This checklist follows the ISO 27001:2022 clauses and all 93 Annex A controls, with the controls also split by theme.
Prepared using the F-Q2 Audit Checklist form template.
The files are supplied in fully editable MS Word format and can be easily customised, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Checklist number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested audit checklists. No junk, jargon or unnecessary questions. Simple and usable audit checklists
developed over 25 years through practical use in the real world.
Further guidance on internal auditing and ISO 27001:
Download these audit checklists with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to these files please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. These checklists are also included in the ISO 27001 Toolkit and the integrated toolkits that include ISO 27001, so the toolkit route gives you these files plus everything else you need in one download.
If you'd like hands-on help completing your internal audits or training your internal auditors, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
ISO 27001:2022 Internal Audit Checklist Template
Internal audit checklists for ISO 27001:2022, covering the full clauses, the documentation the standard requires, and the Annex A controls. It is set out on the F-Q2 Audit Checklist format, with the scope, criteria, auditor and date recorded at the top and space against each clause to record the evidence viewed, responses and findings.
The Annex A controls come as one checklist covering all 93 controls, and as separate checklists for the organisational, people, physical and technological themes, so the controls can be audited in smaller parts across the year.
Note: ISO clause checklists only include the clause numbers and short prompts for each clause (due to copyright reasons) and therefore a full version of the ISO standard is required to be used in conjunction with these checklists.
What the Checklists Cover
- Context (clause 4) - issues, interested parties, scope and the information security management system
- Leadership (clause 5) - leadership and commitment, the information security policy and roles
- Planning (clause 6) - risks and opportunities, information security risk assessment and treatment, the statement of applicability and objectives, and planning of changes
- Support (clause 7) - resources, competence, awareness, communication and documented information
- Operation (clause 8) - operational planning and control, and information security risk assessment and treatment carried out
- Performance evaluation (clause 9) - monitoring, measurement, analysis and evaluation, internal audit and management review
- Improvement (clause 10) - nonconformity and corrective action, and continual improvement
- Documentation - the mandatory documents and records
- Annex A, all controls - the 93 controls in one checklist
- Organisational controls - the 37 organisational controls (A.5)
- People controls - the 8 people controls (A.6)
- Physical controls - the 14 physical controls (A.7)
- Technological controls - the 34 technological controls (A.8)
Using the Checklists
Use the full clause checklist to audit the management system, and the Annex A checklists to check that the controls in the statement of applicability are in place and working. The theme checklists let the controls be shared between auditors or spread across the audit programme, and the documentation checklist is a quick check before a certification audit.
Planning the Audit
Have the statement of applicability, the information security risk register and risk treatment plan, and the record of the last management review to hand, along with the standard itself, and arrange time with whoever manages the IT systems for the technological controls.
Completed Example
A completed example of the ISO 27001:2022 checklist is available with an alphaZ Subscription.
Included in the ISO 27001 Toolkit
These checklists are part of the ISO 27001 Toolkit and the integrated toolkits that include ISO 27001.
Related Documents
Documents that work alongside these checklists:
Would you rather we did it for you?
Our Internal Audit Training and Support service works through your internal audits with you while training your own people as internal auditors, so the audits are completed and the skills stay in the business.
Internal Audit Training and Support