The ISO 27001 Clause 4.2 audit checklist is designed to help an ISO 27001 Lead Auditor conduct internal audits and external audits of ISO 27001 Clause 4.2.
It complements the guide – How to audit ISO 27001 Clause 4.2
Use this checklist to simulate a certification audit and identify non-conformities before the external auditor arrives.
Table of contents
1. Verify Identification Methodology
- Objective: Confirm no critical groups were missed.
- The Challenge: Auditors often check for “Implied” stakeholders like insurance providers or landlords who enforce physical security rules.
- Audit Technique: Review the Legal Register and insurance policies to ensure they appear in the Interested Parties list.
2. Check for “Wish” vs “Requirement”
- Objective: Ensure the ISMS is focused on mandatory obligations.
- The Challenge: Documenting vague expectations (e.g., “Customers want us to be safe”) instead of specific requirements (e.g., “Customers require encryption at rest”).
- Audit Technique: Challenge the document owner to point to the source of the requirement (e.g., a contract clause).
3. Evidence of Review
- Objective: Prove the list is dynamic.
- The Challenge: Presenting a static document dated 12 months ago.
- Audit Technique: Check Management Review Minutes (Clause 9.3) for discussion of “Changes in Interested Parties.”
Further Reading
How to Implement ISO 27001 Clause 4.2
ISO 27001 Clause 4.2 Implementation Checklist
How to audit ISO 27001 Clause 4.2
ISO 27001 Clause 4.2 Audit Checklist
ISO 27001:2022 Amendment 1 – Absolutely Everything You Need to Know
ISO27001:2022 Amendment 1 Climate Action Changes – Definitive Briefing
ISO 27001:2022 Clause 4.2 Understanding The Needs And Expectations of Interested Parties Explained
