Free checklist · For Consultants running ISO 27001 programs and internal audits
ISO 27001 Internal Audit Checklist
Certification auditors start with the management-system clauses, not Annex A. This checklist covers clauses 4–10 of ISO/IEC 27001:2022 with the evidence you should be able to produce for each one.
Clause titles summarised for audit-preparation purposes; refer to the official ISO/IEC 27001:2022 text for normative requirements.
Clause 4 – Context of the organisation
Internal and external issues identified (4.1)
Evidence: context analysis, e.g. SWOT or PESTLE notes.
Interested parties and their requirements (4.2)
Evidence: register of parties, legal and contractual requirements.
ISMS scope defined (4.3)
Evidence: documented scope statement with boundaries and interfaces.
ISMS established and maintained (4.4)
Evidence: process map or ISMS manual.
Clause 5 – Leadership
Top management commitment (5.1)
Evidence: management review minutes, resourcing decisions.
Information security policy (5.2)
Evidence: approved, communicated policy.
Roles, responsibilities and authorities (5.3)
Evidence: RACI or role descriptions.
Get the full ISO 27001 Internal Audit Checklist
All 24 items, plus a spreadsheet (CSV) you can open in Excel or Google Sheets. Free — we'll email you the link too.
No spam. Unsubscribe in one click. Prefer to skip? Start free — the full framework is built in.
Run this for every client — without the spreadsheet
ISO 27001:2022 Annex A is pre-loaded in every plan. Track the SoA, evidence and audit readiness for each client in its own workspace.
The Starter plan is free: one client workspace, up to 3 team members, no credit card.