ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The ISO 27001 independent review is the control most organisations think they have already covered, and most of them are wrong. Annex A 5.35 sits quietly at the end of the organisational controls, gets ticked “applicable” on the Statement of Applicability, and then gets cross-referenced to the clause 9.2 internal audit programme as if the two were the same thing. They are not. A stage 2 auditor who pulls on that thread usually finds one audit report doing the work of two different requirements, and the organisation cannot show who reviewed the approach to managing information security, as opposed to checking conformity against a clause list.
This guide covers what the ISO 27001 independent review actually asks for, how it differs from clause 9.2 and clause 9.3, who is allowed to perform the review, how A.5.36 completes the pair, and the records a certification auditor will ask to see. It also covers the one piece of circular logic that catches people out — pointing at your own certification body as your independent reviewer.
Free gap assessment
Where do you actually stand against ISO 27001?
Score every management system clause and all 93 Annex A controls, free, and get a prioritised gap list back.
Run the free ISO 27001 gap assessment → or View premium report sample
ISO/IEC 27001:2022 carries 93 Annex A controls arranged in four themes: 37 organisational, 8 people, 14 physical and 34 technological. A.5.35, the ISO 27001 independent review, is an organisational control, and its statement is short:
“The organization’s approach to managing information security and its implementation including people, processes and technologies shall be reviewed independently at planned intervals, or when significant changes occur.” — ISO/IEC 27001:2022, Annex A 5.35
Three words in that sentence do the heavy lifting. Approach means the design of the thing, not only its operation — your risk methodology, your policy set, your control selection, your governance structure. Independently means somebody who does not own or run what they are reviewing. People, processes and technologies means the review cannot be a document check; it has to touch how the ISMS is actually staffed and run, and what the technology is actually doing.
ISO/IEC 27002:2022 gives the implementation guidance behind the same control. The stated purpose of the ISO 27001 independent review is to ensure the continuing suitability, adequacy and effectiveness of the organisation’s approach to managing information security. The attributes assigned to 5.35 in 27002 are worth reading as a summary of intent: control type preventive and corrective, all three information security properties, cybersecurity concepts identify and protect, operational capability information security assurance, security domain governance and ecosystem.
One correction before you build anything on a web search. Several widely-read commercial control guides state that the ISO 27001 independent review control replaces ISO/IEC 27002:2013 control 18.1.2. That is wrong, and it propagates. 18.1.2 in the 2013 edition was Intellectual property rights. The real predecessor of A.5.35 is 18.2.1 Independent review of information security, which sat under the 18.2 “Information security reviews” heading alongside 18.2.2 and 18.2.3. If you are maintaining a 2013-to-2022 mapping sheet inherited from a consultant — and the transition deadline for 2013 certificates passed on 31 October 2025, so most of these sheets are now legacy artefacts — check that row.
This is where the control is lost or won. ISO 27001 asks for three distinct looks at the ISMS and they answer three different questions. Treating any one of them as a substitute for the others is the single most common ISO 27001 independent review finding.
| Clause 9.2 internal audit | Clause 9.3 management review | Annex A 5.35 independent review | |
|---|---|---|---|
| Question it answers | Does the ISMS conform to ISO 27001 and to our own requirements, and is it effectively implemented and maintained? | Is the ISMS still suitable, adequate and effective, and what do we decide to change? | Is our whole approach to managing information security — people, processes, technologies — still the right approach? |
| Who runs it | Auditors selected to ensure objectivity and impartiality of the audit process (clause 9.2.2) | Top management | A party independent of the area under review: internal audit, a manager from an unrelated function, or an external specialist |
| Driven by | An audit programme covering the standard’s requirements and your controls | A fixed list of mandatory inputs and documented outputs | Planned intervals, plus significant change |
| Typical output | Audit report, nonconformities, corrective action requests | Minutes with decisions, resource and improvement actions | A review report and recommendations, reported to the management who commissioned it |
| Mandatory documented information? | Yes — evidence of the programme and the results | Yes — evidence of the results | Not named in clause 7.5, but the control is unprovable without a record |
Can the internal audit programme carry the ISO 27001 independent review? Yes — but only if two things are true. First, the programme has to actually review the approach, not just test conformity clause by clause; an audit plan that walks Annex A and the management clauses in order will produce findings but will never say “your risk methodology is the wrong shape for this business.” Second, the auditor has to be genuinely independent of the ISMS. In a lot of small organisations the internal auditor is the same person who wrote the policies, which satisfies neither clause 9.2.2 nor A.5.35. Our guide to the ISO 27001 internal audit and clause 9.2 covers how to build an audit programme that can bear this weight, and the clause 9.3 management review guide covers the inputs that make the third leg work.
ISO 27002 does not name a job title for the ISO 27001 independent review. It names a property: the reviewer must be independent of the area under review, and competent enough to form a sound judgement about it. In practice that gives you four workable options, and one that does not work.
| Reviewer | Works when | Watch out for |
|---|---|---|
| Internal audit function | It reports to the board or audit committee, not to the CISO or IT manager | A reporting line into the function being reviewed destroys the independence in substance even if the org chart looks right |
| A manager from an unrelated function | Small organisations with no audit function; finance, legal or operations leadership with security training | Competence. A reviewer who cannot challenge a technical answer produces a report that says everything is fine |
| External consultant or specialist firm | You want depth, benchmarking, or a defensible answer for a customer | The consultant who built your ISMS cannot review it. That is self-assessment with an invoice attached |
| Peer organisation / group internal audit | Group structures, or a reciprocal arrangement with a comparable business | Confidentiality agreements and scope need to be written down before anyone starts |
| Never, as your only mechanism | It is circular: the certification auditor’s job includes verifying that you run A.5.35. You cannot be audited against a control by the people you nominated as the control |
NIST frames the ISO 27001 independent review requirement in a way that is useful to quote at a sceptical executive. NIST SP 800-53 Rev. 5 control CA-2(1) Independent Assessors — present in both the Moderate and High baselines — requires independent assessors or assessment teams to conduct control assessments, and defines impartiality as being free from any perceived or actual conflicts of interest regarding the development, operation, sustainment or management of the systems under assessment. Assessors must not assess their own work, act as management or employees of the organisation being assessed, or advocate for it. NIST also provides the small-organisation escape hatch that ISO leaves implicit: where organisational structures make true independence impractical, independence can be achieved by having an independent team of experts review and validate the assessment results for completeness, accuracy, integrity and reliability.
That last point matters for a 20-person company. You are not required to hire a Big Four firm. You are required to make sure the person signing off the review did not build the thing being reviewed, and to be able to show why you consider them competent.
The ISO 27001 independent review almost never appears alone in an audit finding, because the control sitting next to it covers the gap it leaves. A.5.36 Compliance with policies, rules and standards for information security requires that compliance with the organisation’s information security policy, topic-specific policies, rules and standards is regularly reviewed. In the 2013 edition this was two separate controls — 18.2.2 (compliance with security policies and standards) and 18.2.3 (technical compliance review) — and the 2022 edition merged them into one.
That merge is the part templates get wrong. Because 18.2.3 was folded in, A.5.36 explicitly reaches technical compliance: configuration baselines, vulnerability scanning results, automated measurement and reporting tools, penetration test findings. A compliance review that is just a manager confirming “yes, my team follows the policy” answers the old 18.2.2 and silently drops the technical half.
| A.5.35 Independent review | A.5.36 Compliance with policies, rules and standards | |
|---|---|---|
| Who performs it | Someone independent of the area reviewed | Managers and information owners, for their own areas |
| What it examines | The approach itself — is it still the right design? | Whether the approach is being followed in practice |
| 2013 predecessor | 18.2.1 | 18.2.2 + 18.2.3 |
| Technical testing in scope? | Only as evidence of effectiveness | Yes — this is where technical compliance review lives |
| Frequency wording | “Planned intervals, or when significant changes occur” | “Regularly” |
| When non-compliance is found | Feed into improvement and management review | Determine the cause, evaluate the need for action, implement corrective action, review effectiveness |
The 5.36 response sequence is worth reading next to clause 10.1. It is the same four-step corrective action logic the management clauses already require, which means a single corrective action register can serve both — and 27002 adds the practical expectation that actions are completed in a timely way, ideally before the next review cycle, with documented progress where they are not. If you want the grading language for those findings, see our guide to major and minor nonconformities.
The standard sets no interval for the ISO 27001 independent review. It gives you a trigger model: planned intervals, plus significant change. You choose the interval, you document the choice, and you defend it with risk.
What most certified organisations settle on is an annual ISO 27001 independent review timed to land before the management review and before the surveillance audit, so the findings have somewhere to go. Typical practice ranges from annual in a stable, low-change environment to every six months where the business is regulated, growing fast, or heavily dependent on a changing technology stack. Those are observed patterns, not requirements.
The change triggers are the part people forget to write into the procedure. ISO 27002’s guidance points at: changes in applicable laws and regulations; a significant security incident; a major change to the business or its scope; a new product or service with security implications; and significant modification to policies, procedures or controls. Any of those should pull a review forward rather than waiting for the anniversary. If you acquired a company, moved to a new cloud provider, or had a reportable breach in the last twelve months and your only independent review predates it, expect a question.
Scope the ISO 27001 independent review from the control statement itself — people, processes, technologies — and then prove each one. A review that produces a single page saying “the ISMS was found to be effective” is worse than no review, because it demonstrates that the arrangement exists and does nothing.
| Dimension | What the reviewer examines | Evidence produced |
|---|---|---|
| Approach and governance | Is the ISMS scope still right? Does the risk methodology still fit the business? Are roles and authorities real? | Commentary on scope statement, risk methodology, RACI, resourcing |
| People | Competence of the security function, segregation, awareness outcomes rather than attendance | Competence matrix review, interview notes, awareness effectiveness data |
| Processes | Risk assessment and treatment, incident handling, supplier management, change control — as operated, not as written | Sampled records, process walkthroughs, exception analysis |
| Technologies | Whether deployed controls match the Statement of Applicability and the risk treatment plan | Configuration and logging samples, scan and test results, control coverage gaps |
| Objectives and performance | Whether the security objectives are measurable and being met, and whether measurement tells you anything | Objective tracking, metric critique, trend commentary |
| Improvement loop | Whether previous findings — internal, external, incident-driven — were actually closed | Corrective action register sample with closure evidence |
If you want a crosswalk for a board that already thinks in NIST terms, the NIST Cybersecurity Framework 2.0 places the same loop in its Govern function under Oversight: GV.OV-01 reviews cybersecurity risk management strategy outcomes to inform and adjust strategy and direction, GV.OV-02 reviews and adjusts the strategy to ensure it covers organisational requirements and risks, and GV.OV-03 measures and reviews risk management performance to confirm and adjust strategic direction. A.5.35 is the ISO expression of that oversight category, and CA-2(1) is the 800-53 expression. One review, mapped three ways, is a far easier sell internally than three separate exercises.
The ISO 27001 independent review is unusual in that the evidence is thin by design — there is no mandated document — but the questions are predictable. Across certification and surveillance audits, the same five things get asked for.
| # | What the auditor asks | What satisfies it |
|---|---|---|
| 1 | “Where is your arrangement for independent review?” | A documented ISO 27001 independent review arrangement naming who reviews, how often, against what criteria, and who receives the report |
| 2 | “Why is this reviewer independent?” | Reporting line, contract scope, or role description showing no ownership of what was reviewed |
| 3 | “Show me the last review report.” | A report covering approach, people, processes and technologies — dated, authored, with findings |
| 4 | “Who did it go to?” | Evidence the report reached the management that commissioned it, typically via the management review minutes |
| 5 | “What changed as a result?” | Findings tracked in the corrective action or improvement register, with closure evidence |
Item 5 is where most organisations lose the control. A review that produced eleven recommendations, none of which were actioned, is evidence of a broken improvement loop. It is better to receive three findings and close three than to receive eleven and close none.
1. Mapping it to clause 9.2 on the Statement of Applicability and stopping there. The SoA is mandatory under clause 6.1.3, and a one-line justification saying “covered by internal audit” is an invitation. If internal audit genuinely covers it, the audit programme and report need to show the approach being reviewed, not just conformity sampled.
Free ISO 27001 risk assessment
Which of your risks sit above your appetite line?
Set your own risk criteria, pick from 61 information security risk scenarios, rate likelihood and impact, and decide how to treat each one. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free risk assessment → or View premium report sample
2. The ISMS owner reviewing the ISMS. A CISO cannot sign off an ISO 27001 independent review of the management system they designed and operate, however senior they are. Neither can the consultant who wrote the policies. This is the single clearest independence failure and it is visible from the signature block.
3. Nominating the certification body. Circular, as above. The certification audit is an assessment of conformity performed for the purposes of certification; it does not discharge a control that the same audit is checking.
4. No change trigger. An annual-only arrangement with no “or when significant changes occur” clause does not match the control text. Write the triggers into the procedure and keep a short record when a trigger fires and you decide a review is not warranted.
5. Forgetting A.5.36’s technical half. A manager’s attestation covers the old 18.2.2. The merged control also absorbed 18.2.3 technical compliance review, so scan results, configuration checks and test findings belong in the compliance review evidence. See our breakdown of all 93 Annex A controls for where this sits among the organisational set.
A.5.35 is an Annex A control, so it is mandatory unless you exclude it in the Statement of Applicability with a justification. In practice an exclusion is extremely difficult to defend — there is no organisation for which reviewing your own security approach independently is inapplicable — so treat it as mandatory and plan the review.
Yes, an internal auditor can perform the ISO 27001 independent review, provided they are independent of the ISMS in substance, not only on the org chart, and competent to judge the approach rather than just test conformity. The usual failure is an internal auditor who reports to the person responsible for security. If that is your structure, either change the reporting line for the review or bring in an external reviewer.
A gap assessment measures you against the standard’s requirements, usually before certification, and is typically performed by or for the implementation team. The ISO 27001 independent review assesses whether your approach is still suitable and effective for your business, is performed by someone with no stake in the answer, and continues for the life of the ISMS.
Whatever you documented and can defend with risk, provided it is actually being met and the change triggers are in the procedure. Annual is the common choice and aligns neatly with the surveillance cycle. The finding is almost never about the number; it is about the interval being undefined, or defined and then missed.
No. One review programme can produce both the ISO 27001 independent review report and the A.5.36 compliance records, as long as the report distinguishes the independent assessment of the approach from the compliance checking that managers perform in their own areas, and as long as the independence requirement applies only where A.5.35 demands it. Many organisations run A.5.36 quarterly at management level and A.5.35 annually with an independent reviewer.
The ISO 27001 independent review is a cheap control to satisfy and an expensive one to fail. The ISO 27001 independent review arrangement is a page: who reviews, how often, what triggers an off-cycle review, what the scope covers, who gets the report. The review itself is a few days of somebody competent looking at your approach with no stake in the answer. What costs money is discovering at stage 2 that your internal audit report has been doing double duty, and rebuilding the evidence under audit pressure.
If you are building the arrangement from scratch, the ISO 27001 Toolkit — 165 templates covering the management clauses and all 93 Annex A controls, $149 — includes the internal audit programme, audit report, corrective action register and management review pack that an independent review feeds into, so the findings have somewhere to land. For the wider picture of how Annex A fits around the management clauses, start with our complete guide to ISO 27001.
The standard itself, ISO/IEC 27001:2022 (Edition 3, published October 2022, with one amendment), is available from ISO; Annex A 5.35 is one short sentence, and the guidance behind it is in ISO/IEC 27002:2022.
October 19, 2026
October 19, 2026
October 18, 2026
October 18, 2026
October 15, 2026