Auditing ISO 27001 Annex A 5.4 is where the rubber meets the road. While other controls look at firewalls or locked doors, this control looks at culture. It asks a simple but uncomfortable question: Does management actually care, or is this just a paper exercise?
As an auditor (or someone preparing for an audit), your job here isn’t just to check if a policy exists. It is to verify that management requires everyone – employees, contractors, and third parties – to actually apply those policies. Let’s dive into how to audit this effectively without getting lost in the weeds.
Table of contents
What is the Auditor Looking For?
The core requirement of Annex A 5.4 is that management ensures all personnel apply information security in accordance with the established policies. It is not enough to have a rule; management must ensure the rule is followed.
When auditing this, you are looking for evidence of three things:
- Communication: Did management tell people what to do?
- Expectation: Is it clear that security is a job requirement, not a suggestion?
- Enforcement: What happens when someone ignores the rules?
The Audit Checklist: Key Evidence to Review
You can’t audit feelings, so you need hard data. Here is the evidence trail you should be following:
1. Employment and Contractor Contracts
Start with the paperwork. Pick a sample of recent hires and contractors. Do their contracts explicitly mention information security responsibilities? If a contractor has access to your data but no contractual obligation to protect it, that is a finding.
2. Policy Acknowledgement Records
It’s the oldest trick in the book: “I didn’t know I couldn’t do that.” Check the logs. Has every employee signed off on the Acceptable Use Policy (AUP) and the Information Security Policy? If you find an employee who has been there for six months and hasn’t signed the policy, you have identified a gap in management responsibility.
3. Training and Awareness Logs
Management responsibilities include ensuring competence. Review the training matrix. It’s not enough to see a generic “Security 101” certificate. Ask yourself: Is the training relevant to the role? A developer needs different training than a receptionist.
4. Whistleblowing Channels
If an employee sees a manager bypassing security controls, is there a safe way for them to report it? The standard encourages a mechanism for reporting violations. Check if this process exists, if it is communicated, and if it has ever been tested or used.
The Interview: Questions to Ask
Documents only tell half the story. The real audit happens during interviews. You want to test if the “management direction” has actually reached the ground floor.
Ask employees:
- “How do you know what your security responsibilities are?”
- “If you saw a security incident, who would you report it to?”
- “When was the last time management spoke to you about security?”
Ask management:
- “How do you ensure your team follows the security policies?”
- “Can you show me an example of how you handled a recent policy violation?”
DO IT YOURSELF
STOP SPANKING £10,000s on CONSULTANTS and ISMS ONLINE PLATFORMS
Common Non-Conformities (What Goes Wrong)
In my experience, auditing Annex A 5.4 often reveals the same few issues repeatedly. Watch out for these red flags:
The “Do as I Say, Not as I Do” Syndrome
This is a classic failure. You might find a pristine policy requiring ID badges to be worn at all times, but during the audit walkthrough, the CEO walks past without one. If management exempts themselves from the rules, they are not fulfilling their responsibilities under A 5.4.
The “Ghost” Staff
You may find records for current employees, but what about the contractors? Often, third-party users are given access without the same rigorous onboarding or contract signing as full-time staff. This is a major gap.
Outdated Communication
If the last time management sent an update about security was three years ago, they aren’t actively ensuring compliance. Look for recent evidence – newsletters, Slack messages, or town hall meeting minutes.
How to Fix Gaps Before the Auditor Arrives
If you are self-auditing and finding these gaps, don’t panic. The fix is usually about formalizing what you might already be doing informally.
- Formalize the communication: Send a quarterly security update from leadership.
- Review the contracts: Work with HR and Legal to ensure security clauses are standard.
- Use a Toolkit: Sometimes the issue is just not knowing how to document these things. Resources like Hightable.io provide excellent templates for roles, responsibilities, and management reviews that can help you structure your evidence so it is audit-ready.
Conclusion
Auditing Annex A 5.4 is about verifying the “tone from the top.” It is less about technical settings and more about organisational behaviour. If you can prove that management sets the rules, communicates them, and ensures they are followed, you will breeze through this part of the audit.
About the author
Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.
Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.
As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.
His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.
