ISO 27001 auditors ask about five things: why your scope and risk decisions look the way they do, whether leadership owns the program, whether people know their part, whether controls work in practice, and whether you can show records that prove it. Most questions are open-ended and are followed by a request to see evidence. This guide groups the questions by audit area, shows what to have ready, and explains how to prepare without memorizing scripts.
TL;DR
- Auditors start with management system questions (scope, objectives, risk method), then sample Annex A controls and ask to see dated records.
- Leaders get asked about objectives and accepted risks. Staff get asked about awareness and incident reporting.
- Keep evidence in one place, name who did what, when and where, and record the filters and date ranges behind any report.
- If a record is missing, say so and show what you have. A visible gap is easier to fix than an unsupported claim.
- Prepare by tracing real records end to end, not by rehearsing answers.
Table of Contents
- How an ISO 27001 audit questions you
- Questions about scope and context
- Questions about risk assessment and treatment
- Questions about the Statement of Applicability
- Questions for leadership, staff and process owners
- Questions about Annex A controls
- Internal, certification and surveillance audits compared
- Evidence to have ready
- When you cannot show that a requirement is met
- Prepare by tracing records, not rehearsing answers
- Our perspective
- Check your readiness before the audit
- FAQ
- Sources
How an ISO 27001 audit questions you
An auditor is not quizzing you on the standard. A certification audit is a systematic, independent, documented process for collecting evidence and judging, objectively, how far ISO/IEC 27001 requirements are met, as ISO’s SC 27 committee describes it. Every question serves that purpose: the auditor wants an answer and then something to look at.
The pattern is consistent. The auditor asks an open question (“Walk me through how you handle a new starter’s access”), listens, then picks a sample (“Show me the last three joiners”). One published guide to audit questions describes this as a conversation where the questions are a starting point for digging into the context of the chosen audit theme. Expect follow-ups you could not have scripted.
The auditor also does not work from a generic checklist alone. Guidance from the Cloud Security Alliance says ISO 27001:2022 gives auditors more flexibility to tailor the plan to your risks, technologies, people, data and customers. A fintech and a manufacturer will hear different questions.
Questions about scope and context
The first conversation usually covers the ISMS itself. Typical questions:
- Why is the scope drawn where it is, and what is deliberately outside it?
- Which interfaces cross the boundary (suppliers, shared platforms, remote staff)?
- Which internal and external issues and interested parties did you consider?
- How did you decide your security objectives, and how do you measure them?
Auditors ask where the scope stops and which interfaces cross it, so be ready to explain the logic, not only recite the boundary statement. The same source notes that auditors check whether climate change is relevant to your ISMS as part of a context review, following Amendment 1:2024. You do not need a long climate analysis. You need a recorded decision on whether it matters to you and why.
For objectives, auditors want to see targets that are measurable and tied to a function, with someone who reviews the result. Our guide to audit-ready security objectives shows examples by ISMS function.
Questions about risk assessment and treatment
This is where most audits spend the most time. Expect:
- How do you identify, analyze and evaluate risks? Show me the method.
- Take this risk. How was it scored, and what did you decide to do?
- Which residual risks did you accept, who accepted them, and against what criteria?
- When did you last update the assessment, and what triggered the update?
Auditors ask which residual risks were accepted and against what criteria, plus how a specific risk was identified and treated. A common finding is a stale assessment. Intelance reports that stale risk assessments and access reviews done less often than scheduled come up repeatedly. If your policy says quarterly, do it quarterly and keep the record.
If you want a working walkthrough of the treatment step, see our auditor-ready guide to risk treatment.
Changes in your systems
Auditors want to see that real change feeds the risk assessment. Pivot Point Security notes that for 2022 audits, auditors look at how changes such as a cloud migration are incorporated into risk assessments, and whether updates carry through to the Statement of Applicability, internal audit results and other ISMS documents. If you moved a workload last year, expect “What did you reassess when this changed?” A cloud migration assessment with defined deliverables is the kind of record that answers it cleanly: who owned the move, what risks were identified, what was decided.
Questions about the Statement of Applicability
The SoA is the document auditors cross-check against everything else. Questions to prepare for:
- Why is this Annex A control included? Why was that one excluded?
- Where is the evidence that a control marked “implemented” actually is?
- How does the SoA relate to the risk treatment plan?
An ISO working group practice note says the SoA must list all necessary controls, explain why they are necessary and whether they are implemented, and justify the exclusion of Annex A controls. The same note makes a useful point: auditors check conformity with Clause 6.1.3 d), but the organization keeps final authority and responsibility for implementing its ISMS, including the SoA. You own the decisions. You must be able to defend them.
Our Statement of Applicability guide covers how to write justifications that survive follow-up questions.
Questions for leadership, staff and process owners
Different people get different questions. Sterling’s summary is that auditors ask leaders about security objectives and accepted risks, and employees about awareness and incident reporting.
| Who is asked | Typical questions | What backs the answer |
|---|---|---|
| Top management | What are the security objectives? Which risks have you accepted? How do you review ISMS performance? | Management review minutes, objectives with owners, risk acceptance sign-offs |
| IT or security manager | How do you manage access, backups, logging, change? | Access review records, restore test results, change tickets |
| HR | How are joiners, movers and leavers handled? How is training tracked? | Onboarding checklists, training records, leaver tickets |
| General staff | What would you do if you lost a laptop or saw a phishing email? Where is the policy? | Awareness training records, incident reporting channel |
| Procurement or vendor owners | How do you assess and monitor suppliers? | Supplier assessments, contracts, review dates |
Staff do not need to recite clause numbers. They need to describe what they actually do, and that should match the procedure. Our piece on policy versus procedure explains why the gap between the two is where answers fall apart.
Questions about Annex A controls
For controls, auditors sample. Sterling says they might check whether a specific leaver’s account was disabled on time or a backup restore test succeeded and was dated. Common probes include:
- Account management: Show me the last five leavers and the time their access was removed.
- Incident logs: Show me an incident from the past year, how it was triaged, and what you learned.
- Backups: When did you last restore from backup, and who verified it?
- Secure development: How do code changes get reviewed and approved before release?
- Suppliers: How do you know your critical supplier still meets your requirements?
Supplier questions are where many first-time audits get uncomfortable. If you rely on cloud and SaaS providers, read our supplier management explainer for compliance teams before the audit.
Internal, certification and surveillance audits compared
The questions overlap, but the purpose and depth differ.
| Audit type | Who does it | What the questions aim at |
|---|---|---|
| Internal audit | Your own trained, independent staff or an outside party you hire | Finding gaps before the certification body does; checking planned arrangements are followed |
| Certification audit | An accredited certification body | Confirming the ISMS meets the standard and works in practice |
| Surveillance audit | The certification body, between certifications | Sampling parts of the ISMS, following up earlier findings, confirming it is maintained |
Transition work is a good example of how this connects. NQA’s U.S. transition plan required organizations to complete an internal audit and management review of new or changed 2022 requirements before the transition audit. Your internal audit is a rehearsal, and the certification body will often ask to see its report and how you closed the findings.
If you are in financial services, the questions lean toward regulated data, third parties and resilience. Our audit prep guide for finance companies goes through those themes.
Evidence to have ready
Auditors commonly request the ISMS scope, risk register, risk treatment plan, policies and procedures, access review records, incident records, training records, internal audit reports and management review minutes, according to one internal audit checklist. Good evidence has a few traits:
- One home. Ocasta’s checklist suggests a single location with a naming convention, including the sample size.
- Who, when, where. Each document should show who did the action, when, and where.
- Context for reports. The same checklist says system reports should show the filters and date ranges applied, not just the final numbers.
A screenshot of a clean dashboard answers little. An export that shows the query, the period and the population answers the follow-up before it is asked. For the different kinds of proof and how auditors weigh them, see our guide to types of audit evidence.
When you cannot show that a requirement is met
It will happen. A record is missing, a review was late, a control is half in place. The worst response is a confident answer you cannot back up.
A practical audit guide from ISO Checklist advises that a missing record is a limitation to acknowledge, and that evidence should follow a clear path: criterion, sample, evidence, finding, action. Say what you can show, what you cannot, and what you will do about it.
After that, the finding is classified by severity, and root-cause analysis and corrective actions are tracked to closure, as described in the same internal audit template. Auditors are far more comfortable with a gap that has an owner, a cause and a due date than with one that was glossed over.
Prepare by tracing records, not rehearsing answers
Scripted answers fail on the first follow-up. A better method is to audit yourself the way an auditor would:
- Pick a recent record, such as an incident, a change or a leaver.
- Walk backward through the procedure. Was there a logged trigger, a verified root cause and a documented approval? QueryChart describes this sampling-and-walking-backward approach for process documentation.
- Check that each process has a named owner and a current approved revision.
- Ask the process owner to explain it without notes. Fix the procedure if their description differs from the document.
- Repeat for each Annex A theme that matters to your risk profile.
The standard itself expects this joined-up thinking. Forvis Mazars notes that the 2022 version requires the ISMS to include the processes needed and their interactions, and that changes to the ISMS be carried out in a planned manner.
For a full sequence of preparation tasks, use our ISO 27001 certification checklist.
Our perspective
Most teams treat auditor questions as a quiz to pass. We see them as a map of where your ISMS is thin. Every question maps to a requirement, and every requirement maps to effort you either already spent or still owe.
That is why we built our platform around the same logic auditors use. The readiness assessment covers the four Annex A control themes, so you see weak areas before an auditor does, and the Gantt-style planner turns each gap into scheduled work with an owner. The estimates behind it use editable assumptions and a versioned methodology, so you can challenge the numbers instead of trusting a black box.
Our advice: do not rehearse. Run a self-check, trace three real records per domain, fix what breaks, and keep the evidence where anyone can find it. If you want independent eyes, we can also introduce you to independent ISO 27001 consultants.
Martin
Check your readiness before the audit
If you would like to know which of these questions you could not answer today, start with our free 2-minute readiness check. It gives you an instant read, no signup needed for the initial calculation. When you want the detail, the ISO 27001 readiness assessment goes domain by domain, and the cost calculator estimates the budget and effort to close the gaps.
You can save and compare several estimates, export a PDF report, and share a link with your leadership team.
FAQ
How long does an ISO 27001 audit interview take?
It depends on your size, scope and the audit type. The certification body sets the audit duration in its plan, and transition-era guidance from NQA, for example, added 0.5 days to a re-assessment and 1.0 day to a surveillance audit for transition. Ask your certification body for the audit plan, which lists who will be interviewed and when.
Will the auditor ask every employee questions?
No. Auditors sample people and records. Expect leadership, the people who run key controls, and a few general staff members chosen to check awareness and incident reporting. Everyone should know where the policies are and how to report an incident.
Can I get the auditor’s questions in advance?
Not the exact list. Published question catalogs exist, and they are meant to be adapted to your organization, with follow-up questions developed during the audit, as Kallmeyer’s audit question catalog explains. You can, however, ask the certification body for the audit plan and themes.
What if I do not know the answer to a question?
Say so, and explain who would know or where the record lives. Guessing creates a worse problem than a gap. If a record truly does not exist, state that plainly and describe the corrective action you will take.
Sources
- ISO/IEC 27001 Audit Questions | Sterling
- ISO/IEC JTC 1/SC 27 Journal 2026 Issue 1
- ISO 27001: Auditing Themes in the 2022 Revision, Cloud Security Alliance
- Intelance: ISO 27001 internal audit, what auditors check
- Pivot Point Security: ISO 27001:2022 auditor’s wishlist
- Cloud Migration Assessment: 5 Deliverables IT Leaders Must Own
- ISO/IEC JTC 1/SC 27/WG 1 N 3298, Auditing Practices Note on the SoA
- NQA USA ISO 27001:2022 Transition Plan
- Internal Audit Plan and Checklist
- Ocasta: Audit Evidence Checklist
- ISO Checklist: An Evidence-Led Internal Audit
- QueryChart: How to prepare process documentation for an audit
- Forvis Mazars: What’s New in ISO 27001:2022 and How to Prepare
- Kallmeyer: Der Auditfragenkatalog zur ISO/IEC 27001