ISO 27001 audit questions checklist with evidence per role
An auditor does not only check whether you have documents. They check whether your information security management system (ISMS) works. This ISO 27001 audit questions list helps you prepare management, HR, IT and employees for an interview. The checklist follows ISO/IEC 27001:2022, the current edition of the international ISMS standard (ISO ).
Before your audit, create one file with the question, answer, evidence, owner and date of the last review. An identity provider (IdP) is the system that manages accounts and sign-ins. For that system, keep only the relevant log reference. Also use the internal audit as a trial run: ask a colleague to follow the same evidence route and note where searching or explaining gets stuck.
Start with the scope and the evidence route
Begin with a short scope map. Note services, locations, teams, systems, suppliers and exclusions. Then link each answer to a concrete artefact: a ticket, log, report, minutes or demonstration. A procedure without practice is a promise. A loose screenshot without context says little.
| Topic | Concrete question | Evidence to prepare | Owner |
|---|---|---|---|
| Scope | Which service and locations fall within the ISMS? | Scope statement, network or process overview | ISMS owner |
| Risks | Which risk did the last change create? | Risk register, decision and measure | Risk owner |
| SoA | Why does this control apply? | SoA with reference to risk and evidence | Security team |
| Access | Who recently lost access and how do you know? | Exit ticket, IdP log, sample check | HR/IT |
| Incidents | What happened in the last incident? | Record, timeline, evaluation | Incident owner |
| Suppliers | How do you check a critical supplier? | Assessment, contract, report | Supplier owner |
Questions per role
Management
The auditor wants to know whether security is steered at board level. Prepare answers to: “Which information security objectives have you set this year?”, “Which resources have been made available?” and “What decision did you make following the last management review?”
Show policy, objectives, the management review and a decision on budget or priority. A good manager does not need to recite technical terms. They must be able to explain which risk the organisation accepts and when management has adjusted course.
ISMS owner or security manager
Expect questions such as: “How have risks been assessed?”, “How do you track the status of controls?” and “How do you know a control is effective?” Show the risk register, the treatment plan, the current Statement of Applicability (SoA), audit findings and improvement actions.
Choose one risk and tell the whole story: cause, impact, owner, control, residual risk and latest evaluation. That is more convincing than ten separate policy documents.
HR and line managers
The auditor might ask: “How is information security covered when someone starts work?”, “What happens when someone changes role?” and “How do you manage departures?” Prepare an HR process, a training record and three anonymised examples. Link a leaver notification to blocking accounts and checking for remaining access.
IT, administrators and engineers
Prepare for questions such as: “How is production access granted?”, “How do you know which patches are outstanding?” and “What happens if a backup cannot be restored?” Show change tickets, access requests, vulnerability scans, patch reports, backup tests and monitoring alerts. Show only a safe demonstration; an auditor does not need unrestricted administrator rights.
Employees
An auditor may ask: “What do you do with a suspicious email?”, “Where do you report an incident?” and “How do you request access?” Inform employees about the purpose of the audit, but do not give them rehearsed answers. An honest answer with a visible reporting route is better than a perfect sentence without practical evidence.
Example: a developer who leaves
Fictional example: Rivierdata. A developer leaves the organisation on Friday. On Monday, the auditor asks how access was withdrawn. HR shows the exit ticket with the end time, IT shows the IdP log, the development team shows that the temporary cloud role has been removed, and the security team shows a sample in which the account no longer appears. The only missing step is revoking an old deploy token. This is recorded as a nonconformity with an owner and a deadline. This openness makes the control credible.
Create one “evidence index” with document name, owner, date and a link to the source. Do not delete audit evidence because one example is not perfect. Record the correction and the effectiveness check instead.
Targeted check before the audit
Ask an independent colleague to draw five questions from the matrix. Do not measure how quickly someone answers, but whether the evidence is traceable and up to date. Then check that the date of the last review, the owner and the action are filled in for every missing item. The external audit remains an assessment by the certification body. This exercise is your own working method.
Frequently asked questions
Will I get a fixed list of questions in advance?
Usually not. The auditor uses the standard, the scope and the risks as a starting point and follows the evidence. Therefore, work with themes and examples, not a script.
Do I need to print all documents?
No. A digital evidence index works well, as long as access rights, versions and permissions are properly managed. Make sure you can open the source quickly during the conversation.
What do I do if evidence is missing?
Say so honestly, record the cause and show a concrete corrective action. Do not create a record after the fact as if it already existed.