A practical, clause-by-clause checklist for planning and conducting an internal ISMS audit. Review Clauses 4–10, use the current Statement of Applicability to scope Annex A controls, and record objective evidence—not just ticks.
By Axel Hoehnke · Published 5 November 2026
0 items checked
01 · BEFORE YOU START
How to use this internal audit checklist
Use the checklist to structure an audit, not to replace professional judgement or the organisation’s own audit criteria. Define the scope, sample evidence, record what was tested and connect every conclusion to an applicable requirement.
This is an independent working aid, not an ISO publication or a certification body’s audit checklist. It paraphrases requirements and does not reproduce the full standard text. Check the licensed, current standard and your certification scheme when interpreting a requirement.
Edition check: this checklist is based on ISO/IEC 27001:2022, including Amendment 1:2024 on climate action changes. It uses ISO 19011:2026 as current audit guidance; ISO 19011 is guidance, not an additional ISO 27001 certification requirement.
For each item, record objective evidence such as a document reference, interview, observation or sample tested. A checked box alone is not an audit trail. Annex A is a reference control set: assess applicability through risk treatment and the current Statement of Applicability (SoA). Do not treat all 93 controls as automatically applicable.
Audit preparation 5 items
02 · REQUIREMENTS
Clauses 4–10 internal audit checklist
The checks below are concise prompts. The audit criteria should be the applicable requirements, the organisation’s own ISMS requirements and the audit scope.
Clause 4 · Context of the organisation5 items
Clause 5 · Leadership5 items
Clause 6 · Planning7 items
Clause 7 · Support7 items
Clause 8 · Operation6 items
Clause 9 · Performance evaluation9 items
Clause 10 · Improvement5 items
03 · ANNEX A
Annex A controls: scope them through the SoA
ISO/IEC 27001:2022 Annex A contains 93 reference controls across four themes. For each control in scope, check the SoA status and sample evidence of implementation. A control may be excluded where the organisation’s risk treatment justifies that decision; Annex A is not a blanket requirement to implement every control.
A.5 · Organisational controls37 items
A.6 · People controls8 items
A.7 · Physical controls14 items
A.8 · Technological controls34 items
04 · REPORTING
Classify findings and close the audit
ISO/IEC 27001 requires reporting audit results and retaining documented information; it does not prescribe one universal major/minor/observation grading scale. Apply the organisation’s audit criteria and any certification scheme definitions consistently.
Major nonconformity
A requirement is not met, or a pattern of findings indicates a systemic failure. Apply the organisation’s documented grading rules; certification consequences depend on the certification scheme.
Follow-up: Record evidence and requirement; assign corrective action and verify effectiveness under Clause 10.2.
Minor nonconformity
An isolated failure to meet an applicable requirement, without evidence that the ISMS has failed systemically.
Follow-up: Record the issue, correction or corrective action, owner and follow-up evidence.
Observation / improvement opportunity
A potential weakness or improvement idea that does not currently meet the organisation’s threshold for nonconformity.
Follow-up: Report transparently; management decides whether to act. Do not label a nonconformity as an observation.
Use these categories only where they match your audit rules and certification scheme.
Audit sign-off record
Lead auditor
Audit date(s)
Areas and processes audited
Findings (major / minor, if used)
Observations or improvement opportunities
Report issued
Distributed to
05 · FAQ
ISO 27001 internal audit checklist: FAQs
What does this ISO 27001 internal audit checklist cover?
It provides audit prompts for Clauses 4–10, a pre-audit setup list, the 93 Annex A control references, a finding record and sign-off fields. It is a working aid, not the full text of ISO/IEC 27001 or ISO/IEC 27002.
Do I need to audit all 93 Annex A controls?
No. Use the current risk treatment and Statement of Applicability to establish which controls are applicable and in scope. Annex A is a reference set for checking that necessary controls have not been omitted; it is not a blanket instruction to implement every control.
Does ISO 27001 require an internal audit every year?
ISO/IEC 27001 requires internal audits at planned intervals. It does not prescribe one universal annual frequency. The audit programme should consider process importance and previous results, alongside the organisation’s scope, risks and changes.
Does this checklist guarantee ISO 27001 certification?
No. Certification depends on the organisation’s ISMS, evidence, audit scope and the applicable certification scheme. A checklist can help structure an internal audit, but it cannot establish conformity by itself or replace a competent auditor’s evaluation.
Does ISO 27001 define major and minor nonconformities?
ISO/IEC 27001 requires audit results to be reported and nonconformities to be addressed, but it does not prescribe one universal major/minor/observation scale. Follow the organisation’s documented audit rules and any applicable certification-body definitions.
Can the person who implemented a control audit it?
Audits must be objective and impartial. As a practical safeguard, assign a different competent person to audit work they designed or operate, or document and manage any conflict so the audit conclusion remains impartial.
Which ISO 19011 edition does this checklist use?
The page references ISO 19011:2026, the current published edition as of this page’s review date. ISO 19011 provides audit guidance; it is not an additional ISO/IEC 27001 certification requirement.
Is the climate-change amendment included?
Yes. The Clause 4 prompts reflect ISO/IEC 27001:2022/Amd 1:2024: determine whether climate change is a relevant issue and consider relevant climate-related requirements raised by interested parties.
Standards and related guidance
Use the official publications for normative wording. This page is a practical summary and does not replace ISO/IEC 27001 or ISO/IEC 27002.
Analytics is optional. If you accept, we use Google Analytics and Replit-hosted Umami analytics (pageviews and site interactions) to understand how visitors use this site and improve it; if you reject, analytics stays off. You can change or withdraw this choice anytime in Cookie settings.
Privacy policy.
