A.5.35 Audit Evidence Pack

What the auditor wants to verify

The auditor wants to confirm that the information security approach and implementation are independently reviewed at planned intervals and after significant changes, with findings reported and corrected.

Evidence to request

Strong evidence

• Independent review schedule defines scope, frequency, reviewer independence, criteria, and reporting route.
• Review records cover people, processes, technologies, ISMS approach, and implementation evidence.
• Supplementary review triggers are linked to change and incident management processes.
• Reviewer independence is documented and appropriate for the scope.
• Findings are tracked to corrective actions, owners, due dates, closure evidence, and effectiveness checks.
• Results are reported to management and considered in management review.

Weak evidence

• Security team reviews its own implementation without independence.
• Reviews happen only before certification audit.
• Major changes occur without supplementary review.
• Findings are recorded but not tracked to closure.
• Corrective actions are closed without effectiveness evidence.
• Management does not receive or act on review results.

Sample interview questions

• Who independently reviews the information security approach and implementation?
• How is independence confirmed for internal reviewers?
• What triggers a supplementary review?
• Show the latest independent review report and corrective actions.
• How were review results reported to management?

Common nonconformities

• Reviewers lack independence
• Review triggers are undefined
• Reviews focus only on documents
• Findings are not tracked to corrective action
• Results are not reported to management

Related notes

• A.5.35 Independent Review of Information Security
• Independent Information Security Review Plan and Report
• A.5.35 Audit Checklist