In this ultimate how to audit guide to ISO 27001 Annex A 5.36 Compliance with Policies, Rules, and Standards, you will learn directly from an ISO 27001 Lead Auditor:
- 10 Key Audit Steps
- Verification Criteria
- Required Evidence
- The Pass / Fail Test
I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.
Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.
Table of contents
- 1. Managerial Accountability Framework Verified
- 2. Technical Standard Operating Procedure (SOP) Alignment Validated
- 3. Periodic Area-Specific Compliance Reviews Evidenced
- 4. Disciplinary Process for Security Violations Confirmed
- 5. Automated Configuration Drift Monitoring Logs Present
- 6. Policy Exception Management Integrity Verified
- 7. Non-Compliance Escalation and Reporting Integrity Confirmed
- 8. Local Asset Owner Compliance Awareness Validated
- 9. Corrective Action for Policy Breaches Records Present
- 10. Compliance Verification with Third-Party Standards Confirmed
1. Managerial Accountability Framework Verified
Auditing ISO 27001 Annex A 5.36 is the rigorous verification of managerial enforcement regarding information security directives across organisational departments. The Primary Implementation Requirement mandates active oversight and regular compliance reviews, delivering the Business Benefit of mitigated internal risks and sustained operational adherence to security standards.
Verification Criteria: Documentation exists defining how managers are held accountable for the security compliance of personnel and systems within their specific department or area of control.
Required Evidence: Managerial job descriptions or annual performance review templates containing specific information security compliance KPIs.
Pass/Fail Test: If there is no formalised record of managers being evaluated on the security compliance levels of their teams, mark as Non-Compliant.
2. Technical Standard Operating Procedure (SOP) Alignment Validated
Verification Criteria: Localised SOPs and work instructions are reviewed to ensure they do not contradict high-level organisational security policies or standards.
Required Evidence: A sample of three departmental SOPs (e.g. Finance, HR, IT Operations) cross-referenced against the Master Information Security Policy.
Pass/Fail Test: If a departmental SOP describes a workflow that bypasses a mandatory security control (e.g. sharing service passwords), mark as Non-Compliant.
3. Periodic Area-Specific Compliance Reviews Evidenced
Verification Criteria: Managers conduct or facilitate regular reviews to ensure that security procedures are being followed correctly within their domain.
Required Evidence: Meeting minutes, internal audit memos, or signed “Managerial Attestation” reports from the current audit cycle.
Pass/Fail Test: If a manager cannot produce evidence of a review performed in their department within the last 12 months, mark as Non-Compliant.
