ISO 27001 Internal Audit Checklist

An ISO 27001 checklist for planning and running an ISMS internal audit: scope, audit programme, evidence sampling, nonconformities and a clean report.

Typical schedule annually
The checklist 5 sections, 26 items
Variables {{audit_period}}

Use this template Free, no credit card. Imports the checklist into your Runbook organization.

Auf Deutsch lesen: ISO 27001 Checkliste für das interne Audit

Use this checklist to plan and carry out an internal audit of your information security management system (ISMS). ISO/IEC 27001 requires internal audits at planned intervals, and certification bodies look at whether yours are real. Most small companies run one full audit a year, often a few months before the external surveillance or recertification audit, so there is time to fix what it finds.

Who owns it

The ISMS owner plans the audit programme, but the auditor must be independent of the area being audited. In a small company that can be a colleague from another team, a partner company, or an external consultant. Adapt this to your jurisdiction and certification scope; it is a practical checklist, not legal advice.

Common pitfalls

Auditing your own work. If the person who wrote the policies also audits them, the certification auditor may question the result. Swap areas with a colleague or buy in help.
Checking documents, not practice. A policy that says "quarterly access reviews" is only half the evidence. Ask for the last two reviews.
Sampling only easy cases. Pick samples yourself, including recent leavers, emergency changes and supplier onboardings.
Findings without owners. Every nonconformity needs a root cause, an owner and a due date, or it will reappear next year.
Skipping the clauses. The management clauses (context, risk assessment, management review) are audited too, not only the Annex A controls.

The checklist: ISO 27001 internal audit {{audit_period}}

Plan the audit

Confirm the ISMS scope and the current Statement of Applicability
Update the audit programme so all clauses and applicable controls are covered over the cycle
Weight the plan by risk and by findings from earlier audits.
Appoint an auditor who is independent of the areas being audited
Agree the audit dates, interviewees and evidence requests with each area owner
Review last period's findings and corrective actions before starting

Audit the management system clauses

Check that context, interested parties and scope are documented and still accurate
Confirm the risk assessment was updated in {{audit_period}} and matches the risk treatment plan
Check that security objectives exist, are measured and are reported
Verify that the last management review happened and its required inputs and decisions are recorded
Confirm document control: versions, approvals and review dates on ISMS documents
Check that staff competence and awareness records exist for people with security roles

Test Annex A controls

Sample joiners, movers and leavers and trace their access changes to approvals
Verify that access reviews were completed on schedule, with evidence of removals
Sample changes to production and confirm each followed the change process
Check that backups ran and that a restore was tested within the policy interval
Review security incidents and confirm each was logged, handled and closed with lessons learned
Sample suppliers that handle sensitive data and check their assessments and contracts
Check vulnerability management: scan results, patch timelines and accepted risks
Walk through physical and remote-working controls relevant to your scope optional

Report findings

Classify each finding as major nonconformity, minor nonconformity or opportunity for improvement
Record the evidence behind every finding, not only the conclusion
Hold a closing meeting with the ISMS owner and area owners
Issue the written audit report and file it as ISMS evidence

Corrective actions

Record a root cause, owner and due date for each nonconformity
Add the audit results as an input to the next management review
Schedule a follow-up check that corrective actions were effective

Checklist as Markdown

# ISO 27001 internal audit {{audit_period}}

## Plan the audit
- [ ] Confirm the ISMS scope and the current Statement of Applicability
- [ ] Update the audit programme so all clauses and applicable controls are covered over the cycle
  Weight the plan by risk and by findings from earlier audits.
- [ ] Appoint an auditor who is independent of the areas being audited
- [ ] Agree the audit dates, interviewees and evidence requests with each area owner
- [ ] Review last period's findings and corrective actions before starting

## Audit the management system clauses
- [ ] Check that context, interested parties and scope are documented and still accurate
- [ ] Confirm the risk assessment was updated in {{audit_period}} and matches the risk treatment plan
- [ ] Check that security objectives exist, are measured and are reported
- [ ] Verify that the last management review happened and its required inputs and decisions are recorded
- [ ] Confirm document control: versions, approvals and review dates on ISMS documents
- [ ] Check that staff competence and awareness records exist for people with security roles

## Test Annex A controls
- [ ] Sample joiners, movers and leavers and trace their access changes to approvals
- [ ] Verify that access reviews were completed on schedule, with evidence of removals
- [ ] Sample changes to production and confirm each followed the change process
- [ ] Check that backups ran and that a restore was tested within the policy interval
- [ ] Review security incidents and confirm each was logged, handled and closed with lessons learned
- [ ] Sample suppliers that handle sensitive data and check their assessments and contracts
- [ ] Check vulnerability management: scan results, patch timelines and accepted risks
- [ ] Walk through physical and remote-working controls relevant to your scope (optional)

## Report findings
- [ ] Classify each finding as major nonconformity, minor nonconformity or opportunity for improvement
- [ ] Record the evidence behind every finding, not only the conclusion
- [ ] Hold a closing meeting with the ISMS owner and area owners
- [ ] Issue the written audit report and file it as ISMS evidence

## Corrective actions
- [ ] Record a root cause, owner and due date for each nonconformity
- [ ] Add the audit results as an input to the next management review
- [ ] Schedule a follow-up check that corrective actions were effective

Frequently asked questions

How often does ISO 27001 require an internal audit?

The standard requires internal audits at planned intervals, without fixing a number. Most organisations cover the full ISMS at least once per certification year, either in one audit or spread over several smaller ones. Certification bodies expect the whole scope to be audited across the three-year cycle.

Can a small company do its own ISO 27001 internal audit?

Yes, as long as the auditor is objective and impartial. In practice that means the person should not audit their own work. Small teams often swap areas between colleagues or hire an external auditor for a few days.

What is the difference between a major and a minor nonconformity?

A major nonconformity is a requirement that is not met at all, or a failure that puts the ISMS at real risk. A minor nonconformity is an isolated lapse in an otherwise working process. Exact definitions vary by certification body, so align your internal grading with the one your external auditor uses.

Updated 2026-11-04