ISO 27001 Annex A 6.1 Audit Checklist

The ultimate audit guide to ISO 27001 Annex A 6.1 Screening

1. Personnel Screening Policy Formalisation Verified

Verification Criteria: A documented policy exists defining the mandatory background verification requirements for all candidates prior to joining the organisation.

Required Evidence: Approved Recruitment or Information Security Policy containing a dedicated section on “Personnel Screening” and “Background Checks”.

Pass/Fail Test: If the organisation cannot produce a formal policy that specifies the minimum screening requirements for different role types, mark as Non-Compliant.

2. Screening Rigour Proportionality Confirmed

Verification Criteria: The level of screening (e.g. basic vs. enhanced) is explicitly mapped to the business requirements, information classification access, and perceived risks of the specific role.

Required Evidence: Role-based risk assessment matrix or a HR screening tier list (e.g. Tier 1 for standard users, Tier 2 for Privileged Admins).

Pass/Fail Test: If high-privileged administrators undergo the same basic screening as non-technical entry-level staff without additional financial or enhanced background checks, mark as Non-Compliant.

3. Government-Issued Identity Verification Records Present

Verification Criteria: Formal verification of the candidate’s identity is performed using primary government-issued documentation to prevent identity fraud.

Required Evidence: Copies of passports, driving licences, or national ID cards held securely within the HR file (redacted where required by local law).

Pass/Fail Test: If a personnel file is missing a verified copy of a government-issued photo ID or evidence that the ID was sighted and verified against the individual, mark as Non-Compliant.

4. Academic and Professional Qualification Validation Evidenced

Verification Criteria: The organisation verifies that the candidate possesses the academic degrees and professional certifications claimed during the recruitment process.

Required Evidence: Verification logs from third-party screening providers or direct email confirmations/transcripts from the issuing educational institutions.

Pass/Fail Test: If the organisation relies solely on “Self-Attestation” (the candidate’s CV) for professional certifications (e.g. CISA, CISSP) without secondary verification, mark as Non-Compliant.

5. Legal Right-to-Work Compliance Confirmed

Verification Criteria: A formal check is conducted to ensure the candidate has the legal right to work in the specific jurisdiction where the service is being performed.

Required Evidence: Completed Right-to-Work check forms, visa status verification logs, or Home Office (UK) share code verification receipts.

Pass/Fail Test: If the organisation cannot produce evidence that a non-citizen’s work visa was verified before they were granted access to organisational assets, mark as Non-Compliant.

6. Criminal Record Check Evidence Identified

Verification Criteria: Criminal record checks are performed where permitted by local law and where the risk associated with the role justifies such a check.

Required Evidence: DBS certificates (UK), Disclosure certificates, or third-party background reports confirming the absence of relevant unspent convictions.

Pass/Fail Test: If a role involves handling sensitive financial data or child-related information and no criminal record check was performed, mark as Non-Compliant.

7. Employment History and Reference Verification Validated

Verification Criteria: The organisation validates the candidate’s previous employment history (typically for the last 3-5 years) and obtains character or professional references.

Required Evidence: Written references from previous employers or timestamped logs of verbal reference checks maintained in the HR system.

Pass/Fail Test: If an employee has been hired with gaps in their employment history exceeding six months that haven’t been documented or explained, mark as Non-Compliant.

8. Ongoing Screening Process Execution Verified

Verification Criteria: Screening is not treated as a “one-time” event; high-risk roles are subject to periodic re-screening or trigger-based re-validation.

Required Evidence: Re-screening schedule or logs showing that staff in critical roles (e.g. Finance/IT) undergo re-checks every 3-5 years.

Pass/Fail Test: If an individual has been in a high-privileged role for 10+ years and has never undergone a follow-up background check or credit check, mark as Non-Compliant.

9. Contractor and Third-Party Screening Alignment Validated

Verification Criteria: Agreements with external recruitment agencies or contractors mandate that they perform screening to the organisation’s defined standards.

Required Evidence: Signed Master Service Agreements (MSAs) with “Right to Audit” screening logs or certificates of compliance from the vendor.

Pass/Fail Test: If the organisation uses third-party contractors who have access to the ISMS scope but the contract doesn’t explicitly mandate screening equivalent to internal staff, mark as Non-Compliant.

10. Screening Documentation Retention Compliance Verified

Verification Criteria: Personnel screening records are retained securely and only for as long as legally required or necessary for the security of the organisation.

Required Evidence: HR Data Retention Schedule and evidence of secure disposal of surplus screening data (e.g. shredding certificates for unsuccessful candidates).

Pass/Fail Test: If sensitive background check data for rejected candidates is kept indefinitely in unencrypted folders, mark as Non-Compliant.

About the author