Back to all 93 controls
Annex A 5.35
Organizational
A.5.35 Independent review of information security
The ISMS is independently reviewed.
What good looks like
Internal audit programme plus, where appropriate, external assurance.
Evidence an auditor will ask for
Audit schedule, audit reports, management responses.
Reviewed & Verified by a Certified ISO/IEC 27001 Lead Implementer
Built for practitioners, by practitioners. Every template, control definition, and audit checklist in this directory is aligned with the latest ISO 27001:2022 standard and structured around real-world certification audit requirements.
Certified Lead Implementer
2022 Standard Aligned
Audit-Ready Materials
Document template for this control
The IT Security Audit Policy template gives you auditor-ready wording that fulfils Annex A 5.35. Preview the full document before you download the editable version.