Define the audit scope and objectives 
Decide what you’re auditing and why. Is it a full ISMS review or a specific department, process, or control set? If you’re not sure what your ISMS includes, start with our ISO 27001 implementation guide.

Assign a qualified internal auditor 
The auditor must understand ISO 27001 and not be auditing their own work. They should be impartial and competent.

Gather documentation and records
Collect all relevant documents including:

– ISMS scope
– Policies and procedures
– Statement of Applicability (SoA)
– Risk assessments
– Incident logs
– Training records

Conduct interviews and evidence checks 
Interview relevant staff to check awareness and practical application. Cross-check documentation against reality.

Record nonconformities
Identify any gaps between documented controls and actual practice. Classify findings as:

– Major nonconformities
– Minor nonconformities
– Observations or opportunities for improvement

Create an internal audit report
Summarise:

– What was audited
– Who was involved
– Findings and evidence
– Recommendations and improvement areas Share the report with ISMS owners and management.

Implement corrective actions

– Assign owners for each issue
– Agree on corrective timelines
– Track actions to closure
– Validate effectiveness before closing the audit

Undefined ISMS scope 

Your ISMS scope defines the boundaries of your information security management system. If you leave out a key location, system, or supplier, you create a blind spot that auditors will treat as a serious issue.

Example: A UK tech startup documented its scope as “Head office IT systems.” During the audit, the assessor discovered that a third-party cloud provider hosted customer data, but wasn’t included. This omission was flagged as a major nonconformity.

How to avoid it: 

– Document all systems, processes, and third parties that handle information.
– Make exclusions explicit and justifiable.
– Cross-check your scope against your GDPR processing activities to ensure personal data is covered

Weak risk assessments 

Risk assessment is the backbone of ISO 27001. If your risk register is vague or doesn’t reflect real-world threats, auditors will assume your ISMS isn’t protecting your business effectively.

Example: A digital agency used a boilerplate risk register that listed “cyber attack” but ignored hybrid working risks. Employees were regularly using personal devices, yet this wasn’t assessed. The auditor concluded the risk assessment didn’t match the organisation’s actual operations.

How to avoid it: 

– Tailor risks to your organisation (e.g. remote access, supply chain, phishing).
– Update assessments annually, or after major changes.
– Involve multiple stakeholders so risks reflect business-wide perspectives.

Unimplemented controls

Your Statement of Applicability (SoA) lists which Annex A controls you’ve chosen and why. Auditors will check that you’re not only claiming these controls but also implementing them.

Example: A logistics company’s Statement of Applicability (SoA) said backups were tested regularly. In reality, no restore tests had been documented. The control existed on paper only.

How to avoid it:

– Link every control to a documented risk.
– Keep evidence (logs, reports, screenshots) that show controls are functioning.
– Review the SoA regularly to confirm it reflects actual practice.

Missing or poor documentation 

ISO 27001 relies heavily on evidence. Missing or outdated documents leave auditors with no proof that your ISMS works as intended.

Example: A growing SME had strong processes but couldn’t provide a current risk treatment plan. Without this document, the auditor couldn’t verify that risks were being tracked and addressed.

How to avoid it: 

– Keep a central document repository for all ISMS materials.
– Review policies and plans at least annually.
– Archive outdated versions but make sure the current version is easy to find.

Lack of training records 

Auditors often test ISMS effectiveness by interviewing staff. If employees aren’t aware of policies or can’t answer basic security questions, it signals a weak security culture. Missing training records compound the problem.

Example: A UK SME delivered ISMS awareness training but failed to record attendance. When the auditor asked for proof, there was none. This resulted in a minor nonconformity.

How to avoid it:

– Schedule annual refresher sessions.
– Maintain a training log with dates, attendees, and outcomes.
– Consider gamified or interactive training to improve engagement.

Neglecting internal audits 

Clause 9.2 of ISO 27001 requires planned internal audits. If you don’t run them, or you fail to record findings, auditors will question your ability to self-monitor.

Example: A small UK manufacturer completed only one internal audit in three years. The certification body flagged this as a nonconformity because internal audits should occur at least annually.

How to avoid it: 

– Plan internal audits every 12 months (or more frequently in high-risk areas).
– Use an independent internal auditor where possible.
– Document scope, findings, corrective actions, and close-out.

Set Up an Audit Folder 

Why it matters: 
Auditors often have limited time. If evidence is scattered across email chains, file servers, and personal laptops, you’ll waste time retrieving it — and auditors may question your organisation.

How to implement:

– Create a single digital or physical folder (e.g. “ISMS Audit Evidence 2025”).
– Include key documents: ISMS scope, policies, SoA, risk assessments, incident logs, training records, and audit reports.
– Use version control so auditors always see the latest documents.

Pro tip: A cloud-based repository (SharePoint, Google Drive) ensures version history and easier collaboration. 

Nominate an Audit Lead 

Why it matters: 
Auditors value clear communication. Having one person coordinate responses avoids confusion and ensures queries don’t fall through the cracks.

How to implement: 

– Appoint a manager or ISMS coordinator as the main point of contact.
– Brief them on the ISMS in detail so they can confidently answer high-level questions.
– Ensure they have access rights to all relevant records.

Map controls to risks

Why it matters: 
ISO 27001 is risk-based. Auditors expect to see why each control exists, not just that it’s in place. Mapping controls to risks makes this link crystal clear.

How to implement: 

– Take your risk register and align it with the Statement of Applicability.
– For each risk, note the relevant Annex A control(s).
– Keep a simple matrix or table to show auditors how risks are managed.

Train your team

Why it matters: 
Auditors often interview staff at random. If employees don’t understand their role in the ISMS, it undermines the effectiveness of your security management.

How to implement:

– Deliver a 1-hour ISMS awareness refresher before the audit.
– Cover basics: data handling, incident reporting, access control.
– Document attendance.
– Consider gamified training or quizzes to make it engaging.

Example: Reception staff should know visitor log procedures; IT staff should be able to describe how incidents are escalated.

Run a Mock Audit

Why it matters: 
Dry runs uncover gaps before the real auditor does. They also help staff feel more comfortable under questioning.

How to implement (Mock Audit Guide): 

1. Appoint an internal or external consultant to act as an auditor.
2. Prepare a list of typical auditor questions (e.g. “How do you handle a suspected phishing incident?”).
3. Interview staff and test evidence.
4. Record findings in a report, then implement corrective actions.

Pro tip: Use this as an opportunity to stress-test your incident response — simulate a breach scenario and see how teams react.

Review past findings 

Why it matters: 
Auditors always check whether you’ve addressed previous nonconformities. If you haven’t, it can escalate into a bigger issue.

How to implement: 

– Keep a log of all past audit findings.
– Document corrective actions with owners and deadlines.
– Close the loop by evidencing completion (e.g. updated policy, new log entries).

Clean up access rights 

Why it matters: 
Access control is a cornerstone of ISO 27001. Outdated user accounts or shared logins are a red flag for auditors.

How to implement:

– Review user accounts quarterly.
– Remove expired or inactive accounts.
– Eliminate shared passwords — move to password managers or single sign-on (SSO).
– Keep evidence of reviews (e.g. screenshots of user deactivation logs).