Why Sampling Annex A Is One of the Hardest Things an ISMS Auditor Does
Annex A of ISO 27001 contains 93 controls across four themes. No auditor, regardless of experience, can verify every single one of them in a single audit cycle. That means sampling is not optional. It is the only realistic way to form a defensible conclusion about whether the organisation has implemented its information security controls effectively.
On this page
The problem is that most ISMS auditors are not taught how to sample Annex A controls in any structured way. They either try to cover too much and end up with shallow evidence across the board, or they default to the same familiar controls every time and miss significant gaps. Neither approach serves the auditee or the audit programme well.
This article is a practical guide to sampling Annex A controls intelligently. It covers how to decide which controls to sample, how many to look at, what evidence to gather, and how to avoid the most common mistakes. If you are preparing for an internal ISMS audit or working toward your ISO 27001 lead auditor credential, this is the kind of guidance that makes the difference between a thorough audit and a superficial one.
Understanding What Annex A Actually Is
Before getting into sampling strategy, it is worth being clear about what Annex A is and what it is not. Annex A is a reference set of controls. It is not a checklist that organisations must implement in full. The controls an organisation is required to implement are determined by the risk treatment process under Clause 6.1.3, and documented in the Statement of Applicability.
This matters enormously for sampling. When you arrive to audit Annex A controls, your starting point is not the standard itself. It is the organisation's Statement of Applicability, which tells you which controls are applicable, which have been excluded, and the justification for each decision. From there, you look at the Risk Treatment Plan to understand which controls are in place to address specific identified risks.
If you skip this step and go straight to sampling controls from the standard, you are auditing in the wrong direction. You might spend time on controls the organisation has legitimately excluded, while missing controls they have declared applicable but not actually implemented.
For a deeper look at how the Statement of Applicability connects to the Risk Treatment Plan, see our article on checking the Statement of Applicability against the Risk Treatment Plan.
Exemplar Global Certified Training ProviderRTP No. 310970
The Four Themes of Annex A and Why They Matter for Sampling
ISO 27001:2022 restructured Annex A into four themes, replacing the previous 14 clause structure. Understanding these themes helps you build a more balanced sampling approach.
Organisational Controls (Controls 5.1 to 5.37)
These are policy, governance and process controls. They cover things like information security policies, roles and responsibilities, threat intelligence, supplier relationships, and incident management. Evidence for these controls tends to live in documents, procedures, meeting records, and contracts.
People Controls (Controls 6.1 to 6.8)
These cover the human side of information security. Screening, terms of employment, awareness, training, disciplinary processes, and offboarding. Evidence here comes from HR records, training records, and interviews with staff.
Physical Controls (Controls 7.1 to 7.14)
Physical security perimeters, clear desk and screen policies, physical media handling, equipment security. Evidence comes from site observation, access logs, and policy documents.
Technological Controls (Controls 8.1 to 8.34)
This is the largest theme. It covers user endpoint devices, privileged access, malware protection, network security, data masking, vulnerability management, configuration management, and more. Evidence is often technical, including system configurations, logs, scan reports, and access reviews.
A well designed sampling plan will draw from all four themes rather than concentrating entirely on technical controls. Many auditors are more comfortable in the organisational and technological space and inadvertently neglect people and physical controls. That is where gaps often hide.
How to Build a Risk-Informed Sampling Plan
The single most important principle for sampling Annex A controls is this: follow the risk. The controls that matter most are the ones addressing the organisation's highest risks. Start there.
Step One: Review the Risk Register and Risk Treatment Plan
Before the audit, obtain the risk register and the risk treatment plan. Identify the top ten to fifteen risks by residual risk rating. For each of those risks, note which Annex A controls have been selected as treatment measures. Those controls become your priority sample.
If the organisation has identified ransomware as a top risk and selected controls 8.7 (malware protection), 8.13 (information backup), and 8.12 (data leakage prevention) as treatment measures, those controls should be in your sample regardless of anything else you do.
Step Two: Cross-Reference with the Statement of Applicability
Check that the controls you intend to sample are marked as applicable in the Statement of Applicability. If a control is marked as not applicable, you need to understand the justification before you can decide whether to include it in your sample. Sometimes exclusions are well reasoned. Sometimes they are not, and the exclusion itself becomes a finding.
Step Three: Apply Coverage Logic Across the Four Themes
Once you have your risk-driven priority list, check whether it gives you reasonable coverage across the four themes. If your risk-driven sample is entirely technological controls, deliberately add two or three controls from the people and physical themes. This is not about ticking boxes. It is about ensuring your audit does not have a systematic blind spot.
Step Four: Rotate Controls Between Audit Cycles
Over a three year certification cycle, a well designed audit programme should work toward covering all applicable controls at least once. This means your sampling plan for each individual audit should be informed by what was sampled previously. Keep a record of which controls were sampled in each cycle and use that to guide rotation.
This rotation approach is discussed in more detail in our article on auditing ISMS operations under Clause 8.
How Many Controls Should You Sample?
There is no rule in ISO 27001 or ISO 19011 that specifies a minimum number of Annex A controls to sample. The number depends on the audit scope, the time available, the risk profile of the organisation, and the findings from previous audits.
As a practical benchmark, for a medium-sized organisation with a full ISMS audit scope, sampling between 20 and 30 controls per audit cycle is reasonable. For a surveillance audit where the focus is narrower, 10 to 15 controls may be appropriate, provided they are well chosen and thoroughly verified.
The key word is thoroughly. It is far better to sample 15 controls and gather solid, triangulated evidence for each one than to skim across 40 controls with a single document reference per control. Shallow sampling produces shallow conclusions. Certification bodies and accreditation assessors know the difference.
For more on how to think about sample sizes in ISO auditing generally, see our article on audit sample sizes and how many records are enough.
What Evidence to Gather for Common Control Categories
Once you have selected your sample, you need to know what to look for. Here is practical guidance for the main control categories.
Policy and Procedure Controls
For controls that require documented policies or procedures, the evidence you need is straightforward but easy to get wrong. Do not just confirm the document exists. Confirm it is current, it has been approved, it has been communicated to relevant personnel, and people actually understand it. Ask an employee to explain what the information classification policy means for their day to day work. If they cannot, the policy is not functioning as a control.
Access Management Controls
Controls around user access rights, privileged access, and access review are among the most commonly sampled in ISMS audits. For these, you want to see the access provisioning process, evidence of periodic access reviews, and examples of access being removed when someone leaves or changes roles. Ask for a list of users with privileged access and verify it against current employment records. Orphaned accounts are a classic finding.
Supplier and Third Party Controls
Control 5.19 through 5.22 cover information security in supplier relationships. Evidence includes supplier contracts with information security clauses, supplier risk assessments, and records of supplier performance monitoring. Ask to see a recent supplier review. Ask what happens when a supplier has a security incident. The answers reveal whether this is a real control or a paper one.
Incident Management Controls
Control 5.24 through 5.28 cover incident management. Look for the incident response procedure, the incident log, and evidence that incidents have been assessed and responded to. Even if there have been no major incidents, there should be evidence that the process has been tested, either through a tabletop exercise or a real event. An incident management procedure that has never been used or tested is not a functioning control.
Vulnerability Management
Control 8.8 requires management of technical vulnerabilities. Evidence includes vulnerability scan reports, patch management records, and evidence that vulnerabilities are prioritised and remediated within defined timeframes. Ask for the most recent scan report and check whether identified vulnerabilities have been actioned. The gap between scan date and remediation date is often revealing.
Backup and Recovery
Control 8.13 covers information backup. Ask to see the backup policy, the backup schedule, and evidence that backups are tested. A backup that has never been tested for restoration is not a control. It is a hope. This is one of the controls where the gap between what the policy says and what actually happens is widest.
Common Mistakes When Sampling Annex A Controls
Sampling the Same Controls Every Time
This is the most common problem. Auditors develop a comfort zone around certain controls and return to them repeatedly. Access management and information security policy get sampled every audit. Physical controls, supplier security, and human resource security get ignored. Over a three year cycle, this leaves large portions of the control set unverified.
Treating the SoA as a Checklist
The Statement of Applicability tells you what controls the organisation says are applicable. It does not tell you whether those controls are actually implemented. The audit is about closing that gap. Do not treat a tick in the SoA as evidence of implementation. That is circular reasoning.
Accepting Documents as Proof of Implementation
A policy document is not evidence that the policy is followed. An access review procedure is not evidence that access reviews happen. Always triangulate. For every control you sample, look for at least two forms of evidence: a document or record, and either an interview or an observation that confirms the control is operating in practice.
This principle is explored in depth in our article on triangulating audit evidence through documents, people and observation.
Ignoring Implemented Controls That Are Not in the SoA
Sometimes organisations implement security measures that are not captured in the Statement of Applicability. This can happen when the ISMS has not been kept current with actual practice. If you observe a control in operation that is not reflected in the SoA, that is a finding worth noting. It suggests the SoA is not an accurate representation of the control environment.
Writing Up Findings Against Annex A Controls
When you identify a nonconformity against an Annex A control, the finding needs to reference both the control number and the clause of the standard that requires the control to be implemented. The relevant clause is 6.1.3, which requires that applicable controls be implemented. The Annex A control number provides the specific requirement that has not been met.
A well written nonconformity against Annex A might read: the organisation's Statement of Applicability identifies Control 8.8 (Management of technical vulnerabilities) as applicable. However, no evidence was found of vulnerability scanning having been conducted in the past 12 months, and no vulnerability management procedure was available. This does not conform to the requirements of Clause 6.1.3(d), which requires that applicable controls be implemented.
Be specific. Name the control. Describe the gap. Reference the evidence you looked for and did not find. Vague findings like “vulnerability management needs improvement” are not useful and will not drive meaningful corrective action.
Exemplar Global Certified Training ProviderRTP No. 310970Building Annex A Sampling Into Your Audit Programme
For organisations running their own internal ISMS audit programme, Annex A sampling should be planned at the programme level, not just the individual audit level. This means deciding at the start of each three year cycle which controls will be prioritised in which audit, and tracking coverage over time.
A simple spreadsheet listing all applicable controls, with columns for each audit cycle showing which controls were sampled and what the outcome was, is sufficient. This gives your audit programme manager visibility over coverage and ensures that high risk controls are revisited more frequently than lower risk ones.
This kind of structured approach is what separates an audit programme that provides genuine assurance from one that simply goes through the motions.
Getting the Skills to Do This Well
Sampling Annex A controls effectively requires more than familiarity with the standard. It requires an understanding of risk treatment logic, evidence evaluation, and how to structure an audit that produces defensible conclusions. These are skills that develop through training and practice, not just reading.
At Audit Workshop, the ISO 27001 Lead Auditor course covers exactly this kind of practical audit methodology, including how to plan a sampling approach, how to gather and evaluate evidence against Annex A controls, and how to write findings that hold up to scrutiny. If you are working toward your ISO 27001 auditor credential or want to sharpen your ISMS audit skills, the ISO 27001 Lead Auditor course is a practical starting point.
