ISO 27001 Internal Audit Checklist and Workbook (Free Excel Template)

Clause 9.2 of ISO/IEC 27001 requires organisations to conduct internal audits at planned intervals to confirm the information security management system (ISMS) conforms to the organisation's own requirements and to the standard, and that it is effectively implemented and maintained.

A good internal audit does more than satisfy an external auditor. It tests whether controls actually work, gives top management honest input for the management review (clause 9.3), and finds problems while they are still cheap to fix.

Clauses 4 to 10 are the mandatory management system requirements: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. Each of the 25 requirements in the workbook comes with an audit question written in plain English, so less experienced auditors know what good evidence looks like.

Annex A lists 93 reference controls grouped into four themes:

• Organisational controls: 37 (5.1 to 5.37)
• People controls: 8 (6.1 to 6.8)
• Physical controls: 14 (7.1 to 7.14)
• Technological controls: 34 (8.1 to 8.34)

Record whether each control is applicable in your Statement of Applicability, how well it is implemented, and the audit result. The dashboard turns those entries into coverage and conformity figures automatically.

Consistent grading is what makes an audit credible. The workbook uses the grading most certification bodies recognise:

• Major nonconformity: a requirement is not met at all, or a systemic failure undermines the ISMS's ability to achieve its intended outcomes.
• Minor nonconformity: a single or isolated lapse that does not, on its own, undermine the ISMS.
• Opportunity for improvement (OFI): not a nonconformity, but something that could be done better.

Every finding should be backed by objective evidence. The Findings & CAP tab prompts for it, along with the root cause, so corrective actions fix the cause rather than the symptom.

The 2022 revision restructured Annex A from 114 controls in 14 domains into 93 controls in four themes, merging many controls and adding 11 new ones, including threat intelligence, information security for cloud services, ICT readiness for business continuity, configuration management, data leakage prevention, monitoring activities and secure coding. The transition period for the 2013 edition ended on 31 October 2025, so audits should now be performed against the 2022 edition.

Control titles in the workbook are abbreviated for reference. Always audit against your licensed copy of the standard and your organisation's Statement of Applicability.