A.5.27 Audit Evidence Pack

What the auditor wants to verify

The auditor wants to confirm that knowledge from incidents is captured and used to improve controls, procedures, awareness, risk treatment, and the ISMS.

Evidence to request

Strong evidence

• Post-incident review records identify root causes and control failures.
• Corrective actions are tracked to closure with evidence.
• Lessons update procedures, controls, risk assessments, training, or supplier controls.
• Anonymized examples are used in awareness where appropriate.
• Incident trends are reported to management review.

Weak evidence

• Lessons learned meeting held but no actions recorded.
• Corrective actions closed without evidence.
• Training uses generic examples unrelated to actual incidents.
• No link to risk assessment or control improvement.
• The organization claims no incidents but has no event reporting evidence.

Sample interview questions

• Show a post-incident review and the actions created from it.
• How did the incident change controls, procedures, training, or risk treatment?
• How are recurring minor incidents reviewed?
• How are lessons reported to management review?
• What evidence proves corrective actions were completed?

Common nonconformities

• Post-incident reviews are skipped after service restoration.
• Root cause stops at human error.
• Actions are not owned or tracked.
• The same incident repeats with no control change.
• Management never sees incident trends.

Related notes

• A.5.27 Learning from Information Security Incidents
• Incident Lessons Learned Register
• A.5.27 Audit Checklist