Information security management system audit program under ISO/IEC 27001.
How to audit whether the information security management system meets the requirements of clauses 4 to 10 and works in daily practice, not only on paper.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation has established an information security management system that links context, scope, leadership, risk assessment and treatment, support, operation, evaluation and improvement coherently. It also assesses whether internal audit and management review lead to decisions and corrective actions.
Scope
- Information security management system within the defined scope
- Processes of clauses 4 to 10 of ISO/IEC 27001:2022, including the statement of applicability
- Roles of top management, the information security officer and process owners
- Out of scope: in-depth testing of individual Annex A controls, which have their own audit programs
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | Internal and external issues and the requirements of interested parties are determined and kept current. | ISO/IEC 27001:2022 clauses 4.1 and 4.2 | Read the context analysis and list of interested parties and check that legal and contractual requirements are included. | Context analysis, list of interested parties and their requirements |
| 2 | The scope is documented, justified and takes interfaces and dependencies into account. | ISO/IEC 27001:2022 clause 4.3 | Reconcile the scope with the organisation chart, sites and outsourced services. | Scope document, site list, interface description |
| 3 | Top management demonstrates leadership, has approved an information security policy and ensures it is communicated. | ISO/IEC 27001:2022 clauses 5.1 and 5.2; BSI standard 200-1 | Read the policy, check approval and ask management in interview about its involvement in the management system. | Information security policy, communication record, interview notes |
| 4 | Roles, responsibilities and authorities in the management system are assigned and communicated. | ISO/IEC 27001:2022 clause 5.3 | Review the appointment of the information security officer and role descriptions and trace the reporting line to management. | Letter of appointment, role descriptions, reporting line |
| 5 | A defined risk assessment process produces repeatable results and is applied at planned intervals and after changes. | ISO/IEC 27001:2022 clauses 6.1 and 8.2; BSI standard 200-3 | Read the method description and check the last risk assessment for rating and justification of three risks. | Risk assessment method, risk register, date of last assessment |
| 6 | A risk treatment plan and a statement of applicability exist; residual risks are accepted by the risk owners. | ISO/IEC 27001:2022 clauses 6.1.3 and 8.3 | Check the statement of applicability for justified exclusions and trace risk acceptance for three residual risks. | Statement of applicability, risk treatment plan, acceptance records |
| 7 | Measurable security objectives are set and planned with owners, resources and deadlines. | ISO/IEC 27001:2022 clause 6.2 | Review the objectives overview and check measurement, owners and achievement for three objectives. | Objectives overview, status reports on objectives |
| 8 | Resources are provided; people with security tasks are competent, and staff know their contribution. | ISO/IEC 27001:2022 clauses 7.1, 7.2 and 7.3 | Review competence evidence for two key roles and ask five employees about their knowledge of the policy. | Qualification records, training plan, interview notes |
| 9 | Documented information is controlled: approval, versioning, distribution and retention are governed. | ISO/IEC 27001:2022 clause 7.5 | Check version, approval and storage location for five documents of the management system. | Document control rule, document register |
| 10 | Performance and effectiveness of the management system are monitored, measured and evaluated. | ISO/IEC 27001:2022 clause 9.1 | Review definitions of measures, methods and timing and check the latest evaluations. | Measurement concept, evaluations, metrics reports |
| 11 | Internal audits are carried out under a program by objective auditors, and results are reported to management. | ISO/IEC 27001:2022 clause 9.2 | Check the audit program of the last three years for coverage of the scope and review two audit reports. | Audit program, audit reports, evidence of auditor independence |
| 12 | Top management reviews the management system at planned intervals with the required inputs and takes documented decisions. | ISO/IEC 27001:2022 clause 9.3 | Check the minutes of the last management review for inputs, outputs and decisions. | Management review minutes, list of decisions |
| 13 | Nonconformities are addressed at the root cause, corrective actions are checked for effectiveness and the management system is improved continually. | ISO/IEC 27001:2022 clauses 10.1 and 10.2 | Follow five nonconformities from audits or incidents from root cause analysis to effectiveness check. | Nonconformity register, root cause analyses, effectiveness evidence |
Documents to request
- Context analysis and list of interested parties
- Scope document
- Information security policy and role descriptions
- Risk assessment method, risk register and risk treatment plan
- Statement of applicability
- Security objectives with status reports
- Audit program and internal audit reports
- Minutes of the last management review
- Register of nonconformities and corrective actions
Typical findings
- The statement of applicability excludes controls without justification.
- The risk assessment has not been repeated for years, not even after major changes.
- Security objectives are not measurable.
- The audit program does not cover the scope, auditors audit their own work.
- The management review is a short note without inputs and without decisions.
- Corrective actions are closed without checking their effectiveness.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing