AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readFor ISMS owners and security leads who hold or are working toward accredited ISO/IEC 27001 certification and must evidence policy, awareness and document control at every audit.
30-day trialUnlimited free viewersNo credit card required
Checked against primary sources on 18 October 2026.
Any organization that chooses to run an information security management system and seek accredited certification, typically because customers, tenders or contracts ask for the certificate.
Auditors from accredited certification bodies; customers and partners then review the certificate, its scope and often the Statement of Applicability.
Two-stage initial certification audit, surveillance audits each year, recertification every three years
ISO/IEC 27001:2022 (Edition 3) with ISO/IEC 27001:2022/Amd 1:2024 Climate action changes, 2022-10-25 (Amd 1:2024 published 2024-02-23). Paid standard (CHF 155 for English PDF + ePub on the ISO Store; Amd 1:2024 listed at CHF 0).
| Date | What happens | Status |
|---|---|---|
| 2025-10-31 | Transition from ISO/IEC 27001:2013 ends; certification bodies must have moved all clients to the 2022 edition | Done |
| 2026-01-01 | Global Accreditation Cooperation Incorporated replaces IAF and ILAC as the international accreditation body | Done |
Each one needs an owner, an approval, and proof it reached the people it covers.
Clause 5.2
Top management sets a policy suited to the organization's purpose that frames security objectives, commits to meeting requirements and improvement, and is communicated internally.
Annex A 5.1
Topic-specific policies sit beneath the main policy; management approves and publishes them, relevant people receive and acknowledge them, and they are reviewed at planned intervals.
Clauses 6.1.2 and 8.2
Documented criteria for assessing and accepting information security risk, applied consistently, with results retained each time the assessment runs.
Clause 6.1.3
The SoA records which controls are necessary, why any are excluded and whether each is implemented; risk owners approve the treatment plan and residual risk.
Clause 7.3 and Annex A 6.3
People working under the organization's control know the policy, their contribution to the ISMS and the consequences of not conforming, with training kept current.
Annex A 5.37
Operating procedures for information processing facilities are documented and made available to the personnel who need them.
Citations are to the standard or regulation; wording is ours.
What reviewers sample about these documents and the people they cover.
Auditors sample the main and topic-specific policies and ask for management approval, the published version and records showing staff and relevant third parties acknowledged them.
They check that documented information is identified, reviewed, approved and versioned, that current versions are available where used and that obsolete versions are withdrawn.
Staff interviews test whether people know where policies live, what applies to their role and what happens if they do not follow them.
Auditors trace policies to the risk assessment and Statement of Applicability to confirm the documented controls match what is implemented.
Write each policy, send it through approval, and send it to the people it covers. Each acknowledgment is recorded by name, with the version, the date and the time.
When a policy changes, the new version is approved, its Editor sends it out again, and everyone it applies to is asked again. Export the record as a PDF or CSV, or give a reviewer Viewer access to the documents their tags allow.
Need help with the rest of ISO/IEC 27001? Find a consultant for your standard (opens in a new tab).
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
It added a requirement in clause 4.1 to determine whether climate change is a relevant issue, plus a note in 4.2 that interested parties can have climate-related requirements. IAF and ISO stated the intent of both clauses is unchanged, so no formal transition program applied.
The IAF MD 26 transition closed on 31 October 2025, and certification bodies had to move all clients to ISO/IEC 27001:2022 by then. Audits now run against the 2022 edition and its 93 Annex A controls.
Annex A control 5.1 calls for relevant personnel and interested parties to receive and acknowledge the policies that apply to them. Certification bodies such as TÜV NORD look for records showing who acknowledged which version.
The standard asks for review at planned intervals and when significant changes occur, without fixing a period. TÜV NORD suggests at least annual review as a practical baseline.
NQA asks for the management system to have run for at least three months, with a management review and a full internal audit cycle completed. Stage 1 then reviews ISMS design and Stage 2 tests operation and effectiveness.
Industries that hear about ISO/IEC 27001 most.
free for 30 days