The ISO 27001 Clause 6.2 audit checklist is designed to help an ISO 27001 Lead Auditor conduct internal audits and external audits of ISO 27001 Clause 6.2 Information Security Objectives and Planning to Achieve Them.
The 10 point ISO 27001 audit plan sets out what to audit, the challenges faced and the audit techniques to adopt.
With over 30 years industry experience I will show you the audit checklist used by professional ISO 27001 Lead Auditors for ISO 27001 certification.
I am Stuart Barker, author of the Ultimate ISO 27001 Toolkit and this is the ISO 27001 Objectives audit checklist.
Review Information Security Objectives
Verify that the organisation has established documented information security objectives.
Challenges
Objectives might be missing, poorly documented, or not readily accessible. There might be a disconnect between documented objectives and actual practice. Objectives might be too numerous and overwhelming, or too few and not comprehensive enough.
Audit Techniques
Document review (ISMS objectives document, strategic plans), interviews with top management and information security management, comparison of objectives against the ISMS policy.
Assess SMART Objectives
Ensure that the objectives are Specific, Measurable, Achievable, Relevant, and Time-bound (SMART).
Challenges
Objectives might be vague, lacking clear metrics, or have unrealistic timelines. Achievability and relevance might not be properly assessed. Metrics might be collected inconsistently or not at all.
Audit Techniques
Document review (objectives documentation), interviews with those responsible for achieving the objectives, analysis of objective statements for clarity and measurability, review of metrics and KPIs associated with objectives.
Evaluate Alignment with ISMS Policy
Verify that the information security objectives are consistent with the ISMS policy.
Challenges
The ISMS policy itself might be outdated or unclear. Objectives might have drifted from the original policy intent. There may be a lack of understanding about how the policy relates to the objectives.
Audit Techniques
Document review (ISMS policy and objectives documentation), interviews with top management, analysis of the relationship between policy statements and objectives.
Assess Consideration of Risks and Requirements
Ensure that the objectives consider identified information security risks and applicable legal, regulatory, and contractual requirements.
Challenges
Risk assessments may be out of date or incomplete. Legal and regulatory requirements might not be fully identified or understood. Contractual obligations might be overlooked. The link between risks/requirements and the objectives might be weak.
Audit Techniques
Document review (risk assessment reports, legal and regulatory compliance documentation, contractual agreements), interviews with risk owners and legal/compliance personnel, analysis of how risks and requirements are addressed in the objectives.
Evaluate Resource Consideration
Verify that the objectives are realistic in terms of available resources (financial, human, technical).
Challenges
Resource allocation may be insufficient to achieve the objectives. Budgetary constraints might hinder progress. Resource planning might be inadequate or non-existent. There may be competition for resources with other projects.
Audit Techniques
Interviews with resource owners and budget holders, review of resource allocation plans and budgets, analysis of the feasibility of achieving objectives with available resources.
Examine Defined Responsibilities
Ensure that clear responsibilities are defined for achieving each objective.
Challenges
Roles and responsibilities might be unclear, overlapping, or missing. Individuals may not be aware of their responsibilities. Accountability for achieving objectives might be lacking.
Audit Techniques
Interviews with those responsible for achieving objectives, review of roles and responsibilities documentation, analysis of accountability for objective achievement.
Assess Established Timeframes
Verify that realistic timeframes are established for achieving each objective.
Challenges
Timeframes might be unrealistic or not aligned with project dependencies. Project planning might be inadequate. Changes in priorities might impact timelines. Progress tracking might be insufficient.
Audit Techniques
Review of objective implementation plans and schedules, interviews with project managers and those responsible for achieving objectives, analysis of timelines for feasibility.
Evaluate Measurement and Evaluation Methods
Ensure that methods for measuring and evaluating progress towards objectives are defined.
Challenges
Performance metrics might be inadequate or inappropriate. Data collection might be inconsistent or inaccurate. Reporting mechanisms might be ineffective. Analysis of data might be lacking.
Audit Techniques
Review of performance metrics and KPIs, interviews with those responsible for monitoring progress, examination of reporting mechanisms and dashboards, analysis of data collection and analysis procedures.
Assess Communication of Objectives
Verify that the information security objectives are communicated to relevant interested parties.
Challenges
Communication might be ineffective or inconsistent. Interested parties might not be identified or appropriately informed. Feedback mechanisms might be lacking. Communication might not be tailored to the audience.
Audit Techniques
Interviews with interested parties at different levels, review of communication plans and records, analysis of communication effectiveness, examination of awareness training materials.
Evaluate Monitoring and Review of Objectives
Ensure that the objectives are regularly monitored and reviewed to ensure they remain relevant and appropriate.
Challenges
Monitoring and review might be infrequent or inadequate. Changes in the business environment might not be reflected in the objectives. The review process might not be effective in identifying necessary adjustments.
Audit Techniques
Review of management review outputs, interviews with top management and information security management, examination of objective review records, analysis of the frequency and effectiveness of objective reviews.
Further Reading
ISO 27001 Clause 6.2 Information Security Objectives and Planning to Achieve Them
