ISO 27001 Annex A 5.4 Audit Checklist

1. Management Enforcement of Security Policies Verified

Verification Criteria: Evidence exists that management explicitly requires all personnel and relevant interested parties to apply information security in accordance with established policies.

Required Evidence: Clauses in employment contracts, signed employee handbooks, or contractor agreements that mandate adherence to the Information Security Policy.

Pass/Fail Test: If there is no documented mandate from management requiring staff to follow security policies within their contractual obligations, mark as Non-Compliant.

2. Tone at the Top and Security Culture Validation Confirmed

Verification Criteria: Management demonstrates a clear “tone at the top” by actively promoting security awareness and compliance through internal communications.

Required Evidence: Emails, newsletters, or video briefings from executive leadership (C-suite) specifically addressing the importance of information security during the current audit period.

Pass/Fail Test: If security communications only originate from the IT/Security department without visible endorsement from senior business leadership, mark as Non-Compliant.

3. Provisioning of Information Security Resources Evidenced

Verification Criteria: Management ensures that the resources required for the ISMS (personnel, budget, and technology) are identified, allocated, and adequate for the risk landscape.

Required Evidence: Approved ISMS budget, resource allocation plans, or organograms showing dedicated security roles with sufficient headcount.

Pass/Fail Test: If critical security projects are stalled or roles remain vacant for over 6 months due to a lack of management-authorised funding/resources, mark as Non-Compliant.

4. Formal Disciplinary Process for Security Breaches Verified

Verification Criteria: A formal disciplinary process exists and is communicated for personnel who have committed an information security breach.

Required Evidence: Human Resources Disciplinary Policy containing specific sections or clauses related to information security violations.

Pass/Fail Test: If the disciplinary policy does not explicitly mention security non-compliance as a ground for corrective action, mark as Non-Compliant.

5. Security KPI Integration in Performance Reviews Confirmed

Verification Criteria: Information security responsibilities are integrated into the standard performance management and appraisal processes for all staff.

Required Evidence: Sampled performance appraisal templates or completed review records showing security-related objectives or KPIs.

Pass/Fail Test: If staff performance is evaluated solely on business output with no regard for security policy adherence or training completion, mark as Non-Compliant.

6. Strategic Alignment of Security Objectives Validated

Verification Criteria: Management ensures that information security objectives are established and are compatible with the strategic direction of the organisation.

Required Evidence: Strategic business plans or Board meeting minutes where security objectives are mapped against business goals.

Pass/Fail Test: If security objectives are developed in isolation by the IT department and are unknown to executive management, mark as Non-Compliant.

7. Management Participation in ISMS Reviews Evidenced

Verification Criteria: Senior management actively participates in the Management Review of the ISMS to evaluate its continuing suitability and effectiveness.

Required Evidence: Management Review Meeting (MRM) minutes showing attendance by Top Management and their sign-off on review outputs.

Pass/Fail Test: If the Management Review is conducted by the CISO alone without the participation or final approval of executive leadership, mark as Non-Compliant.

8. Reporting Lines for Security Leadership Verified

Verification Criteria: The individual responsible for information security has a clear reporting line to senior management to ensure independence and authority.

Required Evidence: Current organisational chart and job description for the CISO/Security Lead showing a direct or dotted line to the CEO or Board.

Pass/Fail Test: If the security function is buried under several layers of IT management with no access to executive leadership, mark as Non-Compliant.

9. Internal Promotion of Security Continuous Improvement Confirmed

Verification Criteria: Management actively supports and directs the continual improvement of the ISMS based on audit findings and risk assessments.

Required Evidence: Corrective Action Plans (CAPs) approved by management following internal or external audits.

Pass/Fail Test: If audit non-conformities are ignored by management or lack an authorised budget for remediation, mark as Non-Compliant.

10. Communication of Organisational Role Changes Verified

Verification Criteria: Management ensures that changes to security-related roles and responsibilities are communicated effectively to the relevant staff.

Required Evidence: Internal announcements, updated RACI matrices, or role-change notification logs sent to affected personnel.

Pass/Fail Test: If key security accountabilities change but personnel are found to be unaware of their updated duties, mark as Non-Compliant.

About the author