Skip to content
compliancebase
ISO 27001A.5 — Independent review of information security

A.5.35

Independent review of information security

ISO 27001 · ISO/IEC 27001:2022 · Last verified July 2026

Objective

Conduct independent reviews of information security and the ISMS at planned intervals or when significant changes occur.

Points of focus

  • Scope the review to the ISMS and the controls actually in operation, not a generic checklist
  • Confirm the reviewer has no operational responsibility for what they are assessing
  • Set a risk-based cadence and trigger reviews after material changes (new product line, acquisition, major incident)
  • Route findings into the corrective action register and management review, not a standalone slide deck

Implementation notes

Most SaaS companies under 100 people do not have a dedicated internal audit function, and ISO 27001 does not require one — it requires independence from the area being reviewed. A common pattern: the compliance or security lead reviews engineering-owned controls, and a fractional vCISO or external consultant reviews the compliance function's own controls once a year. Define the review scope against clause 9.2 (internal audit) rather than paraphrasing Annex A text, schedule it on a cadence tied to your certification cycle (commonly annual, more often after a Series B-scale headcount jump or a security incident), and record findings as dated tickets that route into the corrective action process under clause 10.1. Feed a summary into management review under clause 9.3 so leadership sees the same findings the auditor will sample.

Audit tip: Certification bodies check three things in order: who performed the review and whether they were independent of what they tested, what the review actually covered, and whether findings closed out with dated evidence rather than sitting open indefinitely.

Evidence auditors typically request:

  • Internal audit charter or engagement letter naming scope, criteria, and reviewer independence
  • Dated audit report listing findings, severity, and evidence examined
  • Corrective action tickets linked to each finding with owner and closure date
  • Management review minutes showing findings were reported to leadership

Common gaps

  • The engineer who configured IAM also signs off as the independent reviewer of access control effectiveness
  • An audit plan references an annual cadence, but the last completed review predates the current product architecture
  • Findings live in a slide deck that was never linked back to a tracked remediation ticket

Cross-Framework Mapping

FrameworkRequirementImplementation note
ISO 27001A.5.35This control
SOC 2CC4.1, CC4.2CC4.1 and CC4.2 cover ongoing and separate evaluations of controls and communication of deficiencies — the closest SOC 2 analog, though SOC 2 does not mandate reviewer independence as explicitly as ISO 27001 clause 9.2.

Primary sources

Frequently Asked Questions

No. A.5.35 requires the reviewer to be independent of the area under review. If the same person designs, operates, and reviews a control, use a peer from another team, a fractional auditor, or a consultant instead.

No. ISO 27001 requires independence, not a dedicated department. Rotating peer review between teams that don't own the controls in scope, or contracting a part-time auditor, satisfies the requirement for most SaaS companies.

A.5.36 checks whether staff and systems comply with the policies you've written. A.5.35 checks whether the ISMS itself — its design, scope, and operation — still holds up, independent of who runs it day to day.

A material change to scope — a new product surface, an acquisition, a significant security incident, or a shift in cloud architecture — should trigger a review rather than waiting for the next calendar date.

Framework versions referenced in this page:

  • ISO/IEC 27001 — ISO/IEC 27001:2022

Last verified: July 2026 · Primary sources linked above