Audit approach based on ISO/IEC 27001
The audit approach
An ISO/IEC 27001 audit tests the ISMS's conformity and effectiveness using a process-based, risk-based approach. Start from the audit programme and plan; evaluate Clauses 4-10 and the controls selected in the SoA. Evidence should be triangulated: interview what people say, observe what happens, and review records and documents. Effectiveness means the control is applied consistently and achieves its intended outcome, not that a procedure exists.
Core rules
- Audit the risk assessment and treatment process, not only the risk register output. Test whether risks are identified, analysed, evaluated and treated.
- Use the SoA to select control samples. Follow the process end to end: input, activity, output, owner, record.
- Sample across sites, shifts, systems and time. Higher-risk processes need stronger coverage.
- Internal audit under Clause 9.2 must be planned, conducted by competent auditors and reported; results feed management review under Clause 9.3.
- Audit trails should let another person reconstruct what was tested and why.
Worked example
For access control, the auditor reads A.5.18 and the organisation's procedure, which requires quarterly access reviews. They interview the system owner, observe the review workflow, and sample four quarters. Records exist for Q1 and Q2 but not Q3 or Q4. The auditor does not conclude that access control is effective from the procedure alone; the control was not performed at the required frequency. The finding cites A.5.18, the procedure and the missing records, and notes the sample.
Traps
Do not audit against a generic checklist instead of the SoA and criteria. Do not accept a policy as proof of operation. Do not ignore outsourced or cloud processes at the ISMS boundary. Do not sample only the most convenient records.