Auditing ISO 27001 Clause 9: Performance Evaluation

Clause 9 asks three things: that the organisation measures something meaningful and evaluates the results, that it audits itself against its own requirements and the standard, and that top management reviews the system against a defined list of inputs and takes decisions. It is where an ISMS’s real condition shows, and it should be audited early rather than last.

The worked findings on this page are invented, and so are the organisations in them. They are written to show how a finding is built and graded, not to catalogue the findings you should expect.

Audit ISO 27001 Clause 9 early, not last

The commonest planning mistake is to work through the clauses in order and arrive at Clause 9 with an hour left. That is backwards.

Clause 9 tells you where to look everywhere else. An internal audit report from six months ago is a map of the organisation’s own weak points, drawn by someone who knows the business. A management review that shows a metric moving the wrong way for three cycles tells you which control to test. Read the Clause 9 records early and let them direct the rest of the audit.

It also tells you something no other clause does: whether the organisation can find its own problems. An ISMS with a functioning Clause 9 and several minors is in better health than one with a silent Clause 9 and nothing found.

9.1 — monitoring, measurement, analysis and evaluation

The clause requires the organisation to determine what needs monitoring and measuring, the methods to be used to ensure valid results, when the monitoring is performed and by whom, and when results are analysed and evaluated and by whom. Documented information on the results is required.

Clause 9.1 b) adds that the methods selected should produce comparable and reproducible results to be considered valid. It is worded “should”. Weak ground for a finding on its own, but it is part of 9.1 b), not a note.

Two tests do most of the work here.

Ask what the measures are for. A measure that nobody could act on is a number, not a measure. Ask what a bad result would look like and what would happen next.

Follow the chain from measurement to evaluation. Most organisations measure. Fewer analyse. Far fewer evaluate — that is, decide what the analysis means. The clause requires all three and names who does each, so the gap is usually visible in a document that records numbers and no conclusions.

9.2 — internal audit

9.2.1 requires internal audits at planned intervals providing information on whether the ISMS conforms to the organisation’s own requirements and to the standard, and is effectively implemented and maintained. That first limb is what makes an organisation’s own procedures auditable, and the last is what stops an internal audit being a document check.

9.2.2 requires an audit programme that includes frequency, methods, responsibilities, planning requirements and reporting; that considers the importance of the processes concerned and the results of previous audits; that defines the criteria and scope of each audit; that selects auditors and conducts audits so as to ensure objectivity and the impartiality of the audit process; that reports results to relevant management; and that is evidenced by documented information.

And one distinction that decides a good many Clause 9.2 findings. Clause 9.2.1 states what internal audits are conducted to provide information about: whether the ISMS a) conforms to the organisation’s own requirements for it and to the requirements of the standard, and b) is effectively implemented and maintained. Both limbs are requirements. Cite 9.2.1 where what the audits deliver is the problem; cite 9.2.2 where the programme’s frequency, methods, responsibilities, planning requirements or reporting are; and cite 9.2.2’s objectivity limb only where who audited what is the problem. Three questions, three citations — and reaching for objectivity because it is the phrase that comes to mind is how a good finding gets written against the wrong requirement.

On auditor independence, one form of words is safe: 9.2.2 requires auditors to be selected and audits conducted so as to ensure objectivity and the impartiality of the audit process. “Auditors must not audit their own work” is the practical consequence and a sound thing to look for, but it is not the standard’s phrasing. And auditor competence is Clause 7.2, not 9.2.

9.3 — management review

Three sub-clauses, and the middle one is a list you can audit against directly.

9.3.1 requires top management to review the ISMS at planned intervals. 9.3.2 lists the inputs: the status of actions from previous reviews; changes in external and internal issues; changes in the needs and expectations of interested parties; feedback on information security performance including trends in nonconformities and corrective actions, monitoring and measurement results, audit results and the fulfilment of objectives; feedback from interested parties; results of risk assessment and the status of the risk treatment plan; and opportunities for continual improvement. 9.3.3 requires the results to include decisions on continual improvement and any need for change to the ISMS, with documented information available as evidence of those results.

Audit it as a checklist, because it is one. Take the most recent review record and tick off the inputs. A missing input is one of the cleanest findings to write, because there is nothing to interpret.

Then read the outputs. 9.3.3 requires decisions. A record that lists attendance, presentations given and papers noted, with no decision anywhere, does not meet it.

A worked ISO 27001 finding on Clause 9.1

Dunmore Software has defined six information security measures and publishes a monthly dashboard.

Note which requirement this cites. The organisation did determine when results would be analysed and by whom, so the parts of 9.1 about determining are met — and a finding written against them would be defeated by producing MEA-02. What is not met is the requirement to evaluate. Reading the clause to the end before choosing the limb is what makes the difference.

A wording point that matters when you write the requirement out. At 9.1, 9.2.2, 9.3.3 and 10.2 the current text says documented information shall be available as evidence; the word retain belongs to 6.1.2, 6.1.3, 6.2, 7.2, 8.2 and 8.3. Quoting the older verb in a finding hands the auditee something to argue about.

A worked ISO 27001 finding on Clause 9.3

Thornbury Mutual holds management reviews half-yearly, chaired by the chief operating officer, with decisions recorded.

A finding that cannot supply all three — the statement, the objective evidence and the requirement — is not defensible, and the auditee can reasonably challenge it. A nonconformity missing its evidence or its criterion is the commonest defect in a written finding, and the first thing an auditee will push on. The order the three are written in varies — some material teaches requirement first, some statement first — and what matters is that all three are present, specific and traceable.

Major or minor on ISO 27001 Clause 9

The grading test does not change by clause — evidence and reach, never how serious the failure feels, with related minors capable of adding up to a major. The Clause 8 page in this set states the test in full. What changes by clause is what falls on each side of the line.

• Major territory: no internal audits performed; no audit programme at all, or one with no defined method, responsibilities or reporting route; no management review held; monitoring defined but never evaluated; a review with no decisions across cycles.
• Minor territory: some required inputs missing from a review that otherwise works; one internal audit late against the programme; one measure without a stated method.
• Escalation: a pattern of internal audits that never find anything, in an organisation where you are finding things, is worth pursuing at 9.2.1 — whether the audits are delivering the information the clause requires — and, where the cause turns out to be who audits what, at 9.2.2’s objectivity limb.

And an opportunity for improvement is not a way round a weak Clause 9 finding. If the requirement is unmet, it is a nonconformity; if it is met and could be done better, that is advice the organisation may take or leave.

Where ISO 27001 Clause 9 connects

Frequently asked questions about auditing ISO 27001 Clause 9

Where to go next: more ISO 27001 Lead Auditor exam preparation

• Auditing Clause 8: operational planning and control
• Auditing Clause 10: nonconformity and continual improvement
• The clause map: what each clause asks, on one page
• Where the evidence lives: clauses matched to records

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is PR373. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.