This audit checklist is a guide on how to conduct an internal audit of ISO 27001 scope based on what the ISO 27001 certification auditor will audit. It gives practical audit tips including what to audit and how.
The ISO 27001 Clause 4.3 audit checklist is designed to help an ISO 27001 Lead Auditor conduct internal audits and external audits of ISO 27001 Clause 4.3.
It complements the guide – How to audit ISO 27001 Clause 4.3
Use this checklist to simulate a certification audit and identify non-conformities regarding the Scope before the external auditor arrives.
Table of contents
- 1. Check that scope boundaries are defined
- 2. Check that the scope is aligned with the organisation’s goals
- 3. Review scope exclusions
- 4. Ensure the scope is documented
- 5. Check interdependencies between systems
- 6. Check alignment with legal and regulatory requirements
- 7. Evidence the inclusion of supporting processes
- 8. Ensure that the scope was communicated
- 9. Gain evidence of scope reviews
- 10. Review justifications for scope changes
1. Check that scope boundaries are defined
- Review scope documentation, diagrams, and network maps.
- Interview personnel involved in defining the scope.
- Check for consistency with other documented information.
2. Check that the scope is aligned with the organisation’s goals
- Review business strategy documents, risk assessments, and management review minutes.
- Interview senior management about how the scope supports business objectives.
3. Review scope exclusions
- Review the documented justifications for exclusions.
- Interview personnel about the rationale behind exclusions.
- Assess the potential impact of excluded elements on information security.
4. Ensure the scope is documented
- Inspect the scope document for completeness, accuracy, and clarity.
- Check version control and document accessibility.
5. Check interdependencies between systems
- Review network diagrams, data flow diagrams, and agreements with third parties.
- Interview personnel about system interconnections and dependencies.
6. Check alignment with legal and regulatory requirements
- Review legal and regulatory requirements relevant to the organisation.
- Check that the scope document reflects these requirements.
7. Evidence the inclusion of supporting processes
- Review process documentation and interview personnel from supporting functions.
- Assess the impact of these processes on information security.
8. Ensure that the scope was communicated
- Review communication records and interview personnel about their understanding of the scope.
- Check for evidence of communication to relevant stakeholders.
9. Gain evidence of scope reviews
- Examine the process for reviewing and updating the scope.
- Check review frequency and evidence of updates.
- Look for triggers for review (e.g., changes in business strategy, new threats).
10. Review justifications for scope changes
- Interview personnel about the reasons for changes and their impact on the ISMS.
- Review records of scope changes and their justifications.
About the author
Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.
Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.
As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.
His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.