Auditing ISO 27001 Clause 5: Leadership, Policy and Roles
Clause 5 is audited indirectly. Top management commitment leaves few records of its own, so you evidence it through the clauses where it would have had consequences: whether resources were provided, whether management review happened and produced decisions, whether roles were assigned and whether anyone reports ISMS performance to top management.
Clause 5 is audited indirectly. Top management commitment leaves few records of its own, so you evidence it through the clauses where it would have had consequences: whether resources were provided, whether management review happened and produced decisions, whether roles were assigned and whether anyone reports ISMS performance to top management.
The clause reference sets out what 5.1, 5.2 and 5.3 require. This page is about the evidence problem, which is peculiar to this clause.
The worked findings on this page are invented, and so are the organisations in them. They are written to show how a finding is built and graded, not to catalogue the findings you should expect.
The evidence problem in auditing ISO 27001 Clause 5
Clause 5.1 asks top management to demonstrate leadership and commitment. That is a real requirement with real consequences, and it is also the requirement least amenable to being shown a document.
Two failure modes follow, and both are common among inexperienced auditors.
Accepting the interview. A chief executive says information security is a priority, and it goes in the report as evidence of commitment. It is not evidence; it is a statement. Under the audit principles you corroborate a claim rather than accept it.
Grading on impression. An auditor who finds top management uninterested writes a Clause 5.1 nonconformity on that impression. It will not survive the closing meeting, because there is nothing in it another auditor could trace and confirm.
The way out of both is the same. Commitment that is real leaves traces in other clauses. Audit the traces.
The trail: auditing ISO 27001 Clause 5.1 through its consequences
Clause 5.1 lists what top management must ensure. Each item has a downstream consequence you can look at.
| If commitment is real… | …you will find it here |
|---|---|
| The policy and objectives are established and compatible with strategic direction | 5.2 and 6.2 — and whether the objectives relate to anything the business actually cares about |
| ISMS requirements are integrated into business processes | Clause 8, and whether security appears in change, procurement and project processes or runs alongside them |
| Resources are available | 7.1, and whether posts identified as needed were filled and budget requested was granted |
| The importance of the ISMS is communicated | 7.3 and 7.4, and whether anyone below the security team can say what the policy is for |
| The ISMS achieves its intended outcomes | 9.1 and 9.3 — whether performance is reviewed and whether the review produced decisions |
| Other management roles are supported | Interviews with those managers, and whether escalations went anywhere |
The most productive single test is the management review. Clause 9.3 requires it; Clause 5.1 is where its absence or emptiness gets its meaning. A management review that top management did not attend, or that recorded attendance and no decisions, is evidence about commitment that another auditor can trace.
Preparing for the PR373 exam?Full-length mock exams and exam application support are included.
Auditing the ISO 27001 policy: Clause 5.2 asks for more than people expect
Most policy findings come from auditors reading the policy for content rather than against the clause. Read it against the clause and there are seven distinct tests.
Is it appropriate to the purpose of the organisation? A generic policy that would fit any company is worth a question.
Does it include information security objectives, or a framework for setting them?
Does it include a commitment to satisfy applicable requirements?
Does it include a commitment to continual improvement of the ISMS?
Is it available as documented information?
Is it communicated within the organisation? Test this by asking someone, not by reading the intranet.
Is it available to interested parties as appropriate?
That last one is easy to miss and often fails, because organisations write a policy for internal use and then contract with customers who expect to see it.
5.3 is shorter: roles, responsibilities and authorities assigned and communicated, specifically for ensuring the ISMS conforms and for reporting on its performance to top management. Those last four words are the testable part. Ask who reports, to whom, how often — and then ask to see it happening.
A worked ISO 27001 finding on Clause 5.2: the policy nobody outside can see
Thornbury Mutual has a current, approved information security policy, published on its intranet and covered in induction. Three customer contracts require the policy to be made available on request.
| Statement | The information security policy is not available to interested parties as required. |
|---|---|
| Objective evidence | The information security policy (POL-01 version 4) is published on the internal intranet only. Three sampled customer contracts require the policy to be made available on request. The account manager confirmed that two such requests had been received in the period and that neither had been answered; no record of either request or of any response was produced. The policy is approved, is communicated internally, and contains the commitments Clause 5.2 requires. |
| Requirement | ISO/IEC 27001 Clause 5.2 g) requires the information security policy to be available to interested parties, as appropriate. |
| Grade | Minor — the policy exists, is approved and is communicated internally; the failure concerns availability to a defined group and is limited in its effect on the ISMS. |
Note the grading reasoning. The temptation is to call this major because a contractual commitment was missed. The grade follows the effect on the ISMS, not the commercial embarrassment.
Want structured preparation?One year of LMS access and HD recordings come with the course.
A worked ISO 27001 finding on Clause 5.1 at the other grade
Dunmore Software identified in two successive management reviews that it needed a second information security analyst for the ISMS to operate as planned. The post was not filled, and work the organisation itself scheduled has not been done.
| Statement | Top management has not ensured that the resources needed for the information security management system are available. |
|---|---|
| Objective evidence | Management review records MR-08 and MR-09 each record a determination that an additional information security analyst was required for the ISMS to operate as planned, and each records the decision as carried forward without a further decision. The post has not been filled. The risk treatment plan shows seven items with agreed completion dates now passed and no work recorded against them; the information security manager confirmed that none has been started and attributed this to resource. The awareness programme scheduled in the same plan for the last two quarters has not been delivered. |
| Requirement | ISO/IEC 27001 Clause 5.1 c) requires top management to demonstrate leadership and commitment with respect to the ISMS by ensuring that the resources needed for the ISMS are available. |
| Grade | Major — the organisation itself determined the resource was necessary, twice, and it was not provided; the consequence is that seven treatment items are past their agreed dates with no work done and a planned control is not being delivered, which raises doubt the ISMS can achieve its intended results. |
Statement, objective evidence, requirement: miss one and the finding is not defensible. The Clause 6 page sets out why, and what examination items do with a nonconformity that is missing a part.
One point of technique in that example. Clause 7.1 was the obvious alternative citation, and was rejected. Clause 7.1 requires the organisation to determine and provide the resources; the evidence shows it determined them. What did not happen is that top management, who alone could release the post, acted on that determination across two cycles. Clause 5.1 c) describes that and 7.1 does not. Cite one requirement from the standard per finding. Adding the organisation’s own documented requirement alongside it strengthens a finding; bundling two clauses that describe different failures weakens it, because the auditee can accept half.
Major or minor on ISO 27001 Clause 5
Grade from the evidence and its reach, never from how serious it feels. A major is a significant or systemic failure — a requirement absent, a process that is not operating, a breakdown that raises doubt the ISMS can achieve its intended results. A minor is an isolated or occasional lapse that does not by itself break the system. Several related minors can together show a systemic problem and become a major.
Major territory: no policy; a policy that has never been approved; top management absent from the direction of the ISMS across cycles; nobody assigned responsibility for ISMS performance at all.
Minor territory: a policy missing one required element; one gap in communication; a role assigned but not communicated.
Opportunity: a policy that meets every requirement but reads as boilerplate, where nothing downstream has failed.
Where ISO 27001 Clause 5 connects
Clause 5 is the clause you cite when a pattern of failures elsewhere has a single explanation. That is a real technique and also a trap.
The technique: where several minors across Clause 7, Clause 9 and Annex A all trace to resources never provided or decisions never taken, the escalation rule applies — related minors that together show a systemic problem can become a major, and Clause 5.1 may be where that major belongs.
The trap: reaching for Clause 5 because a finding feels important. A management review held without top management is a Clause 9.3 finding on its face — 9.3.1 requires top management to review the ISMS — and citing 5.1 for it puts the weaker limb first. A Clause 5 nonconformity needs evidence about what top management did or did not do with something that reached them.
The Annex A connection worth knowing is A.5.1 policies for information security, which covers topic-specific policies below the overarching one, and A.5.4 management responsibilities. A finding about a missing access control policy is A.5.1, not Clause 5.2 — a distinction candidates lose marks on.
ISO 27001 Clause 5: where does leadership commitment show up?
Pick a commitment top management must show and see where the evidence is.
How to use it: Choose the option that fits you from the list. The answer appears below.
From the commitment table in this article. Commitment is not directly observable, so you audit its consequences.
Frequently asked questions about auditing ISO 27001 Clause 5
How do you audit top management commitment in ISO 27001?
Through its consequences. Whether resources were provided, whether management review happened with top management present and produced decisions, whether roles were assigned, whether ISMS performance is reported upward. An interview alone is a claim, not evidence.
What must an ISO 27001 policy contain?
It must be appropriate to the organisation’s purpose, include objectives or a framework for setting them, commit to satisfying applicable requirements and to continual improvement, be available as documented information, be communicated internally, and be available to interested parties as appropriate.
Is ISO 27001 Clause 5.2 the same as Annex A control A.5.1?
No. Clause 5.2 is the overarching information security policy required of the organisation. A.5.1 covers policies for information security more broadly, including topic-specific ones. A missing access control policy is an A.5.1 matter.
Can you raise a major nonconformity on ISO 27001 leadership?
Yes, where the evidence supports it — a resource the organisation itself determined was necessary, refused across cycles, with ISMS processes failing as a result. What will not stand is a major based on an impression that management seemed uninterested.
Who has to attend the ISO 27001 management review?
Clause 9.3.1 requires top management to review the ISMS at planned intervals. A review conducted without them is a 9.3 finding first; whether it also supports a 5.1 finding depends on what else the evidence shows.
Where to go next: more ISO 27001 Lead Auditor exam preparation
Auditing Clause 4: context, interested parties and scope
Clause 6.3 planning of changes, the clause people miss
Auditing Clause 7: competence, awareness and documented information
3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.
Booking a PR373 course? See the schedule, trainers and what’s included.
Leave a reply