ISO 27001 Audit Checklist: The Complete Guide to ISMS Audits in 2026
ISO 27001 Audit Checklist: The Complete Guide to ISMS Audits in 2026
An ISO 27001 audit checklist gives you a structured list of questions to test your information security management system (ISMS) against the standard. Use it for your internal audit, for a gap analysis before you start, and for a final readiness check before the certification body arrives. This guide covers the clause checklist, the Annex A controls, the documents auditors ask for and how to run the audit.
An ISO 27001 audit checklist is a list of questions based on clauses 4 to 10 and the 93 Annex A controls of ISO/IEC 27001:2022. You answer each one with evidence, such as a policy, a record or an interview, to show where your ISMS conforms and where it has gaps.
What is an ISO 27001 audit checklist?
ISO/IEC 27001 is the international standard for information security management. Clause 9.2 requires you to run internal audits at planned intervals, and certification bodies audit you too. In both cases the auditor works through questions and looks for objective evidence.
A good ISO 27001 audit checklist helps in three ways: it keeps the audit consistent, it makes sure nothing is skipped, and it gives you a record of what was checked and what was found.
ISO 27001 audit checklist by clause (4 to 10)
The management system clauses apply to every organization. Check each one first.
- Clause 4Context. Have you defined the ISMS scope and the needs of interested parties?
- Clause 5Leadership. Is there an approved information security policy with assigned roles?
- Clause 6Planning. Is risk assessed and treated, and is there a Statement of Applicability and set objectives?
- Clause 7Support. Are resources, competence, awareness and documented information in place?
- Clause 8Operation. Are risk assessments and treatment plans actually carried out?
- Clause 9Performance. Is the ISMS monitored, internally audited and reviewed by management?
- Clause 10Improvement. Are nonconformities recorded and corrective actions closed?
ISO 27001 audit checklist for Annex A controls
ISO/IEC 27001:2022 has 93 Annex A controls in four themes. You audit the ones listed as applicable in your Statement of Applicability, and you must be able to justify any you exclude.
- 37Organizational controls. Policies, roles, asset management, access control, supplier relationships and incident management.
- 8People controls. Screening, terms of employment, awareness and training, and remote working.
- 14Physical controls. Secure areas, equipment protection, clear desk and secure disposal.
- 34Technological controls. Endpoint security, backup, logging, cryptography, network security and secure development.
ISO 27001 audit checklist: documents and records auditors ask for
Auditors ask to see "documented information": some you maintain as documents and some you retain as records.
Documents to maintain
- Scope of the ISMS
- Information security policy
- Risk assessment and treatment process
- Statement of Applicability
- Information security objectives
Records to retain
- Competence and training
- Risk assessment and treatment results
- Monitoring and measurement results
- Internal audit programme and results
- Management review results
- Nonconformities and corrective actions
ISO 27001 audit checklist: free download vs complete toolkit
A free checklist lists questions. It does not give you the policies, procedures and forms that answer them.
| Free checklist | Complete ISO 27001 toolkit | |
|---|---|---|
| Audit forms | Often a single list | Procedure, plan, checklist and NCR forms |
| Policies and procedures | Not included | 23 policies, 19 procedures, 9 SOPs |
| Statement of Applicability | Rarely included | Form and manual annexure |
| Edition | Often the 2013 version | Built for ISO/IEC 27001:2022 |
| Support | None | Questions answered within 24 hours |
How to run an ISO 27001 internal audit in five steps
Plan the audit programme
Define scope, criteria and schedule. Auditors must be impartial, so nobody should audit their own work.
Review the documented information
Check the policy, scope, risk process and Statement of Applicability against the standard. Our ISO 27001 templates guide lists what to expect.
Test the controls and collect evidence
Work through the checklist using interviews, observation and sampling of records. Note evidence for every answer.
Report nonconformities
Record each finding with the clause or control it relates to, and agree a corrective action and owner.
Follow up and feed the review
Verify that corrective actions worked, then present the results at the management review. For the full document set, see our ISO 27001 documentation toolkit guide.
Use a 2022 ISO 27001 audit checklist
The transition from ISO/IEC 27001:2013 to the 2022 edition ended on 31 October 2025, so audits now use the 2022 requirements and its 93 Annex A controls. Read the official overview on the ISO website. Make sure any checklist you download is mapped to the 2022 edition.
ISO 27001 audit checklist: frequently asked questions
What is an ISO 27001 audit checklist?
An ISO 27001 audit checklist is a list of questions based on clauses 4 to 10 and the Annex A controls of ISO/IEC 27001:2022. You answer each with evidence to show where your ISMS conforms and where it has gaps.
How many controls are in ISO 27001:2022 Annex A?
Annex A of ISO/IEC 27001:2022 has 93 controls in four themes: 37 organizational, 8 people, 14 physical and 34 technological. The 2013 edition had 114.
Do we need an internal audit for ISO 27001?
Yes. Clause 9.2 requires internal audits at planned intervals, and certification bodies expect to see the audit programme, the results and the corrective actions.
Can I use a free ISO 27001 audit checklist?
Yes, for a first gap analysis. Free checklists usually list questions without the policies, procedures and records that prove the answers, so you still need to produce those.
Does passing the checklist guarantee certification?
No. The certification body makes its own assessment. A checklist helps you find and close gaps beforehand, but certification depends on how your ISMS runs in practice.
Related toolkits and guides
ISO 27001 TemplatesRead the guide
Toolkit GuideDocument-by-document guide
ISO 27001 Documentation PackWhat's inside
ISO 22301 KitBusiness continuityGet your ISO 27001 audit checklist and ISMS documents today
Skip months of drafting. Get a complete, editable ISMS documentation toolkit built by a team with 20+ years of ISO experience and used by 600+ clients in 109 countries.
Build your ISO knowledge with globally recognised training
Develop practical ISO knowledge through self-paced training designed for professionals, auditors and organisations looking to strengthen their understanding of international management standards.
Training is delivered through our recommended training provider, Itmad Academy. Choose from ISO courses covering quality, environmental, occupational health & safety, information security and other management standards.
Use this code at checkout
Browse all courses →Redeem this code at itmadacademy.com. Itmad Academy is an independent training provider. ISO Gorilla may earn a commission on qualifying purchases made through this link.