ISO 27001 Annex A 5.1 Audit Checklist

1. High-Level Information Security Policy Approval Verified

Verification Criteria: The primary Information Security Policy must be formally approved by top management, demonstrating leadership commitment to the ISMS.

Required Evidence: Signed policy document or Management Review Meeting (MRM) minutes explicitly recording the board-level approval of the current policy version.

Pass/Fail Test: If the policy lacks a formal signature, digital approval stamp, or corresponding minute-entry from executive leadership, mark as Non-Compliant.

2. Topic-Specific Policy Architecture Validated

Verification Criteria: A comprehensive suite of topic-specific policies (e.g., Access Control, Cryptography, Physical Security) exists to support the high-level policy as defined by the ISMS scope.

Required Evidence: Document register showing a structured hierarchy of active, approved topic-specific policies.

Pass/Fail Test: If significant control areas identified in the Statement of Applicability (SoA) lack supporting topic-specific documentation, mark as Non-Compliant.

3. Policy Accessibility for Relevant Personnel Confirmed

Verification Criteria: All policies must be published in a format and location (e.g., Intranet, DMS) that is accessible to all employees and contractors within the ISMS scope.

Required Evidence: Live demonstration of the policy repository and verification of “Read Only” access permissions for general staff.

Pass/Fail Test: If policies are stored in a restricted folder inaccessible to the staff expected to follow them, mark as Non-Compliant.

4. Policy Communication and Acknowledgement Records Present

Verification Criteria: Evidence must exist that personnel have been notified of policy updates and have formally acknowledged their understanding of their responsibilities.

Required Evidence: Logs from a Learning Management System (LMS), signed acknowledgement forms, or automated read-receipt reports from a GRC platform.

Pass/Fail Test: If more than 10% of the sampled personnel list lacks a record of policy acknowledgement within the last 12 months, mark as Non-Compliant.

5. Formal Policy Review Cycle Evidence Identified

Verification Criteria: Policies must be reviewed at planned intervals (at least annually) to ensure their continuing suitability, adequacy, and effectiveness.

Required Evidence: Document revision history showing review dates even if no changes were required, or MRM minutes documenting the annual policy review agenda item.

Pass/Fail Test: If the “Last Reviewed” date on any mandatory policy exceeds the frequency defined in the organisation’s own governance framework, mark as Non-Compliant.

6. Ad-Hoc Review Triggers for Significant Changes Verified

Verification Criteria: A mechanism must exist to trigger policy reviews outside the annual cycle in response to significant organisational or technical changes (e.g., major breach, merger, or tech stack migration).

Required Evidence: Internal audit reports or change management records showing policy updates following a major business milestone or security incident.

Pass/Fail Test: If a significant infrastructure change occurred without a corresponding review of the related security policies, mark as Non-Compliant.

7. Policy Alignment with Organisational Objectives Validated

Verification Criteria: Information security policies must reflect the organisation’s specific business requirements, legal obligations, and contractual security commitments.

Required Evidence: Mapping document or policy statements that explicitly reference relevant legislation (e.g., GDPR, UK DPA 2018) or industry standards.

Pass/Fail Test: If policy content is found to be “generic template” material that contradicts actual business workflows or legal jurisdictions, mark as Non-Compliant.

8. Stakeholder Distribution and Access Controls Confirmed

Verification Criteria: Relevant policies or policy excerpts must be communicated to external interested parties (e.g., vendors, partners) who have access to organisational assets.

Required Evidence: Third-party contracts containing security policy appendices or evidence of policy distribution via a secure vendor portal.

Pass/Fail Test: If external consultants have system access but have not been provided with the relevant Acceptable Use Policy (AUP), mark as Non-Compliant.

9. Version Control and Distribution Integrity Maintained

Verification Criteria: Only the latest authorised version of any policy must be available for use, with obsolete versions archived and removed from circulation.

Required Evidence: Inspection of the document management system to ensure no “draft” or “deprecated” versions are visible to general users.

Pass/Fail Test: If an employee is found to be using an outdated version of a policy that lacks current control requirements, mark as Non-Compliant.

10. Continuous Policy Improvement Evidence Identified

Verification Criteria: The organisation must demonstrate that policies are updated based on feedback from internal audits, management reviews, or evolving threat landscapes.

Required Evidence: “Changelog” or “Version History” sections within policies detailing the rationale for specific updates made over the last two cycles.

Pass/Fail Test: If policy versions are incremented without any descriptive record of what was changed or why, mark as Non-Compliant.

About the author