Guide · 7 min read
Evidence that passes an ISO 27001 audit
What ISO 27001 auditors accept as evidence: system-generated records, dated approvals, complete populations and corrective actions that are verified, plus common evidence that fails.
ISO 27001 audits are rarely failed on the big things. They are failed on evidence: a policy nobody approved, a review with no date, a screenshot that could have come from anywhere. The good news is that evidence habits are easy to build once you know what auditors look for.
What makes evidence credible
- It comes from the system. An export or report from the tool beats a spreadsheet someone typed up.
- It is dated and attributable. Who did it, and when? A signed review with no date can't be placed in the audit period.
- It covers the period. One example from last week doesn't prove a quarterly control ran all year.
- It is complete. If you give a sample, the auditor will ask for the population it came from.
Evidence that commonly fails
- A policy marked "draft" or approved years ago with no review since. Clause 5.2 expects top management to approve it.
- A risk assessment that hasn't been updated after a major change, such as a cloud migration.
- Change records approved after the change went live.
- Training records that cover employees but not contractors.
- Corrective actions marked closed with no proof that the fix works.
Do the internal audit properly
Clause 9.2 is where many organisations make life hard for themselves. An internal audit that only covers comfortable areas, or is done by people auditing their own work, gives false comfort, and the certification auditor will often sample your internal audit to see how thorough it was. Plan it on risk, pick samples at random from complete populations, judge evidence against the requirement, and grade findings honestly.
Close findings with proof
Clause 10.2 asks you to fix the cause, not just the symptom, and to check the fix worked. For each nonconformity, record the root cause, the action, an owner and a date. Then re-test: if late leaver removals were the problem, take a fresh sample after the fix and show it is clean.
Small habits that make audits calm
- Keep an evidence calendar: which control produces which record, and when.
- Save the report parameters with every extract.
- Store evidence in one place, named by control, with the period in the file name.
- Run a mini pre-audit two months before the real one, on the controls that failed last time.
Auditors are not looking for perfection. They are looking for a system that notices its own problems and fixes them. Good evidence is how you show that.