The monthly check
Are you maintaining the system or only its documents?
ISO/IEC 27001:2022 asks organisations to operate and improve a risk-based management system. Your recurring schedule should reflect what matters for the organisation—not a generic promise to review every document monthly.
- Are scope and business-context changes assessed?
- Are relevant risks reviewed and treatment actions tracked?
- Do control owners have evidence from the period being reported?
- Have significant changes, incidents and supplier risks been assessed?
- Are nonconformities and corrective actions moving toward closure?
- Can management see decisions that require authority or resources?
Before an external audit
Focus on consistency and completeness.
Check that records reflect actual operations, that internal audit and management-review activities have been carried out at planned intervals and that corrective action has evidence of completion. Prepare the approved version of relevant documents before the certification-body assessment.
- Confirm assessment date and scope with your certification body
- Check the current Statement of Applicability and risk methodology
- Locate recent internal audit and management-review records
- Review outstanding actions and assign accountable owners
- Do not backfill fabricated evidence for missed control activities
Common failure mode
Risk registers become historical photographs.
A risk register created at initial certification can become inaccurate as products, staff, infrastructure and suppliers change. The fix is not endlessly rewriting the risk policy; it is embedding risk-review triggers in existing change and management processes.
A competent independent internal auditor can test whether the process is effective, while the organisation retains authority over risk acceptance.
A control-owner test
Do you have the record that would support an answer today?
Choose five in-scope controls from the current Statement of Applicability. For each, ask an owner to point to recent evidence, its time period, the applicable business system, open exceptions and the last reviewer. A written policy without evidence of operation is a different thing from an implemented control.
The table is an illustrative sampling checklist; the size of a formal internal audit must be determined using an impartial audit programme, not this informal exercise.
| Check | Pass condition for internal triage | Owner |
|---|---|---|
| Access review | Dated review identifies accounts, approver and exceptions | Identity/control owner |
| Change management | Material changes recorded with approvals and risk review | Technical/change owner |
| Supplier oversight | Risk tier, recent scope-matched evidence, expiry and decision | Procurement/risk owner |
| Corrective actions | Root cause, target action, verification of effectiveness | Action owner and reviewer |
| Management review | Minutes show inputs considered, decisions and follow-up owners | Management sponsor |
Prioritisation
Start with evidence that is absent, stale or outside the certified scope.
Rank the gaps by material risk, external commitment and approaching review date. Assign ownership before choosing a tool. If evidence was never collected, record the missing period rather than backdating a document. Where controls genuinely failed, treat the issue as a corrective action with evidence that the remedy worked.
Primary references and further reading
These public references inform the topic; they do not constitute an endorsement or review of our services.
Editorial content reviewed: 12 October 2026. Specialist technical review is required before applying this guidance to a real environment.Put this into practice