ISO 27001 Audit Checklist
A clause-by-clause audit checklist covering Clauses 4–10 of ISO/IEC 27001:2022 plus all 93 Annex A controls, to help you check your information security management system before your certification audit.
ISO 27001 Audit Checklist
ISO/IEC 27001:2022 clause audit checklist, Annex A controls checklist and gap analysis workbook (3 Excel files).
- 3 editable files · 3 Excel
- Instant download after payment, plus an email copy of your links
- Single-organisation licence: use across all your sites and staff
- 90-day money-back guarantee
See every file in the download (3)
- Internal Audit Checklist ClausesExcel
- Annex A Controls ChecklistExcel
- Gap AnalysisExcel
Try the checklist before you buy
Change the answers below to see how the Excel checklist in this download scores your answers and updates its dashboard.
Try the live audit dashboard
Change an answer below and watch the score, chart and readiness update instantly. This is a simplified version of the Excel checklist, which scores every question automatically.
The full Excel checklist scores all 123 questions automatically, with charts, a root-cause chart and a readiness dashboard.
Preview sample documents
Sample pages from the ISO 27001 Complete ISMS Toolkit, showing the structure and writing style. Only the files listed in the purchase box above are in this product.
Information Security Management System Manual
Section 6.1 — Actions to address risks and opportunities
6.1.2 Information security risk assessment
The organization runs a defined and repeatable process for assessing information security risk. The criteria for performing assessments and for accepting risk are set out in advance, so that repeated assessments give consistent and comparable results.
Risks to the confidentiality, integrity and availability of information within scope are identified. Each risk is given an owner, analysed for likelihood and consequence, and weighed against the acceptance criteria to set its priority for treatment.
6.1.3 Information security risk treatment
For each risk that needs treatment, a treatment option is selected — modify, retain, avoid or share — and the controls required to deliver it are determined. The chosen controls are checked against the reference set in Annex A to confirm nothing has been missed, and the outcome is captured in the Statement of Applicability.
Instant download · editable Excel · 90-day money-back guarantee
Why Use an ISO 27001 Checklist?
ISO 27001 is the international standard for information security management systems. Achieving certification requires demonstrating compliance across multiple clauses and a large set of Annex A controls. A structured checklist ensures your internal audits are thorough, repeatable, and produce the documented evidence that certification bodies expect.
Our checklist walks you through each clause from 4 to 10 (30 questions) and every Annex A control (93 questions), giving auditors a clear path through the standard.
What's Included
- 30 clause-by-clause audit questions covering Clauses 4 through 10
- Annex A controls checklist spanning all 93 controls across 4 themes
- Risk assessment and treatment questions (6.1.2, 6.1.3, 8.2 and 8.3), including producing the Statement of Applicability (the SoA workbook itself is in the complete ISMS toolkit)
- Audit result drop-down for each item (Conforms, Opportunity, Minor NC, Major NC, N/A) with automatic scoring and a dashboard sheet
- Space for recording objective evidence and corrective actions
- Gap analysis workbook with 123 rows (30 clause questions plus 93 Annex A controls)
How to Use This Checklist
- Define audit scope — identify which departments, processes, and information assets will be assessed
- Review the Statement of Applicability — confirm which Annex A controls are in scope before starting
- Work through each clause — follow the checklist systematically, gathering evidence at each step
- Assess Annex A controls — verify implementation effectiveness for every applicable control
- Record findings — classify each result and agree corrective actions where needed