ISO 27001 Internal Audit Checklist
This checklist can be used to assess the organization's readiness for ISO 27001 certification. It helps to uncover gaps in processes and to review your organization's ISMS according to ISO 27001:2013.
Use this template with flowdit
- Customize this template or build your own
- Complete inspections using the mobile app
- Get reports and analyze your data
Start inspecting smarter — free for one user.
How to Use This Checklist
- Assign an auditor who is objective and independent of the area being reviewed.
- Plan the audit by defining its scope, criteria and objectives, and inform the relevant roles.
- Work through the checklist section by section, gathering objective evidence for each requirement.
- Record each finding, whether it is conforming, non-conforming or an opportunity for improvement.
- Report the results to top management and ensure the responsible owners agree on corrective actions and timescales.
Start inspecting smarter — free for one user.
About this checklist
This checklist can be used to assess the organisation's readiness for ISO 27001 certification. It helps to uncover gaps in processes and to review your organisation's ISMS according to ISO 27001:2013.
First, define the scope of your ISMS
Start by determining the internal and external issues that are relevant to the organisation's purpose and that affect its ability to achieve the intended outcomes of the information security management system (ISMS). Identify the interested parties that are relevant to the ISMS and their information security requirements. Then determine the boundaries and applicability of the ISMS to establish its scope, and establish, implement, maintain and continually improve the ISMS in accordance with the requirements of ISO 27001.
Confirm leadership commitment
Check that top management demonstrates leadership and commitment by ensuring the information security policy and objectives are established and compatible with the organisation's strategic direction, integrating ISMS requirements into the organisation's processes, ensuring the necessary resources are available, communicating the importance of effective information security, ensuring the ISMS achieves its intended results, directing and supporting people to contribute to its effectiveness, promoting continual improvement, and supporting other management roles to demonstrate leadership in their areas of responsibility.
Check the information security policy
The policy should be appropriate to the organisation's purpose, include information security objectives or provide the framework for setting them, include a commitment to satisfy applicable information security requirements, and include a commitment to continual improvement of the ISMS. It should be available as documented information, communicated within the organisation, and available to interested parties as appropriate.
Review roles, responsibilities and authorities
Check that management ensures the responsibilities and authorities for roles relevant to information security are assigned and communicated.
Review risk planning
When planning the ISMS, check that the organisation considers the issues referred to in the context of the organisation and the requirements of interested parties. It should determine the risks and opportunities that need to be addressed to ensure the ISMS can achieve its intended outcomes, prevent or reduce undesired effects, and achieve continual improvement. Check that the organisation plans actions to address these risks and opportunities, how to integrate and implement the actions into its ISMS processes, and how to evaluate the effectiveness of those actions.
Review how information security risks are assessed
Establish and maintain information security risk criteria, including criteria for accepting risk and criteria for performing information security risk assessments. Ensure repeated risk assessments produce consistent, valid and comparable results. Identify the risks associated with the loss of confidentiality, integrity and availability of information within the scope of the ISMS, and identify the risk owners. Analyse the risks by evaluating the potential consequences if they materialise, the realistic likelihood of occurrence, and the resulting levels of risk. Evaluate the risks by comparing the results of the analysis against the risk criteria, and prioritise them for risk treatment.
Review risk treatment
Select appropriate risk treatment options that take into account the results of the risk assessment. Determine all controls necessary to implement the chosen options, then compare them with the controls in Annex A to verify that no necessary controls have been omitted. Produce a Statement of Applicability that includes the necessary controls and the justification for their inclusion, whether implemented or not, and the justification for any exclusions of Annex A controls. Formulate a risk treatment plan, and obtain approval of the plan from the risk owners along with acceptance of the residual information security risks.
Review information security objectives
Establish information security objectives at relevant functions and levels. Objectives should be consistent with the information security policy; measurable where feasible; take into account applicable information security requirements and the results of risk assessment and treatment; be communicated; and be updated as appropriate. When planning how to achieve them, determine what will be done, what resources will be required, who will be responsible, when it will be completed, and how the results will be evaluated.
Review support and resources
Determine and provide the resources needed to establish, implement, maintain and continually improve the ISMS.
Review competence
Determine the necessary competence of persons doing work under the organisation's control that affects information security performance. Ensure these persons are competent on the basis of appropriate education, training or experience. Where applicable, take actions to acquire the necessary competence and evaluate the effectiveness of the actions taken. Retain appropriate documented information as evidence of competence.
Review awareness
Check that persons doing work under the organisation's control are aware of the information security policy.
Review operations, performance evaluation and improvement
Review how the organisation plans, implements and controls the processes needed to meet information security requirements; how it monitors, measures, analyses and evaluates information security performance; and how it addresses nonconformities and continually improves the ISMS. The checklist includes sections on operations, performance evaluation and improvement for this purpose.
Completing the audit
Use the completion section to record the audit results, then prepare and share your internal audit report.
Frequently Asked Questions
Still managing operations with paper and Excel?
Digitize inspections, audits, SOPs, and corrective actions.
Book A Personal Demo
Resources Under The Same Category
GAP Audit Part 4 - Storage and Transportation Checklist
Utilize this comprehensive storage and transportation inspection tool to identif...
View template →
Site Investigation Report Template
A comprehensive site investigation report template designed for qualified enviro...
View template →
Ladder Inspection Checklist (HSE)
This checklist supports compliance with the Work at Height Regulations 2005 (WAH...
View template →
Environmental Site Audit Checklist
This comprehensive environmental site audit checklist empowers construction team...
View template →
LEED IEQ Inspection Checklist – Tower Construction
Structured Indoor Environmental Quality (IEQ) assessment framework designed to v...
View template →
OpenView Equipment Return Form
This equipment return form helps organizations recover and document company asse...
View template →Ready to simplify inspections and get your team moving faster?
Start free today and turn inspections into a clear, consistent digital workflow. Prefer a guided walkthrough? Book a demo and see how flowdit can fit your team.