Systems & standards
ISO/IEC 27001 Management Systems Review
Independent review of your information security management system, documentation, controls and supporting evidence.
ISO/IEC 27001:2022 · Information Security Management Systems
What it is
A structured review of your information security management system
ISO/IEC 27001:2022 specifies requirements for an Information Security Management System (ISMS). It provides a framework for managing information-security risks through organisational processes, people, technology and controls.
DAN AUDITS provides an independent review of the structure, documentation, controls and supporting evidence within your ISMS. The review is designed for organisations preparing for certification, maintaining an existing ISMS, or seeking an independent view before formal assessment.
The approach
The review is built around information-security evidence
The review looks beyond whether policies and procedures exist. It considers whether the ISMS is coherent, whether the risk process connects to the control environment, whether responsibilities are clear, and whether objective evidence supports the documented arrangements.
- ISMS scope, organisational context and information-security objectives
- Information-security policy and management-system structure
- Risk assessment and risk-treatment arrangements
- Statement of Applicability and control selection
- Documented procedures, operational controls and records
- Roles, responsibilities, competence and awareness
- Monitoring, measurement and information-security performance
- Internal audit and management review arrangements
- Nonconformity, corrective action and continual improvement
- Evidence supporting the operation and effectiveness of relevant controls
Current edition
ISO/IEC 27001:2022, the current framework
ISO/IEC 27001:2022 is the current published edition. ISO also published Amendment 1:2024, which introduces climate-action considerations into management-system standards.
Where relevant to the organisation's context, the review can consider how the current ISMS documentation reflects applicable requirements, including the relationship between organisational context, risks, controls and supporting evidence.
Technical capability
Third-party certification-audit experience, not consultancy alone
DAN AUDITS reviews are carried out by a third-party auditor with certification-body audit experience, supported by formal BSI Lead Auditor Practitioner qualifications and ISO/IEC 27001:2022 Lead Auditor training.
The difference is the perspective: independent assessment of documented arrangements, controls and objective evidence from a certification-audit standpoint.
What it is not
Independent review, not certification
- DAN AUDITS does not configure security controls or implement the ISMS.
- DAN AUDITS does not issue ISO/IEC 27001 certificates or act as a certification body.
- DAN AUDITS does not make certification decisions or guarantee a certification outcome.
What we review
- ISMS scope and context. Whether the defined scope, organisational context, interested parties and information-security objectives are coherent.
- Risk assessment and treatment. Whether the risk methodology, assessment results and treatment arrangements connect logically to the ISMS.
- Statement of Applicability. Its structure, rationale and relationship to selected controls, risks and supporting evidence.
- Control environment. Whether relevant policies, procedures, responsibilities and operational controls are documented and supported by evidence.
- Performance and assurance. Monitoring, measurement, internal audit, management review, nonconformity and corrective-action arrangements.
Typical evidence and documentation
- Information-security policy and objectives
- ISMS scope and organisational context
- Risk assessment methodology and risk register
- Risk treatment plan
- Statement of Applicability
- Information-security policies, procedures and control documentation
- Asset, access, supplier and operational-control records where applicable
- Monitoring and measurement information
- Internal audit and management review records
- Nonconformity and corrective-action records
What you receive
Clear, practical outputs
- A written independent review
- Clearly identified findings and points requiring attention
- A structured gap summary against the applicable ISO/IEC 27001 requirements
- Identification of inconsistencies between documented arrangements, controls and supporting evidence
- Clear next steps for your organisation to consider before formal assessment or continued operation of the ISMS
Why it matters
Why an independent third-party audit perspective matters
Information-security documentation can appear comprehensive while important links between risks, controls, responsibilities and evidence remain unclear. A third-party certification-audit perspective examines whether those links can be demonstrated objectively, rather than simply whether the documentation looks complete.
FAQs
ISO 27001 review: common questions
What is an ISO/IEC 27001 Management Systems Review?
An independent, structured review of your ISMS documentation, controls and supporting evidence against the applicable ISO/IEC 27001 requirements. It is a review and analysis, not implementation or certification.
What edition does the review cover?
The review is based on ISO/IEC 27001:2022, the current published edition, together with applicable published amendments.
What is the Statement of Applicability?
The Statement of Applicability records the organisation's treatment of applicable controls within its ISMS. The review considers its structure, rationale and relationship to the risk process and supporting evidence.
Can you review an ISMS before certification?
Yes. The review can identify gaps, inconsistencies and evidence issues before a formal third-party assessment. The certification decision remains with the organisation's certification body.
Do you issue ISO/IEC 27001 certificates?
No. DAN AUDITS is not a certification body and does not issue certificates or make certification decisions.
Do you implement the ISMS or configure security controls?
No. The service is an independent review of the management system, documentation, controls and evidence.
Is the review fixed-fee?
Yes. Each engagement is independently scoped and agreed on a fixed-fee basis before work starts.
Start with a short intro call
We will confirm the scope of the ISMS review, the applicable ISO/IEC 27001 requirements and whether the service is the right fit for your organisation. Independent, fixed-fee, and commission-free.