An ISO/IEC 27001:2022 internal audit tests two things: whether the information security management system (ISMS) meets the management clauses 4 to 10, and whether the Annex A controls the company selected are in place and working. The Statement of Applicability is your map for the second part.
Last reviewed: 17 October 2026. Facts checked. This guide follows the published structure of ISO/IEC 27001:2022, including the four themes of Annex A (93 controls, replacing the 114 in the 2013 edition, as confirmed against several compliance-vendor summaries rather than the standard itself). The standard is a paid document, so we have not reproduced control wording. Check the current edition, any amendments, and your certification body's transition rules before you audit.
What an ISMS is
An ISMS is a system of policies, risk assessments, controls and records that a company uses to protect the confidentiality, integrity and availability of information. Confidentiality means only the right people see it. Integrity means it is accurate. Availability means it can be used when needed.
ISO/IEC 27001:2022 is the 2022 edition of the standard. It replaced the 2013 edition, and certificates to the 2013 edition had a transition period set by the accreditation community. If you meet a 2013-based document, check it has been updated.
Part 1: Audit the management clauses (4 to 10)
These follow the same ten-clause layout as other ISO management system standards.
| Clause | What to check |
|---|---|
| 4 Context | Issues, interested parties, ISMS scope and boundaries |
| 5 Leadership | Information security policy, roles and authorities, management commitment |
| 6 Planning | Risk assessment and treatment, the Statement of Applicability, security objectives, planned changes |
| 7 Support | Resources, competence, awareness, communication, documented information |
| 8 Operation | Risk assessment and treatment carried out as planned |
| 9 Performance evaluation | Monitoring, internal audit (9.2), management review (9.3) |
| 10 Improvement | Nonconformity, corrective action, continual improvement |
Clause 6.1.3 matters most. The company must choose controls to treat its risks, compare them against Annex A, and document the result in a Statement of Applicability (SoA). Ask to see the risk assessment first. Controls should follow the risks, not the other way round.
The Statement of Applicability
The SoA lists the Annex A controls, says whether each is included, why, and whether it is implemented. As auditor:
- Check every control is addressed, with a reason for any exclusion.
- Check "implemented" claims against evidence.
- Check the SoA links back to the risk treatment plan.
- Check version and approval.
Part 2: Audit the Annex A controls
ISO/IEC 27001:2022 Annex A has 93 controls in four themes. The 2013 edition had 114 controls in 14 groups. The 2022 edition reorganised and merged them and added some new ones.
| Theme | Number of controls | Examples of what you test |
|---|---|---|
| Organisational | 37 | Policies, roles, asset inventory, access control rules, supplier security, incident management, business continuity, legal and compliance |
| People | 8 | Screening, terms of employment, awareness and training, remote working, reporting events |
| Physical | 14 | Secure areas, entry controls, equipment protection, clear desk, media handling |
| Technological | 34 | User endpoints, privileged access, malware protection, backup, logging, network security, secure development, data masking |
Do not test all 93 in one pass. Use a risk-based sample across the audit programme, and make sure the programme covers every applicable control over its cycle.
Evidence to ask for
- Access control: the access rights list, joiner and leaver records, privileged account review.
- Asset management: an asset inventory with owners.
- Supplier security: supplier assessments and contract clauses.
- Incident management: the incident log and one worked incident.
- Backup: a restore test record, not only a backup schedule.
- Logging and monitoring: sample logs and proof someone reads them.
- Awareness: training attendance and test results.
- Business continuity: the plan and an exercise record.
Technical controls often need a specialist. If your auditors are not technical, bring someone who is, or ask IT to demonstrate while you watch. For a related view of controls, see our ITGC audit guide.
Typical findings
- Risk assessment done once and not reviewed.
- SoA says "implemented" but no evidence.
- Leavers keep access longer than policy allows.
- Internal audit programme skips parts of the scope.
- Management review misses required inputs.
India angle
Indian companies often pair ISO/IEC 27001 with data protection duties. The Digital Personal Data Protection Act, 2023 is a separate law. A 27001 certificate does not by itself prove compliance with it. See our DPDP audit readiness checklist.
Frequently Asked Questions
How many controls are in Annex A of ISO/IEC 27001:2022?
93, grouped into four themes: organisational, people, physical and technological.
Does a company have to implement all Annex A controls?
No. It must consider them, decide which apply using its risk assessment, and justify any exclusions in the Statement of Applicability. It may also add controls from other sources.
Who can do the internal audit?
Someone competent and impartial. They must not audit their own work. In a small company, an outside consultant can do it.
How often should an ISMS be audited internally?
At planned intervals, as set in your audit programme. The standard does not fix a number, so base it on risk and past results.
Is ISO 27001 the same as SOC 2?
No. ISO/IEC 27001 is a certifiable standard for an ISMS. SOC 2 is an attestation report from a CPA firm against trust services criteria. They overlap but differ.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error