An ISO/IEC 27001 auditor asks for proof that your management system exists and runs: a defined scope, an information security policy, risk assessment and treatment records, a Statement of Applicability, internal audit results, management review minutes, and corrective actions. They also sample real operations to see that your written controls match what people do.
Why does evidence beat policy?
ISO describes a management system that applies a risk process and gives "confidence to interested parties that risks are adequately managed". Confidence needs records. A policy that nobody follows fails the audit even when it reads well, and a working control with no record is hard to defend.
A note on sources: the standard's text is paid, and we did not reproduce it. The clause numbers below follow the 2022 edition structure and you should confirm each against your licensed copy before you build a checklist from this post.
Which records tie to which clauses?
Think of the audit as seven questions, each with its own paper trail.
Does the organization know its context and scope? (clause 4) Expect the scope statement with boundaries, plus the list of interested parties and their requirements.
Is leadership involved? (clause 5) The information security policy, role assignments, and proof it was communicated.
Is risk handled properly? (clause 6) This is where most auditor time goes. Bring the risk assessment method, the completed risk register, the risk treatment plan, the risk owners' sign-off, and the Statement of Applicability. The Statement of Applicability lists which Annex A controls you apply, which you exclude, and why. Expect questions about every exclusion.
Do people have what they need? (clause 7) Competence records such as training and role descriptions, awareness evidence, and your document control approach.
Do the controls actually run? (clause 8) Results of risk assessments and risk treatment, plus operational evidence for the controls you chose. This is the section where the audit moves from documents to samples.
Do you measure it? (clause 9) Monitoring and measurement results, the internal audit programme and reports, and management review minutes showing decisions, not just attendance.
Do you fix what breaks? (clause 10) Nonconformity records, root causes, corrective actions and proof they were closed.
What does operational evidence look like?
For each control in the Statement of Applicability, expect the auditor to pick a sample and ask to see it working. A few examples, all of them things you should be able to produce in minutes:
- Access review: the last quarterly review, who approved removals, and a leaver whose access was removed on time.
- Change management: a recent production change with its approval and test record.
- Vulnerability management: a scan report, the ticket for a high finding, and the closing evidence.
- Supplier management: a supplier assessment and the contract clause covering security.
- Incident handling: a real or exercised incident with the timeline and lessons learned.
- Backup and recovery: a restore test result, not just the schedule.
For software teams, an SBOM and dependency scan history can support the vulnerability and supplier items. They are supporting evidence for specific controls, not a certification of anything.
Where do audits usually stall?
Often the problem is not missing paper but mismatches between documents. The risk register names assets that the scope excludes. The Statement of Applicability says a control is implemented while the sampled evidence is a draft. The internal audit happened but no one acted on its findings. Treat these as consistency checks you run on yourself first.
What to do
- Write the scope statement and confirm it matches your asset inventory.
- Build one risk register and link each treatment to a control in the Statement of Applicability.
- For every applicable control, name an evidence owner and a place the proof lives.
- Run an internal audit before the external one and log findings as nonconformities.
- Hold a management review with minutes that record decisions.
- Do a dry-run: pick ten controls at random and produce their evidence in under ten minutes each.
- Refer to your result as "certified to ISO/IEC 27001:2022" only after an audit says so, and name the certification body.
Quick check
Do I need to be certified to follow ISO/IEC 27001?
No. ISO says organizations can decide whether to go through certification. Some implement the standard for its practices alone.
Does a tool make me ISO 27001 compliant?
No tool certifies you. Tools can collect and organize evidence, but an accredited audit body decides certification.
Sources
Last reviewed: 18 October 2026.
