A.6.4 Audit Checklist

When to use this

Use this checklist during an internal audit of disciplinary handling for information security policy violations.

Related controls

• A.6.4 Disciplinary Process
• A.6.4 Audit Evidence Pack
• Disciplinary Process Checklist
• Policy Violation and Disciplinary Action Register

Audit checklist

• Confirm disciplinary process is documented and communicated.
• Confirm security policy violations are covered.
• Confirm criteria define when action is triggered.
• Sample incidents/policy violations and test whether criteria were applied.
• Check whether sufficient evidence existed before action.
• Check proportionality and consistency of outcomes.
• Verify follow-up actions were completed.
• Confirm contractor or third-party violation route exists.
• Interview HR, legal, security, managers, and sampled personnel.
• Record nonconformities, observations, and improvement actions.

Findings table