ISO 27001:2022 Annex A 5.35 Independent review of information security

In this guide, I will show you exactly how to implement ISO 27001 Annex A 5.35 and ensure you pass your audit. You will get a complete walkthrough of the control, practical implementation examples, and access to the ISO 27001 templates and toolkit that make compliance easy.

I am Stuart Barker, an ISO 27001 Lead Auditor with over 30 years of experience conducting hundreds of audits. I will cut through the jargon to show you exactly what changed in the 2022 update and provide you with plain-English advice to get you certified.

Key Takeaways: ISO 27001 Annex A 5.35 Independent Review of Information Security

ISO 27001 Annex A 5.35 mandates that an organization’s approach to information security is assessed objectively. The goal is to prevent “marking your own homework” ensuring that security controls are evaluated by someone who has no direct influence over the operations being checked.

Core requirements for compliance include:

• True Independence: The reviewer must not be responsible for the implementation or management of the controls they are testing. For example, a CISO cannot independently review the ISMS they built.
• Planned Intervals: Reviews must happen on a scheduled basis (often annually) or when significant changes occur, such as a merger, new regulation, or major system overhaul.
• Qualified Reviewers: Independence isn’t enough; the reviewer must also be competent. This can be an internal audit team, a peer from another department (e.g., HR auditing IT, if trained), or an external consultant.
• Reporting: The results of the independent review must be reported directly to Top Management to ensure accountability and visibility.

Audit Focus: Auditors will scrutinize the org chart and contracts to verify independence. They will check:

1. Objectivity: Is the reviewer free from conflict of interest?
2. Competence: Does the reviewer actually understand what they are auditing?
3. Action: Did management actually fix the issues raised in the independent report?

Internal vs. External Review: While “Independent Review” often implies an external consultant (which is the gold standard for objectivity), it is not strictly required. An internal audit team can fulfil this requirement, provided they report to a separate authority (like the Board) and not the IT or Security Manager.

What is ISO 27001 Annex A 5.35?

ISO 27001 Annex A 5.35 Independent review of information security is an ISO 27001 control that wants you to get an independent review of your information security management and controls at planned intervals or when things change significantly.

What is the purpose of ISO 27001 Annex 5.35?

The purpose of ISO 27001 Annex A 5.35 Independent review of information security is to ensure that what you are doing is still suitable, adequate and effective.

It is independent so that you do not mark your own homework or become complacent in your operations.

What is the definition of ISO 27001 Annex 5.35?

The ISO 27001 standard defines ISO 27001 Annex A 5.35 as:

The organisations approach to managing information security and its implementation including people, processes and technologies should be reviewed independently at planned intervals, or when significant changes occur. 

ISO 27001:2022 Annex A 5.35 Independent review of information security

Watch the ISO 27001 Annex A 5.35 Tutorial

In this video I show you how to implement ISO 27001 Annex A 5.35 and how to pass the audit.

ISO 27001 Annex A 5.35 Podcast

In this episode: Lead Auditor Stuart Barker and team do a deep dive into the ISO 27001 Annex A 5.35 Independent Review Of Information Security. The podcast explores what it is, why it is important and the path to compliance.

How to implement ISO 27001 Annex A 5.35

Process of independent review

You will have policy and process for independent reviews. Consider the guidance in ISO 27001 Clause 9.2 Internal audit.

For the process of independent review and audit you can learn the exact process by reading How to Conduct an Internal Audit.

Plan your reviews

You will plan your reviews on a periodic basis. There is no real guidance on periodic so plan to do one full audit of everything at least annually. You can implement an audit plan that includes both internal and external audits and reviews.

Make sure the reviewer is independent

Independence can be achieved using internal or external persons as long as they are independent of the area being reviewed. The people should have the competence to do the review and not have authority over the area being reviewed.

Continual Improvement

Opportunities for continual improvement form part of the independent review. Based on the continual improvement policy and process this is an opportunity to identify any needs for change or enhancements.

Consider the guidance in ISO 27001 Clause 10.1 Continual Improvement.

Corrective Actions

Corrective actions may be required and should be implemented if the review finds things not working as intended. You would record it in the incident and corrective action log, potentially in the risk register if there is a risk identified and manage it as part of the corrective action process.

For further guidance refer to ISO 27001:2002 Clause 10.2 Corrective Action

Send reports to management

Independent reviews are reported to management and to top management as appropriate. Using the mechanism of the Management Review Team and the Management Review Team meeting is a great way to report out. Following the structured management review team agenda as defined by the standard.

When to conduct independent reviews

In addition to the planned periodic independent reviews there are other times that you would consider conducting independent reviews. They could be when

• Laws change
• Regulations change
• You start a new business venture
• You change business practice
• You enter a new jurisdiction
• Your security controls change

Independence Criteria

Reviewer	Can they review?	Condition
CISO / Security Mgr	❌ NO	Cannot mark their own homework.
IT Manager	❌ NO	Cannot review IT controls they manage.
Internal Audit Team	✅ YES	If they report to the Board/Audit Committee.
External Consultant	✅ YES	The gold standard for independence.
Peer Review	⚠️ Maybe	E.g., HR Manager audits IT (requires training).

ISO 27001 Annex A 5.35 Template

The ISO 27001 Gap Analysis, Review and Audit Toolkit provides everything you need to conduct an independent review from the templates, reports, detailed step by step guides and audit work sheets.

Fast Track ISO 27001 Annex A 5.35 Compliance with the ISO 27001 Toolkit

---

Own Your ISMS, Don’t Rent It

Do it Yourself ISO 27001 with the Ultimate ISO 27001 Toolkit

---

For ISO 27001 Annex A 5.35 (Independent review of information security), the requirement is to review the organization’s approach to managing information security independently at planned intervals or when significant changes occur. This ensures you don’t “mark your own homework” and that your controls remain suitable, adequate, and effective.

While SaaS compliance platforms often try to sell you “automated internal audit modules” or “compliance tracking dashboards,” they cannot actually be independent, they are the tool you are using to manage your compliance, nor can they provide the “fresh eyes” of an external auditor, those are human governance and independent verification tasks. The High Table ISO 27001 Toolkit is the logical choice because it provides the audit framework you need to manage independent reviews effectively without a recurring subscription fee.

1. Ownership: You Own Your Audit Framework Forever

SaaS platforms act as a middleman for your compliance evidence. If you define your audit plan and store your review reports inside their proprietary system, you are essentially renting your own organizational verification records.

• The Toolkit Advantage: You receive the Internal Audit Policy and Independent Review Templates in fully editable Word/Excel formats. These files are yours forever. You maintain permanent ownership of your standards (such as specific independence criteria for reviewers), ensuring you are always ready for an audit without an ongoing “rental” fee.

2. Simplicity: Governance for Real-World Reviews

Annex A 5.35 is about getting an impartial view. You don’t need a complex new software interface to manage what an external consultant’s report or a well-documented internal audit already does perfectly.

• The Toolkit Advantage: You likely already engage external experts for certain tasks. What you need is the governance layer to prove to a certification body that these reviews are formal, planned, and reported to management. The Toolkit provides pre-written procedures and “Audit Worksheets” that formalize your verification into an auditor-ready framework, without forcing your team to learn a new software platform just to log an audit result.

3. Cost: A One-Off Fee vs. The “Audit Module” Tax

Many compliance SaaS platforms charge more for “advanced audit” or “independent review” features. For a control that is a mandatory part of the “Check” phase in the PDCA cycle, these monthly costs can scale aggressively for very little added value.

• The Toolkit Advantage: You pay a single, one-off fee for the entire toolkit. Whether you conduct 1 review a year or 10, the cost of your Independent Review Documentation remains the same. You save your budget for actual external auditors or security experts rather than an expensive compliance dashboard.

4. Freedom: No Vendor Lock-In for Your Verification Strategy

SaaS tools often mandate specific ways to report on and monitor “independent reviews.” If their system doesn’t match your unique internal audit structure or specialized industry requirements, the tool becomes a bottleneck to true verification.

• The Toolkit Advantage: The High Table Toolkit is 100% technology-agnostic. You can tailor the Review Procedures to match exactly how you operate, whether you use a dedicated internal team or a third-party consultant. You maintain total freedom to evolve your audit strategy without being constrained by the technical limitations of a rented SaaS platform.

Summary: For Annex A 5.35, the auditor wants to see a formal audit plan and evidence that reviews were conducted by someone independent of the area being audited. The High Table ISO 27001 Toolkit provides the governance framework to satisfy this requirement immediately. It is the most direct, cost-effective way to achieve compliance using permanent documentation that you own and control.

ISO 27001 Annex A 5.35 FAQ

What other standards apply?

ISO/IEC 27007 and ISO/IEC TS 27008 provide guidance for carrying out independent reviews. 

Related ISO 27001 Controls

ISO 27001 Annex A 5.36 Compliance With Policies, Rules And Standards For Information Security

ISO 27001 Controls and Attribute values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Preventive	Availability Confidentiality Integrity	Identify Protect	Information protection	Governance and ecosystem

About the author

Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.

Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.

As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.

His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.