How to Audit Performance Evaluation in an ISMS

Why Performance Evaluation Is Where ISMS Audits Get Serious

Clause 9 of ISO 27001 is where an Information Security Management System either proves it works or exposes itself as a paper exercise. The monitoring, measurement, internal audit, and management review requirements in this section are not administrative formalities. They are the feedback loop that tells an organisation whether its controls are effective, whether its risks are being managed, and whether the system is actually improving over time.

When you audit performance evaluation in an ISMS, you are not just ticking boxes against a list of documented information. You are testing whether the organisation genuinely understands how its information security system is performing. That requires a different mindset to auditing operational controls. You need to follow the logic: what did they measure, what did it tell them, and what did they do with that information?

This article walks through the three main components of Clause 9, what auditors should be looking for in each, the evidence that actually matters, and the nonconformities that come up most often in practice.

Understanding the Three Components of Clause 9

Clause 9 of ISO 27001:2022 covers three distinct but connected requirements:

• Clause 9.1: Monitoring, measurement, analysis and evaluation
• Clause 9.2: Internal audit
• Clause 9.3: Management review

Each one feeds the next. Monitoring and measurement produces data. Internal audits provide an independent assessment of conformity and effectiveness. Management review uses both to make decisions about the direction of the ISMS. If any one of these is weak, the whole performance evaluation loop breaks down. That is exactly what you are testing when you audit this clause.

Auditing Clause 9.1: Monitoring, Measurement, Analysis and Evaluation

This is often the most technically demanding part of the performance evaluation audit. The standard requires the organisation to determine what needs to be monitored and measured, the methods to be used, when monitoring and measurement will be performed, who will perform it, when results will be analysed and evaluated, and who will do that analysis. All of this needs to be retained as documented information.

What to Ask For Before You Start

Before your audit session on Clause 9.1, request the following:

• The monitoring and measurement plan or framework, whatever form it takes
• Examples of recent measurement results
• Evidence that results have been analysed and acted upon
• Any dashboards, reports, or metrics used to track ISMS performance

Do not accept a blank stare followed by a printout of a spreadsheet that was clearly created the week before your audit. If the organisation cannot point you to records that predate your engagement, that is a signal worth following.

The Core Audit Questions

In your interviews, you want to understand the substance behind the process. Some of the most useful questions include:

• What are you actually measuring in relation to information security?
• How did you decide what to measure?
• Who is responsible for collecting and reviewing the data?
• What happened the last time a metric indicated a problem?
• How do your measurements connect to the controls in Annex A?

That last question is important. Many organisations have generic IT metrics that bear little relationship to their actual risk treatment plan or their Annex A control selection. If an organisation selected Control 5.23 (information security for use of cloud services) as applicable, for example, you would expect to see some form of measurement related to cloud service security performance. If the only metrics being tracked are things like server uptime and helpdesk ticket volumes, there is a gap worth exploring.

What Good Looks Like

A well-functioning Clause 9.1 process has a defined set of indicators that are genuinely linked to the organisation's information security risks and objectives. Results are collected at planned intervals, reviewed by someone with the authority and knowledge to interpret them, and fed into decisions about whether controls are working. You will find records of trend analysis, not just point-in-time snapshots. And when something looks wrong, there is evidence that someone investigated and responded.

Common Nonconformities in Clause 9.1

The most frequent findings in this area include:

• No documented method for monitoring and measurement, just ad hoc activities
• Metrics that exist on paper but have no records showing they were actually collected
• Results that were collected but never analysed or acted upon
• Measurements that have no logical connection to the organisation's risks or objectives
• Responsibility for monitoring not clearly assigned to anyone

If you find that monitoring is happening but there is no evidence of analysis or evaluation, that is typically a nonconformity against the explicit requirement to analyse and evaluate results. Collecting data and doing nothing with it does not satisfy the clause.

Auditing Clause 9.2: Internal Audit

The internal audit requirement for an ISMS is covered in detail in a related article on ISMS internal audits under Clause 9.2, so this section focuses on what you should be testing when you audit the internal audit process itself, rather than how to run one.

What the Standard Requires

ISO 27001 requires the organisation to conduct internal audits at planned intervals to determine whether the ISMS conforms to the organisation's own requirements and to the standard's requirements, and whether it is effectively implemented and maintained. The organisation must plan, establish, implement and maintain an audit programme, define the audit criteria and scope for each audit, select auditors who ensure objectivity and impartiality, report results to relevant management, and retain documented information as evidence.

Audit Evidence to Gather

When auditing the internal audit process, you want to see:

• The audit programme, showing planned audits for the current cycle
• Individual audit plans for recent audits
• Audit reports from completed audits
• Evidence that findings were communicated to relevant management
• Records showing corrective actions were raised and followed up
• Evidence of auditor independence, meaning auditors did not audit their own work

Pay particular attention to the audit programme itself. Many organisations have a programme that looks comprehensive on paper but has significant gaps in coverage. If the programme has never included a full audit of Annex A controls, or if certain high-risk areas have been consistently skipped, that is worth noting.

Testing Auditor Competence and Independence

This is an area where internal audit programmes often fall short. Ask who conducted the most recent internal audits. Ask what qualifications or training those individuals have. Ask whether any auditor audited a process they are directly responsible for. Independence does not require an external auditor, but it does require that the person conducting the audit is not auditing their own work. If the IT manager audited all of the IT-related controls with no independent oversight, you have a problem regardless of how thorough the audit appeared to be.

Frequency and Risk-Based Scheduling

The standard requires audits at planned intervals but does not specify a minimum frequency. What it does require is that the programme takes into account the importance of the processes concerned and the results of previous audits. In practice, this means higher-risk areas should be audited more frequently, and areas with a history of nonconformities should receive closer attention. If the audit schedule is the same year after year with no adjustment based on risk or previous findings, that is a gap in the programme design.

Common Nonconformities in Clause 9.2

• No formal audit programme, just audits conducted on an informal basis
• Audit programme that has not been updated to reflect changes in the ISMS scope or risk profile
• Auditors who lack documented competence in ISMS auditing
• Audit reports that record activities but do not evaluate effectiveness
• Findings from previous audits that were never closed out with verified corrective actions
• No evidence that audit results were communicated to relevant management

Auditing Clause 9.3: Management Review

Management review is where senior leadership engages with the performance of the ISMS. This is the part of Clause 9 that most directly tests whether top management is genuinely involved in information security or whether the ISMS is being run entirely by a team below the leadership level. For more on auditing leadership evidence in an ISMS, see the article on auditing leadership and evidence that top management owns the ISMS.

What the Standard Requires

ISO 27001 specifies a list of mandatory inputs that must be considered in the management review. These include the status of actions from previous reviews, changes in external and internal issues relevant to the ISMS, feedback on information security performance including trends in nonconformities and corrective actions, monitoring and measurement results, audit results, fulfilment of information security objectives, feedback from interested parties, results of risk assessment and the status of the risk treatment plan, and opportunities for continual improvement.

The outputs must include decisions related to continual improvement opportunities and any need for changes to the ISMS.

Evidence to Request

Ask for management review minutes or records from the most recent review and at least one prior review. Review the records against the mandatory input list. A well-structured management review record will show that each required input was actually discussed, not just listed. There should be evidence of decisions made and actions assigned, with owners and timeframes.

Testing Whether the Review Was Substantive

This is where auditors need to exercise judgement. A management review can be documented as having covered all the required inputs, but if the minutes show no discussion, no decisions, and no actions, it is difficult to conclude that the review was meaningful. Push for evidence of what was discussed. Ask the management representative or CISO what came out of the last review. Ask what changed as a result. If the answer is nothing, explore whether the review is functioning as intended.

One practical technique is to trace a finding from the previous internal audit through to the management review. If an internal audit raised a finding about access control in a particular system, you would expect to see that finding referenced in the management review inputs, a decision about how to address it, and a corresponding corrective action. If that chain does not exist, the management review is not performing its intended function.

Frequency and Timing

The standard requires management review at planned intervals. Most organisations conduct this annually as a minimum, though higher-risk environments often review more frequently. Check that the review is being conducted at the frequency stated in the ISMS documentation. If the procedure says quarterly reviews and you can only find one review in the past 18 months, that is a nonconformity against the organisation's own requirements.

Common Nonconformities in Clause 9.3

• Management review records that list required inputs but show no evidence of actual discussion
• Reviews conducted by the ISMS team without genuine top management participation
• Missing mandatory inputs, particularly risk assessment status and objective fulfilment
• No outputs in the form of decisions or improvement actions
• Actions from previous reviews that were never followed up
• Review conducted less frequently than stated in the ISMS documentation

Connecting the Three Clauses: The Audit Trail Approach

The most effective way to audit Clause 9 is not to work through each sub-clause in isolation. It is to follow the data. Start with the monitoring and measurement results. Ask where those results went. They should flow into the internal audit programme (as evidence of risk-based scheduling) and into the management review (as a mandatory input). Then ask what decisions came out of the management review and whether those decisions were implemented. If you can trace a clear path from measurement to review to action, the performance evaluation loop is working. If the trail goes cold at any point, that is where your findings will be.

This approach also helps you avoid the trap of auditing documented information in isolation. A beautifully formatted management review report means nothing if the decisions it contains were never implemented. A comprehensive internal audit programme means nothing if the audits were not actually conducted. Always look for the evidence behind the documents, not just the documents themselves. The article on auditing the ISMS risk assessment covers a similar evidence-tracing approach that works well alongside Clause 9 auditing.

Practical Tips for ISMS Performance Evaluation Audits

A few things that make a real difference in practice:

• Review the previous audit findings before you start. If Clause 9 nonconformities were raised in the last cycle, check whether they were closed and whether the root cause was addressed. Repeat findings in the same area are a red flag.
• Do not accept verbal assurances. When someone tells you that monitoring is happening regularly, ask to see the records. When someone says the management review covered all required inputs, ask to see the minutes.
• Test the connection between objectives and measurement. If the organisation has information security objectives under Clause 6.2, there should be corresponding measurements that show progress toward those objectives. If objectives exist but there is no measurement of progress, you have a gap that spans both Clause 6 and Clause 9.
• Look for evidence of trend analysis. Point-in-time data is less useful than trend data. An organisation that can show you that a particular metric has been improving over six months is demonstrating a more mature monitoring process than one that can only show you the most recent result.
• Check the management review against the risk treatment plan. The status of the risk treatment plan is a mandatory management review input. If the review records do not reference the risk treatment plan at all, that is a gap worth raising.

Building Your Competence in ISMS Auditing

Auditing performance evaluation in an ISMS requires a solid understanding of how Clause 9 fits within the broader management system, how monitoring and measurement connect to risk treatment, and how to evaluate the substance of management review records rather than just their format. These are skills that develop with practice, but they also benefit from structured training that explains the intent behind the requirements, not just the words.

If you are working toward ISO 27001 auditor credentials or looking to sharpen your ISMS audit skills, Audit Workshop offers internal auditor and lead auditor training for ISO 27001 delivered by an experienced lead auditor with hundreds of real certification audits behind him. The courses are built around practical application, so you leave with the skills to actually conduct an audit, not just pass an exam. You can explore the available training at auditworkshop.com.