ISO 27001 internal audit checklist: free Excel template

By the NexoDocs Team · how we make and check our content

Internal audit is mandatory in ISO/IEC 27001:2022 (clause 9.2): the organization must audit its ISMS at planned intervals, with a defined program, criteria and scope, objective and impartial auditors, results reported to management and evidence retained. A checklist organizes that work: one row per requirement of clauses 4 to 10 and per applicable Annex A control, with what to verify, the evidence reviewed, the result (conforming, major or minor nonconformity, observation or opportunity for improvement) and the finding. You can download a reduced version of our toolkit's checklist for free below.

What the standard requires for internal audit

Clause 9.2 of ISO/IEC 27001:2022 has two parts. 9.2.1 requires audits to check that the ISMS meets the organization's own requirements and those of the standard, and that it is effectively implemented and maintained. 9.2.2 requires an audit program (frequency, methods, responsibilities, planning and reporting requirements) that takes into account the importance of the processes and the results of previous audits.

Define the criteria and scope of each audit.
Select auditors who ensure objectivity and impartiality (nobody audits their own work).
Report the results to relevant management.
Retain documented information as evidence of the program and the results.

ISO 19011 gives general guidelines for auditing management systems and is a good reference for method (sampling, interviews, writing findings).

Program, plan, checklist and report: what each one is

Document	What it is for	When it is used
Audit program	Annual or multi-year schedule: which processes are audited, when and with what priority.	At the start of the cycle; reviewed every year.
Audit plan	Details of one audit: scope, criteria, agenda, auditors and interviewees.	Before each audit.
Checklist	The auditor's working guide: requirement by requirement, what to check and what was found.	During the audit.
Audit report	Formal result: findings, conclusions and nonconformities to address.	When the audit closes.

The template, ready to use

Internal audit checklist in Excel (free sample)

All of clauses 4 to 10 and 10 Annex A controls, with a drop-down result and automatic summary. Direct download, no email. The full toolkit has all 93 controls plus the program, plan and report.

Download the free checklist (Excel)

Which columns the checklist needs

Column	What goes in	Example
ID	Clause or control	6.1.3
Requirement to verify	The question being answered	Does the Statement of Applicability justify inclusions and exclusions?
What to verify	Sampling suggestion	Review the current SoA and 3 excluded controls
Evidence reviewed	Documents, records, interviews or samples, with their identification	SoA v2.1 approved on 12 March; interview with the ISMS manager
Result	Closed list	Conforming / Major NC / Minor NC / Observation / Opportunity for improvement / Not audited
Finding	Requirement, evidence and statement	The exclusion of 8.28 is not justified (SoA v2.1)

With a closed list in the result column, a summary sheet can count each type of finding automatically, which is what management wants to see.

How to grade findings

Major nonconformity: a whole requirement is missing or a failure casts doubt on the ISMS's effectiveness (for example, no risk assessment was ever done).
Minor nonconformity: an isolated lapse that does not compromise the system (for example, an unsigned training record).
Observation: something that still conforms but may become a nonconformity if not addressed.
Opportunity for improvement: a suggestion to do better, with no nonconformity.

Each nonconformity goes to the nonconformity and corrective action register (clause 10.2) with its cause, action, owner and date.

Common internal audit mistakes

Auditing with a generic checklist without looking at the year's risks and changes.
Writing "conforming" without noting which evidence was reviewed: the certification auditor will not be able to rely on the audit.
Having the ISMS manager audit their own documents.
Reviewing only documents, not real samples (access logs, changes, incidents).
Not taking the results to the management review (clause 9.3).

Next step

Try it free or go straight to the complete solution.

ISO 27001 ISMS documentation toolkit

84 Word and Excel templates to document your ISMS based on ISO/IEC 27001:2022.

See the full toolkit

Free sample

Download a reduced version of the toolkit's risk matrix for free (Excel, 10 scenarios, heat map). See how it calculates risk level and category before you decide.

Get the free sample

Frequently asked questions

How often should an ISO 27001 internal audit be done?

The standard asks for planned intervals without setting a period. In practice most organizations audit the whole ISMS at least once a year, before the management review and the certification or surveillance audit.

Can someone from inside the company do it?

Yes, as long as they are objective and impartial: they cannot audit their own work. Small organizations often swap departments or hire an external auditor just for this task.

Do all 93 Annex A controls have to be audited?

Over the audit program you need to cover the controls your Statement of Applicability declares applicable. They can be spread across several audits in the cycle according to risk.

Is the free sample enough for a real audit?

It covers clauses 4 to 10 in full and lets you try the format. For Annex A it has 10 controls; the full toolkit has all 93.

Updated: 2026-10-25