Methodology for conducting ISO 27001 audits

A comprehensive, professional, and ready-to-use methodology for conducting ISO 27001 audits by JDA Advisory.

General principles

The ISO 27001 audit conducted by JDA Advisory is a comprehensive assessment of the information security management system (ISMS), covering compliance with the standard, process maturity, the effectiveness of controls and the actual level of risk. The methodology combines:

• ISO/IEC 27001:2022 requirements
• best practices from ENISA, NIST and OWASP
• sector-specific experience (banking, fintech, insurance, ICT, manufacturing, SaaS)
• an evidence-based approach, grounded in evidence and measurable indicators

Stages of the ISO 27001 audit

Audit preparation and plan

Objective: to gain a full understanding of the organisation’s context and the scope of the ISMS.

Scope of activities:

• analysis of preliminary documents (policies, registers, Statement of Approach, risk analysis, process map)
• identification of critical areas and supporting processes
• definition of the audit scope (sites, systems, processes, suppliers)
• Preparation of the Audit Plan:
  • objectives and criteria
  • timetable
  • list of processes and owners
  • required evidence
  • audit methods and techniques

Products:

• ISO 27001 Audit Plan
• Evidence Request List
• Schedule of meetings with process owners

Documentation review (Stage 1)

Objective: to assess the completeness and adequacy of the ISMS documentation.

Scope:

• information security policy
• risk analysis and methodology
• asset registers
• information classification
• operational procedures
• policies on access, cryptography, backup, logging and business continuity

Techniques:

• gap analysis
• assessment of the documentation’s compliance with the standard’s requirements
• assessment of consistency between documents

Products:

• Documentation Review Report
• List of non-conformities and areas for improvement
• Updated list of evidence for the operational audit

Operational audit (Stage 2)

Objective: to assess the actual functioning of the ISMS and the effectiveness of controls.

Scope:

• interviews with process owners
• review of operational evidence
• control tests (sampling)
• analysis of logs, configurations and incident records
• process evaluation:
  • incident management
  • change management
  • access management
  • backup and recovery
  • monitoring and logging
  • supplier management
  • business continuity

Techniques:

• compliance testing
• performance testing
• residual risk analysis
• process maturity assessment (CMMI-like)

Products:

• Inspection test results
• List of non-conformities (NC)
• List of observations (OBS)
• List of recommendations (REC)

Risk analysis and SoA verification

Objective: to assess whether the organisation properly identifies, assesses and manages risks.

Scope:

• review of the risk analysis methodology
• assessment of the risk register
• assessment of the adequacy of controls in relation to risks
• SoA verification:
  • completeness
  • justification
  • implementation status
  • link to risks

Products:

• SoA verification with recommendations
• Risk assessment report
• Updated risk map

Final report and closing session

Objective: to present the audit findings and recommendations.

Scope:

• presentation of findings to management
• discussion of non-compliance issues and areas of risk
• prioritisation of corrective actions
• strategic and operational recommendations
• roadmap to full compliance

Products:

• Compliance and Risk Dashboard
• ISO 27001 Audit Report
• NC/OBS/REC Matrix
• 3–12-month Roadmap

Audit techniques used by JDA Advisory

• documentation review
• interviews and workshops
• control testing (design & operating effectiveness)
• log and configuration analysis
• evidence sampling
• risk analysis
• process maturity assessment
• incident and problem analysis
• review of changes and implementations
• analysis of compliance with sector-specific requirements (DORA, NIS2, KNF, EBA, ENISA)

Key deliverables provided to the client

• Updated risk analysis (optional)
• Audit Plan
• List of evidence
• Stage 1 Report
• Stage 2 Report
• List of NC/OBS/REC
• Compliance dashboard
• Compliance roadmap
• Updated SoA (optional)

Key features of the JDA Advisory methodology

• executive-ready communication
• granularity and evidence-based approach – every conclusion backed by concrete evidence
• sector-specific approach – banking, fintech, insurance, ICT, SaaS, manufacturing
• mapping to DORA, NIS2, KNF, EBA
• dashboards and KPIs/KRIs for management boards
• practical recommendations, not theoretical advice
• minimising the client’s workload – a precise list of evidence, clear instructions