| File Reference : | A-C_ISO27001 |
| Date File Updated | 05-10-26 |
| File Format | MS Word, pdf |
| No. of files | 5 |
| Category | ISO Checklists | Tags: ISO 27001, 9.2, IMS1 5.3 |
Included in the alphaZ subscription
Every alphaZ document and toolkit, with updates as they are released. Everything you download is yours to keep.
This checklist follows the ISO 27001:2013 clauses and Annex A controls, with a separate documentation checklist.
Prepared using the F-Q2 Audit Checklist form template.
The files are supplied in fully editable MS Word format and can be easily customised, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Checklist number and title
- Information-classification
- Version
- Page number / total pages
Further guidance on internal auditing and ISO 27001:
Download these audit checklists with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.
These files are included in the alphaZ subscription.
If you'd like hands-on help completing your internal audits or training your internal auditors, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
ISO 27001:2013 Internal Audit Checklist Template
Internal audit checklists for ISO 27001:2013: a full clause checklist working through clauses 4 to 10, a checklist for the Annex A controls of the 2013 edition, and a checklist of the documents and records the standard requires. It is set out on the F-Q2 Audit Checklist format, with the scope, criteria, auditor and date recorded at the top and space against each clause to record the evidence viewed, responses and findings.
The 2022 edition of ISO 27001 replaced the 2013 edition. The ISO 27001:2022 Requirements Checklists follow the current clauses and the 93 Annex A controls.
Note: ISO clause checklists only include the clause numbers and short prompts for each clause (due to copyright reasons) and therefore a full version of the ISO standard is required to be used in conjunction with these checklists.
What the Checklists Cover
- Context (clause 4) - issues, interested parties, scope and the information security management system
- Leadership (clause 5) - leadership and commitment, the information security policy and roles
- Planning (clause 6) - risks and opportunities, information security risk assessment and treatment, the statement of applicability and objectives
- Support (clause 7) - resources, competence, awareness, communication and documented information
- Operation (clause 8) - operational planning and control, and information security risk assessment and treatment carried out
- Performance evaluation (clause 9) - monitoring, measurement, analysis and evaluation, internal audit and management review
- Improvement (clause 10) - nonconformity and corrective action, and continual improvement
- Annex A controls - the 114 controls of the 2013 edition, from information security policies (A.5) to compliance (A.18)
- Documentation - the mandatory documents and records
Using the Checklists
These checklists are useful where controls are still mapped to the 2013 Annex A, for example when comparing an existing statement of applicability with the 2022 controls. Record the scope and criteria at the top, then work through each clause and control, noting the evidence viewed and any findings.
Planning the Audit
Have the statement of applicability, the information security risk register and risk treatment plan, and the record of the last management review to hand, along with the standard itself, and arrange time with whoever manages the IT systems for the technical controls.
Annex A Controls
The Annex A checklist lists each control objective and control of the 2013 edition, with space for the evidence against each one, so the controls in a statement of applicability can be checked one by one.
Completed Example
A completed example of the ISO 27001:2013 checklist is available with an alphaZ Subscription.
Related Documents
Documents that work alongside these checklists:
Would you rather we did it for you?
Our Internal Audit Training and Support service works through your internal audits with you while training your own people as internal auditors, so the audits are completed and the skills stay in the business.
