Achieving certification to ISO/IEC 27001 is a major milestone for any Nigerian or African organisation — but certification is not just about having documented policies. It is about demonstrating that your Information Security Management System (ISMS) is genuinely implemented, maintained, and continually improved.
During an audit, certification bodies and internal auditors request objective evidence to verify that your ISMS complies with ISO/IEC 27001. For organisations also navigating obligations under the Nigeria Data Protection Act (NDPA) 2023, NITDA guidelines, or CBN cybersecurity requirements, evidence-based often does double duty — supporting both certification and regulatory demonstrations of due diligence.
Many organisations struggle not because they don't know the standard, but because they are unsure exactly what evidence auditors expect to see. This guide provides a practical ISO/IEC 27001 audit evidence checklist to help you prepare for internal audits, certification audits, surveillance audits, and recertification audits.
Types of ISO/IEC 27001 Audits
Not every audit carries the same weight, and evidence expectations shift slightly depending on the type:
- Internal audits — conducted by your own team or an independent consultant to test readiness before external scrutiny
- Certification audits (Stage 1 and Stage 2) — conducted by an accredited certification body to award initial certification
- Surveillance audits — annual checks by the certification body to confirm the ISMS remains effective between certification cycles
- Recertification audits — a full review, typically every three years, to renew certification
Understanding which audit you are preparing for helps you calibrate how much evidence to assemble and how far back your records need to go.
What Is Audit Evidence?
Audit evidence is the information auditors use to determine whether your ISMS complies with ISO/IEC 27001. It typically includes:
- Policies and procedures
- Records, logs, and reports
- Meeting minutes
- Risk assessments
- Technical configurations
- Training records
- Interviews with personnel
Auditors look for objective evidence — not assumptions or verbal assurances.
Why an Audit Evidence Checklist Matters
A structured checklist helps organisations prepare for certification audits, identify missing documentation, demonstrate compliance, improve audit efficiency, reduce nonconformities, and support continual improvement. Proper preparation can significantly reduce audit findings — and the cost and disruption that come with them.
The ISO/IEC 27001 Audit Evidence Checklist
The checklist below is organised the same way most certification bodies structure their audit plans, moving from strategic context through to operational and technical controls.
1. Organisational Context
☐ Scope of the ISMS
☐ Internal and external issues
☐ Interested parties
☐ Information security objectives
☐ Organisational structure
2. Leadership
☐ Information Security Policy
☐ Management approval records
☐ Evidence of leadership commitment
☐ Roles and responsibilities
☐ ISMS governance structure
3. Risk Assessment and Risk Treatment
☐ Risk assessment methodology
☐ Risk register
☐ Asset inventory
☐ Risk evaluation results
☐ Risk treatment plan
☐ Risk acceptance records
4. Statement of Applicability (SoA)
One of the most important documents in the entire audit. Auditors will expect:
☐ Selected Annex A controls
☐ Justification for inclusion or exclusion
☐ Implementation status of each control
☐ Control references
5. Information Security Objectives
☐ Documented security objectives
☐ Performance measurements
☐ Progress reports
☐ Improvement actions
6. Competence and Awareness
☐ Employee training records
☐ Security awareness session logs
☐ Attendance records
☐ Competency assessments
☐ Certification records
7. Documented Information
Ensure availability of policies, procedures, standards, guidelines, and work instructions. All documents should be current, approved, and version-controlled — outdated or unapproved documentation is one of the most common sources of nonconformity.
8. Asset Management
☐ Asset inventory
☐ Asset owners
☐ Classification records
☐ Acceptable use policy
☐ Asset handling procedures
Access control evidence is consistently one of the areas auditors probe hardest, since weak identity governance is behind a large share of real-world breaches.
9. Access Control
☐ User account lists
☐ Access requests and approvals
☐ Privileged account reviews
☐ Password policy
☐ Multi-factor authentication implementation
10. Operational Security
☐ Vulnerability assessments
☐ Penetration testing reports
☐ Patch management records
☐ Antivirus/endpoint reports
☐ Backup logs
☐ Monitoring records
With more Nigerian organisations outsourcing hosting, payments processing, and IT support to third parties, supplier security evidence has become a growing focus area for auditors and regulators alike.
11. Supplier Security
☐ Supplier agreements
☐ Security requirements for vendors
☐ Third-party risk assessments
☐ Vendor monitoring records
12. Incident Management
☐ Incident response procedures
☐ Incident register
☐ Investigation reports
☐ Corrective actions
☐ Lessons-learned records
For organisations handling personal data, incident registers should also map to NDPA 2023 breach notification timelines, since certification evidence and regulatory reporting obligations frequently draw from the same records.
13. Business Continuity
☐ Business continuity plans
☐ Disaster recovery plans
☐ Recovery testing records
☐ Backup restoration results
14. Internal Audit
☐ Internal audit programme
☐ Audit plans
☐ Audit reports
☐ Nonconformity records
☐ Corrective action records
15. Management Review
☐ Management review agenda
☐ Meeting minutes
☐ Decisions taken
☐ Improvement actions
☐ Follow-up records
16. Corrective Actions
☐ Nonconformity reports
☐ Root cause analysis
☐ Corrective action plans
☐ Verification of effectiveness
Technical Evidence Auditors Often Review
Depending on your environment, auditors may also request:
- Firewall configuration reviews
- Security monitoring reports
- Vulnerability scan results
- Endpoint protection reports
- Cloud security configurations
- Identity and access management records
- Security event logs
- Encryption implementation evidence
It is worth noting that the volume of evidence is far less important than its relevance and freshness. A thin folder of current, well-mapped evidence will always outperform a thick archive of outdated documents that no longer reflect how the organisation actually operates.
Common Audit Mistakes
Organisations most often pick up nonconformities because they:
- Keep outdated policies
- Fail to review risks regularly
- Ignore corrective actions
- Do not perform internal audits
- Cannot demonstrate implementation, only intention
- Maintain incomplete or scattered records
Documented procedures alone are not enough. Auditors expect evidence that controls are actually operating effectively.
Best Practices for Audit Readiness
- Review documentation regularly, not just before an audit
- Conduct internal audits well ahead of certification
- Maintain an up-to-date risk register
- Record every management review meeting
- Track corrective actions through to closure
- Keep training records current
- Test business continuity plans annually
- Retain evidence in a single, organised repository
Audit readiness should be an ongoing discipline, not a last-minute scramble in the weeks before the certification body arrives. Organisations that treat evidence collection as a continuous, year-round habit — rather than a pre-audit fire drill — consistently walk into certification and surveillance audits with fewer findings and far less stress on their teams.
Organising Evidence for a Smooth Audit
Beyond simply gathering documents, how you organise evidence matters almost as much as what you collect. Auditors move faster — and form a more favourable impression — when evidence is indexed against Annex A controls, stored in a single accessible repository, and clearly dated and version-controlled. A common approach is to build an evidence matrix that maps each Annex A control to its supporting documents, owners, and last review date, so that any control can be traced to proof within minutes rather than hours.
For organisations juggling ISO 27001 alongside NDPA 2023 obligations, it also helps to flag which evidence items double as regulatory records — such as incident logs, data protection impact assessments, and breach notifications — so the same evidence base can serve both audiences without duplication of effort.
Final Thoughts
Preparing for an ISO/IEC 27001 audit becomes far easier when evidence is collected and maintained throughout the year rather than assembled in a rush. A well-organised audit evidence checklist helps organisations demonstrate compliance, reduce audit findings, and strengthen their Information Security Management System — while also supporting parallel obligations under NDPA 2023 and sector-specific regulators.
Most importantly, ISO/IEC 27001 is not simply about passing an audit. It is about building a culture of information security, managing risk effectively, and continually improving your organisation's ability to protect its information assets.
By maintaining complete, accurate, and up-to-date audit evidence, your organisation will be better positioned for certification success — and for long-term security resilience across every audit cycle that follows.
About the Author
Jackson Godwin is a Cybersecurity Analyst, Penetration Tester, and founder of Jackson Technology, a cybersecurity and data protection consulting firm based in Abuja, Nigeria. He advises banking, fintech, oil and gas, and public sector clients across Africa on VAPT, cloud security, and compliance with frameworks such as ISO 27001, the Nigeria Data Protection Act (NDPA) 2023, and GDPR. Jackson is also affiliated with TechTrain Academy, where he supports the development of African cybersecurity professionals.