Illustrative stock imagery from Pexels. Images do not identify the people, premises or events discussed and do not imply endorsement.
Reviewed 26 October 2026. Original publication date retained: 2023-06-07.
An information-security management system needs to reflect the organisation's information, activities and responsibilities. An audit follows that context into operating evidence instead of treating a list of technologies as assurance by itself.
Questions to follow in an audit
- How are information risks linked to the organisation's scope?
- Who owns decisions about the response to those risks?
- How is the effectiveness of the arrangements evaluated?
Connect the records with practice
Trace one risk through its owner, chosen response, operating records and the review of whether further action is needed.
These are illustrative audit trails, not findings about a named organisation, technical instructions or a guarantee of a particular result. The appropriate evidence depends on the activities, risks and agreed scope. The organisation remains responsible for its operations and legal obligations.
AAA provides independent certification audits. Confirm the applicable standard edition, scope and customer requirements before agreeing a programme. Request an indicative price or discuss your proposed audit.
Further reading: ISO information security.