Governance · 8 min read

Auditing an ISMS against ISO 27001: from scope to evidence

An effective ISO 27001 audit is not a document scavenger hunt. It tests whether the organization understands its information risks, operates its chosen controls, and learns when those controls do not work as intended.

Published Oct 12, 2026 · By InfoSec Consult

Start with the audit trail

Begin with the ISMS scope and risk methodology, then follow a small number of material risks through the complete management cycle. This exposes disconnected documents quickly: a risk register that does not influence controls, a Statement of Applicability that is not understood by owners, or a corrective action process that closes findings without verifying effectiveness.

Practical audit tests

Confirm the ISMS scope, interested parties, interfaces, exclusions, and business context before selecting samples.
Trace significant risks from assessment through treatment, control ownership, evidence, residual risk, and management acceptance.
Test both control design and operation: a policy is not evidence that a control was performed or effective.
Sample across locations, systems, suppliers, teams, and time periods so the audit does not only test the easiest evidence.
Interview control owners and users, then corroborate answers with tickets, logs, access reviews, training records, and change history.
Record findings against clear criteria, objective evidence, impact, and agreed corrective action rather than vague observations.

What good evidence looks like

Good evidence is attributable, dated, reproducible, and linked to a requirement or risk. A screenshot without context is weak; a system record showing the owner, population, approval, exception handling, and completion date is stronger. Always distinguish evidence that a process exists from evidence that it achieved its intended result.

Close the learning loop

Findings should produce owners, due dates, root-cause analysis, interim risk treatment, and a follow-up test. Management review should see trends and recurring causes, not only a count of open actions. That is how audit becomes an improvement mechanism for the ISMS.

Scope note: Use the current published ISO 27001 requirements and your certification body's rules as the authoritative criteria. This article is practical guidance, not certification advice.