This checklist checks the information security policy and awareness, and that the statement of applicability covers every Annex A control with a justification.

Effective Audit Checklists

Prepared using the F-Q2A Audit Checklist form template.

The file is supplied in fully editable MS Word format and can be easily customised, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Checklist number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested audit checklists. No junk, jargon or unnecessary questions. Simple and usable audit checklists developed over 25 years through practical use in the real world.

Further Reading

Further guidance on information security and internal auditing:

• ISO 27001 Clause 5.2 - Information Security Policy
• Information Security Awareness and Training
• ISO 27001 knowledge base
• Internal Auditing knowledge base

Logo Update Service

Download this audit checklist template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription. This checklist is also included in the ISO 9001, ISO 14001, ISO 45001, ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them, so the toolkit route gives you this file plus everything else you need in one download.

Need Help Implementing?

If you'd like hands-on help completing your internal audits or training your internal auditors, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Information Security Commitment Audit Checklist Template

A process audit checklist for auditing commitment to information security management: the information security policy, how awareness is communicated, and the statement of applicability for the ISO 27001 Annex A controls. It is set out on the F-Q2A Audit Checklist format, with the scope, criteria, site, participants, auditor and date recorded at the top, and each question alongside the auditee and the evidence viewed, response and findings.

Questions Covered

• Whether there is an information security policy, and when it was last reviewed
• How information security awareness is communicated within the organisation
• Whether there is a statement of applicability covering all the Annex A controls in ISO 27001
• Whether the statement of applicability shows, for each control, whether it is included and the justification for including or excluding it

Carrying Out the Audit

Check a few controls on the statement of applicability against what is actually in place, including at least one that has been excluded, to see whether the justification still holds. Asking a few people about the information security policy, and how they would report an incident, shows whether awareness has reached them.

Planning the Audit

Have the information security policy, the statement of applicability and any awareness or training records to hand. If the statement of applicability has changed since the last audit, ask what prompted the change.

Who Should Carry Out the Audit?

Anyone trained in internal auditing who is independent of the area being audited. The questions are written in plain language, so the checklist also works well for training new internal auditors.

Included in the ISO Toolkits

This checklist is part of the ISO 9001 Toolkit and is also included in the ISO 14001, ISO 45001, ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them.

Related Documents

Documents that work alongside this checklist:

• P-20 Information Security Policy
• F-IMS26 Statement of Applicability
• PP-8-100 Information Security Policy Procedure
• P-35 Information Security Awareness Policy

Part of the Process Audit Checklists

This is one of the alphaZ process audit checklists, each covering a single area of the management system, so audits can be spread across the year using the ER11 Audit Schedule. The completed checklist becomes the record of the audit, and the results can be written up using the F-Q31 Audit Report.

Adapting the Checklist

The questions can be edited, added to or removed to suit the way the organisation works, and the scope and criteria at the top changed to match the area being audited. Because every alphaZ audit checklist uses the same F-Q2A layout, audit records look the same whichever area was audited, which makes them easier to review and compare.

Using the Findings

Controls that are not in place as the statement of applicability says, or gaps in awareness, are raised as actions and the statement is updated where needed.