.org/standard/88984.html; ISO/IEC 27007 https://www.iso.org/standard/77802.html; ISO/IEC TS 27008 https://www.iso.org/standard/67397.html; ISO/IEC 17021-1 https://www.iso.org/standard/61651.html.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (clauses 4 to 10, clause 9.2 and Annex A), with audit method following ISO 19011:2026 and ISO/IEC 27007:2020. The audit questions, trails, sampling rule, grading definitions and examples are original wording written for this template; they are not the text of the clauses, controls or guidance, and no ISO or IEC text, tables or definitions are reproduced. Audit against the official standard, which is copyrighted and sold by ISO, IEC and national standards bodies. Check the current editions before use: ISO/IEC 27007 and ISO/IEC TS 27008 are under revision. This template does not promise certification; certification decisions belong to the accredited certification body. Template licence: MIT.

Related templates

ISMS & ISO/IEC 27001