A.5.5 Audit Checklist

When to use this

Use this during internal audits to test whether relevant authority contacts are identified, maintained, authorized, and usable.

Checklist

• Relevant authorities are identified from legal, regulatory, contractual, operational, and incident-response requirements.
• Authority contact register exists.
• Each contact has a defined purpose.
• Contact triggers are documented.
• Primary and backup liaisons are assigned.
• Communication approval requirements are defined.
• Disclosure rules prevent unauthorized sharing of sensitive information.
• Contact details are reviewed and updated periodically.
• Incident response or continuity plans reference authority contact steps.
• Contact paths are tested where practical.
• Records exist for actual authority communications, if any.
• Interviewed personnel know how authority contact is initiated.

Related notes

• A.5.5 Contact with Authorities
• A.5.5 Audit Evidence Pack
• Authority Contact Register