ISO 27001 A.5.35: Independent Review of Information Security

Quick Reference: A.5.35 in 60 Seconds

What the Standard Actually Requires

Figure · Process

What A.5.35 asks you to do

ISO 27001:2022 A.5.35 Control Text

ISO 27001:2022 Annex A 5.35 asks organizations to review the organization's approach to managing information security independently, at planned intervals and after significant changes.

This single sentence contains five mandatory elements:

ISO 27002:2022 Implementation Guidance (Section 5.35)

ISO 27002:2022 provides the following implementation guidance for A.5.35:

1. Independence of reviewers, Reviewers should be independent of the activities being reviewed. Where full independence is not feasible due to organization size, independence should be maximized through reporting lines, scope separation, or external support.
2. Competence, Reviewers should be competent in information security management, auditing principles, and the technologies/processes under review.
3. Risk-based planning, Reviews should be planned based on risk, previous findings, regulatory requirements, and changes.
4. Scope coverage, Reviews should assess whether the ISMS conforms to the organization's own policies and procedures and to ISO 27001, and whether it is effectively implemented and maintained.
5. Reporting, Results should be documented and reported to relevant management, including top management where appropriate.
6. Follow-up, Findings should be tracked to closure with evidence of corrective action.

Shall / Should / May Analysis

What Auditors Actually Check

Why Independent Review Matters

The Business Risk Narrative

Independent review is the immune system of the ISMS. Without it, organizations operate on assumptions: "Our policies are followed," "Our controls work," "Our risks are managed." These assumptions are dangerous. An independent review tests reality against intention. It discovers whether the security program is performative or operational, whether risk treatment is effective or decorative, and whether management has the information it needs to govern.

The consequences of weak independent review include:

• Undetected control failures that persist for months or years.
• External audit nonconformities and certification suspension.
• Regulatory penalties for failing to demonstrate assurance.
• Breaches that exploit known but unremediated weaknesses.
• Loss of customer trust and enterprise revenue.

Indian Regulatory Context

Indian organizations face a layered assurance environment. A.5.35 is not an abstract ISO checkbox; it aligns directly with Indian legal and supervisory expectations.

Digital Personal Data Protection Act, 2023 (DPDP Act)

Section 8 of the DPDP Act requires data fiduciaries to implement "reasonable security safeguards" to prevent personal data breaches. Section 9 imposes additional duties on significant data fiduciaries, including the appointment of a Data Protection Officer and the conduct of periodic independent audits. While the DPDP Rules are still under finalization, the statutory intent is clear: independent review of security controls will be a compliance obligation for many organizations. A.5.35 implementation prepares organizations for this requirement.

Reserve Bank of India (RBI)

• Cyber Security Framework in Banks (2016): Banks must conduct periodic independent assurance audits of their cyber security posture. The board must review assurance reports.
• Master Direction on Information Technology Framework for NBFCs: Requires NBFCs to establish an internal audit function for IT and cyber security, with reporting to the board or audit committee.
• Cyber Security Information Technology (CSIT) directions: Regulated entities must report incidents within six hours and maintain strong assurance mechanisms.

Securities and Exchange Board of India (SEBI)

SEBI's cybersecurity circulars for market infrastructure institutions (MIIs), stock brokers, depository participants, and mutual funds mandate:

• Half-yearly cybersecurity audits by empaneled auditors.
• Submission of audit reports to SEBI.
• Remediation timelines and evidence of closure.
• Board-level review of cybersecurity posture.

Insurance Regulatory and Development Authority of India (IRDAI)

IRDAI's cybersecurity guidelines for insurers require:

• An information security governance framework.
• Periodic internal and external audits.
• Reporting of cyber incidents.
• Maintenance of audit trails.

CERT-In Directions, 2022

CERT-In's directions under the IT Act, 2000 require:

• Reporting of specified cyber incidents within six hours.
• Maintenance of ICT asset inventory and user logs.
• Synchronization of ICT system clocks. Independent reviews validate whether these operational requirements are actually met.

Information Technology Act, 2000

Section 43A imposes liability on body corporates for negligence in implementing and maintaining reasonable security practices. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 recognize ISO 27001 as a valid security standard. An effective A.5.35 program provides evidence of due diligence in court or regulatory proceedings.

Industry-Specific Consequences

impact of Non-Compliance: Statistics and Research

A single major nonconformity on A.5.35, for example, an internal audit function that lacks independence, can lead to a corrective action request, suspension of certification, and cascading customer and regulatory consequences.

Scope and Applicability

What A.5.35 Covers

A.5.35 applies to the review of the entire ISMS implementation, not just technical controls. The scope includes:

Who It Applies To

A.5.35 applies to all organizations seeking or maintaining ISO 27001 certification, regardless of size or sector. The implementation approach varies:

Role Categories Covered by Review

Key Definitions and Terminology

Relationship to Other Controls

A.5.35 does not operate in isolation. It provides assurance over the implementation of many other controls.

Upstream Controls (Inputs to A.5.35)

Downstream Controls (Assured by A.5.35)

Parallel Controls (Complementary Assurance)

The Internal Audit vs. Independent Review Distinction

Is A.5.35 the Same as Internal Audit?

Not exactly. A.5.35 requires an independent review of information security. Internal audit is the most common and strong way to satisfy this requirement, but other models are possible if they preserve independence and competence.

Independence Continuum

LEAST INDEPENDENT                                    MOST INDEPENDENT
─────────────────────────────────────────────────────────────────────►
Self-review by CISO    Peer review by    Internal audit    Co-sourced    Fully outsourced
or IT manager          unrelated manager reporting to      internal      internal audit
                                            board/CEO        audit        by Big 4 /
                                                                           specialist

The Three Lines Model Applied to A.5.35

┌─────────────────────────────────────────────────────────────────┐
│  LINE 1: OPERATIONS (Owns Risk)                                 │
│  • IT, Engineering, HR, Facilities, Procurement                 │
│  • Implement and operate controls                               │
│  • Perform control self-assessments                             │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│  LINE 2: RISK & COMPLIANCE OVERSIGHT                            │
│  • CISO, Risk Manager, Compliance Officer, DPO                  │
│  • Establish policies, monitor compliance, report to management │
│  • NOT independent of management; provides oversight            │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│  LINE 3: INDEPENDENT ASSURANCE (A.5.35)                         │
│  • Internal Audit / Independent Review Function                 │
│  • Reports to Board / Audit Committee / CEO                     │
│  • Independent of operations and security management            │
└─────────────────────────────────────────────────────────────────┘

Critical point: If the CISO or security team also performs the internal audit, the organization has violated the independence requirement of A.5.35, regardless of how competent the individuals are.

Building the Independent Review Function

Organizational Options by Size

Independence Safeguards Checklist

• The audit function has a formal charter approved by top management or the board.
• The audit function has unrestricted access to people, records, systems, and premises.
• The head of audit has direct access to the CEO / Board / Audit Committee without management filtering.
• Auditors do not audit operations for which they are responsible.
• Auditors are not incentivized based on the performance of the areas they audit.
• Audit scope and plan cannot be unilaterally overridden by operational management.
• Auditors have a documented conflict-of-interest declaration process.
• Where the same person must perform security operations and audit (very small orgs), a record of mitigating controls exists (e.g., external review, management review, board oversight).

Audit Charter Template (Key Clauses)

INTERNAL AUDIT / INDEPENDENT REVIEW CHARTER
[Organization Name]
Version: 1.0
Approved by: [Board / Audit Committee / CEO]
Date: [Date]
Review Date: [Date + 12 months]

1. PURPOSE
This charter establishes the authority, independence, responsibility, and scope
of the independent review of information security at [Organization Name].

2. AUTHORITY
The independent review function is authorized to:
   • Access all information, records, systems, personnel, and premises relevant
to information security.
   • Request assistance from any employee or third party.
   • Report findings directly to the Audit Committee / Board / CEO.
   • Escalate unresolved high-risk findings without management interference.

3. INDEPENDENCE
The independent review function shall be independent of the activities reviewed.
The Head of Internal Audit reports functionally to the [Audit Committee / Board]
and administratively to the [CEO].

4. SCOPE
The scope includes the ISMS, information security policies, procedures, controls,
people, processes, and technologies, including outsourced operations.

5. RESPONSIBILITIES
   • Develop and maintain a risk-based audit plan.
   • Conduct audits in accordance with ISO 19011 principles.
   • Issue clear, risk-rated findings and recommendations.
   • Track findings to closure.
   • Provide input to management review.
   • Maintain auditor competence.

6. QUALITY ASSURANCE
The audit function shall undergo periodic internal and external quality assessments.

7. APPROVAL
This charter is approved by:
   [Chairperson, Audit Committee]    Date: __________
   [CEO]                             Date: __________
   [Head of Internal Audit]          Date: __________

Audit Charter and Governance

Governance Structure

┌─────────────────────────────────────────────────────────────┐
│  BOARD OF DIRECTORS / GOVERNING BODY                        │
│  • Ultimate oversight of information security               │
│  • Approves audit charter and risk appetite                 │
│  • Receives summary audit reports                           │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  AUDIT COMMITTEE (or equivalent)                            │
│  • Oversees internal audit function                         │
│  • Approves annual audit plan                               │
│  • Reviews significant findings and remediation             │
│  • Hires / fires Head of Internal Audit                     │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  HEAD OF INTERNAL AUDIT / INDEPENDENT REVIEW                │
│  • Develops audit plan                                      │
│  • Ensures independence and competence                      │
│  • Signs off on audit reports                               │
│  • Escalates unresolved issues                              │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  AUDIT TEAM(S)                                              │
│  • Execute audit engagements                                │
│  • Document working papers                                  │
│  • Test controls and sample evidence                        │
│  • Draft findings and reports                               │
└─────────────────────────────────────────────────────────────┘

Audit Committee Agenda (Quarterly)

Audit Planning and Risk Assessment

Risk-Based Audit Planning Process

┌─────────────────────────────────────────────────────────────┐
│  STEP 1: UNDERSTAND CONTEXT                                 │
│  • ISMS scope, assets, processes, locations                 │
│  • Risk register and risk treatment plan                    │
│  • Legal / regulatory requirements                          │
│  • Previous audit findings                                  │
│  • External audit / certification history                   │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  STEP 2: RISK ASSESSMENT FOR AUDIT PLANNING                 │
│  • Inherent risk by process / system / location             │
│  • Control effectiveness from prior reviews                 │
│  • Regulatory and customer priority                         │
│  • Recent changes and incidents                             │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  STEP 3: PRIORITIZE AND SCHEDULE                            │
│  • High-risk areas audited more frequently                  │
│  • All Annex A controls covered over audit cycle            │
│  • Resource allocation and timing                           │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  STEP 4: APPROVE PLAN                                       │
│  • Audit Committee / top management approval                │
│  • Communicate plan to stakeholders                         │
└─────────────────────────────────────────────────────────────┘

Risk Scoring for Audit Planning

Audit Priority Score = Σ (Factor Weight × Score)

Sample Three-Year Audit Plan

Note: High-risk areas should be audited every year regardless of the cycle.

Competence and Independence Requirements

Auditor Competence Framework

Independence Threats and Mitigations

Conflict-of-Interest Declaration Template

CONFLICT-OF-INTEREST DECLARATION
Audit Engagement: ________________________________
Auditor Name: ________________________________
Date: ________________________________

I declare that:
   ☐ I have no financial or personal interest in the area or personnel being audited.
   ☐ I have not been involved in designing, implementing, or operating the controls
      being audited in the past 12 months.
   ☐ I have no close family relationship with any manager in the audited area.
   ☐ I am not aware of any other circumstance that could impair my objectivity.

If any of the above is NOT true, describe below:
________________________________________________

Mitigation agreed:
________________________________________________

Auditor Signature: __________________ Date: __________
Audit Manager Signature: ____________ Date: __________

Conducting the Independent Review

Audit Engagement Lifecycle

┌─────────────────────────────────────────────────────────────┐
│  1. ENGAGEMENT PLANNING                                     │
│  • Define objectives, scope, criteria                       │
│  • Identify auditee, resources, timing                      │
│  • Prepare audit program and checklists                     │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  2. OPENING MEETING                                         │
│  • Confirm scope and schedule                               │
│  • Introduce audit team                                     │
│  • Explain methodology and independence                     │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  3. FIELDWORK / EVIDENCE GATHERING                          │
│  • Interviews, document review, observation, testing        │
│  • Sample selection and testing                             │
│  • Working paper documentation                              │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  4. ANALYSIS AND FINDING FORMULATION                        │
│  • Evaluate evidence against criteria                       │
│  • Rate risk and formulate findings                         │
│  • Validate with auditee (no surprises)                     │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  5. REPORTING                                               │
│  • Draft audit report                                       │
│  • Management response and action plan                      │
│  • Finalize and distribute                                  │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  6. FOLLOW-UP AND CLOSURE                                   │
│  • Track corrective actions                                 │
│  • Verify closure evidence                                  │
│  • Escalate overdue items                                   │
└─────────────────────────────────────────────────────────────┘

Audit Program Template: A.5.35 Review of Information Security

Audit Sampling Guidance

Sample selection must be risk-based and representative, not convenience-based. Document the sampling method in working papers.

Audit Evidence Collection Techniques

Evidence Types and Reliability

Interview Techniques for Auditors

Working Paper Requirements

Every audit finding must be supported by working papers containing:

• Audit objective and criteria.
• Population and sampling method.
• Evidence collected (with references to documents, logs, screenshots).
• Auditor analysis and conclusion.
• Finding classification (conformity / nonconformity / OFI).
• Risk rating and rationale.
• Cross-reference to final report.

Reporting and Management Review

Audit Report Structure

INDEPENDENT REVIEW REPORT — INFORMATION SECURITY
[Organization Name]
Audit Engagement: ________________________________
Audit Period: ________________________________
Report Date: ________________________________
Distribution: Audit Committee, CEO, CISO, [relevant management]

1. EXECUTIVE SUMMARY
   • Overall opinion on ISMS effectiveness
   • Number and severity of findings
   • Key themes and trends

2. AUDIT SCOPE AND OBJECTIVES
   • What was reviewed and why
   • Audit criteria (ISO 27001, policies, regulations)

3. METHODOLOGY
   • Sampling approach, evidence types, interviews conducted

4. FINDINGS
   For each finding:
   • Finding ID and title
   • Risk rating (Critical / High / Medium / Low)
   • ISO 27001 / policy clause reference
   • Condition (what was found)
   • Criterion (what should be)
   • Cause (root cause)
   • Effect (risk / impact)
   • Recommendation

5. MANAGEMENT RESPONSE AND ACTION PLAN
   • Agreed actions, owners, target dates

6. OVERALL OPINION
   • Effective / Partially Effective / Ineffective

7. APPENDICES
   • Detailed test results, sample lists, evidence references

Risk Rating Matrix for Findings

Management Review Input

A.5.35 outputs must feed into ISO 27001 Clause 9.3 Management Review. Inputs include:

• Summary of audit results (internal and external).
• Status of open findings and corrective actions.
• Trends in incidents and control failures.
• Resource adequacy of the audit function.
• Changes affecting the ISMS.
• Recommendations for improvement.

Corrective Action and Continuous Improvement

Findings Register

Corrective Action Process

FINDING IDENTIFIED
        │
        ▼
ROOT CAUSE ANALYSIS
(5 Whys / Fishbone / Fault Tree)
        │
        ▼
CORRECTIVE ACTION PLAN
(Who, What, When, Evidence)
        │
        ▼
MANAGEMENT APPROVAL
        │
        ▼
ACTION IMPLEMENTATION
        │
        ▼
VERIFICATION BY AUDITOR
(Evidence review, retest)
        │
        ▼
FINDING CLOSED

Escalation Protocol for Overdue Findings

Tools, Technologies, and Solutions

GRC and Audit Management Platforms

Technical Testing Tools for Audit Evidence

Build vs. Buy vs. Outsource

Policy and Procedure Templates

Independent Review / Internal Audit Policy (Extract)

INDEPENDENT REVIEW OF INFORMATION SECURITY POLICY
[Organization Name]
Version: 1.0
Owner: Head of Internal Audit
Approved by: [CEO / Audit Committee Chair]
Date: [Date]
Review Date: [Date + 12 months]

1. PURPOSE
This policy defines the requirements for independent review of the organization's
information security management system (ISMS) and its implementation.

2. SCOPE
This policy applies to all ISMS processes, controls, personnel, technologies,
locations, and third-party operations within the defined ISMS scope.

3. POLICY STATEMENTS
3.1 The organization shall conduct independent reviews of information security
    at planned intervals and when significant changes occur.
3.2 Reviews shall be conducted by competent reviewers who are independent of
    the activities being reviewed.
3.3 Reviews shall assess conformance to ISO 27001, organization policies, and
    applicable legal/regulatory requirements.
3.4 Review findings shall be documented, risk-rated, reported to management,
    and tracked to closure.
3.5 Results of independent reviews shall be input to management review.
3.6 The review function shall have an approved charter, unrestricted access,
    and a reporting line to top management or the audit committee.

4. ROLES AND RESPONSIBILITIES
4.1 Board / Audit Committee: Approve charter, approve plan, oversee findings.
4.2 Head of Internal Audit: Plan, execute, and report independent reviews.
4.3 Process Owners: Provide access, implement corrective actions.
4.4 CISO: Support audits, remediate security findings (but does not audit own function).

5. INDEPENDENCE AND CONFLICTS
5.1 Auditors shall not audit their own work.
5.2 Auditors shall declare conflicts of interest before each engagement.
5.3 Where full independence is not achievable, mitigation shall be documented
    and approved by top management.

6. COMPETENCE
6.1 Auditors shall maintain relevant qualifications (CISA, qualified lead auditor,
    certified, or equivalent).
6.2 Auditors shall complete at least 20 hours of continuing professional
    development annually.

7. PLANNING AND EXECUTION
7.1 A risk-based audit plan shall be prepared annually and approved by the
    Audit Committee / top management.
7.2 Audit engagements shall follow the documented audit methodology aligned
    with ISO 19011.
7.3 Audit working papers shall be maintained securely and retained for at
    least [X] years.

8. REPORTING AND FOLLOW-UP
8.1 Audit reports shall be issued within [15/30] days of engagement completion.
8.2 Management shall provide responses and action plans within [15] days.
8.3 Findings shall be tracked in a central register until closure.
8.4 Overdue findings shall be escalated per the escalation matrix.

9. REVIEW
This policy is reviewed annually and on significant change.

Audit Procedure Template (Extract)

PROCEDURE: CONDUCTING INDEPENDENT INFORMATION SECURITY REVIEWS

1. PURPOSE
To define the steps for planning, conducting, reporting, and following up on
independent reviews of information security.

2. SCOPE
All ISMS audits, reviews, and assurance engagements.

3. PROCEDURE STEPS

Step 1 — Annual Planning
   a. Review risk register, previous findings, incident trends, regulatory changes.
   b. Develop risk-based audit plan covering all Annex A controls over [3-year] cycle.
   c. Obtain Audit Committee / top management approval.

Step 2 — Engagement Planning
   a. Define objectives, scope, and criteria.
   b. Assign competent, independent auditors.
   c. Issue engagement letter / notification to auditee at least 2 weeks in advance.
   d. Prepare audit program and checklists.

Step 3 — Opening Meeting
   a. Confirm scope, schedule, and contacts.
   b. Explain independence and confidentiality obligations.
   c. Document attendance and agreements.

Step 4 — Fieldwork
   a. Conduct interviews, document reviews, observations, and testing.
   b. Maintain working papers with evidence references.
   c. Hold daily debriefs to discuss emerging issues.

Step 5 — Findings Validation
   a. Draft findings and share with auditee for factual accuracy.
   b. Allow auditee to provide additional evidence.
   c. Finalize risk ratings.

Step 6 — Reporting
   a. Draft audit report within [15] days.
   b. Obtain management responses and action plans.
   c. Finalize and distribute to approved recipients.

Step 7 — Follow-Up
   a. Track corrective actions to target dates.
   b. Verify closure evidence.
   c. Report status to Audit Committee / management review.

4. RECORDS
   • Annual audit plan
   • Engagement planning documents
   • Working papers
   • Audit reports
   • Findings register
   • Closure evidence

Risk Assessment and Treatment

A.5.35-Specific Risk Table

Risk Treatment Summary

Audit and Compliance Checklist

A.5.35 Audit Checklist (for Internal / External Auditors)

Compliance Evidence Mapping

Metrics and KPIs

Audit Function KPIs

KPI Dashboard Template

INDEPENDENT REVIEW KPI DASHBOARD — Q2 2026
[Organization Name]

AUDIT PLAN
   Planned audits: 12
   Completed: 11
   Completion rate: 91.7% ⚠️ (target 95%)

FINDINGS
   Open: 23
   Critical: 1 (age 8 days)
   High: 5 (avg age 22 days)
   Medium: 10
   Low: 7
   Closed on time: 94% ✅

COMPETENCE & INDEPENDENCE
   Auditor qualification compliance: 100% ✅
   Independence compliance: 100% ✅
   CPD hours per auditor: 24 ✅

EXTERNAL AUDIT ALIGNMENT
   External certification findings: 2
   Previously identified internally: 2
   Internal coverage: 100% ✅

TOP RISKS
   1. Delayed closure of privileged access review finding
   2. One supplier audit postponed due to resource constraints

Common Pitfalls / Audit Failures & How to Avoid Them

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: Bengaluru Fintech, Major Nonconformity on Independence

Background A 300-employee fintech startup in Bengaluru processed payments and lending data for over 1 million customers. The company had achieved ISO 27001 certification two years earlier and was preparing for recertification.

The Incident During the Stage 1 recertification audit, the external auditor reviewed the internal audit function. The findings were severe:

• The "Internal Audit Manager" reported directly to the CISO.
• The internal audit plan was drafted by the CISO and approved by the CISO.
• Two of three internal auditors were former members of the IT security team.
• The internal audit report for the previous year had been edited by the CISO before submission to management.
• The audit had not reviewed any area owned by the CISO (risk assessment, incident management, security operations).

The external auditor issued a major nonconformity against A.5.35 and suspended the certification process.

Impact

• ISO 27001 recertification delayed by 6 months.
• Two enterprise customers (a bank and an NBFC) put partnership agreements on hold, citing loss of certification.
• Estimated revenue impact: s in delayed deals.
• Regulatory scrutiny increased because the company was also preparing for RBI NBFC cyber security compliance.

Root Cause Analysis

1. Structural independence failure: The audit function was structurally subordinate to the function it was supposed to review.
2. Conflict of interest: Former IT security staff auditing their old colleagues created familiarity and intimidation threats.
3. Lack of board oversight: No audit committee existed; the board received only summarized, sanitized reports.
4. overhead-driven design: The company had combined the CISO and internal audit roles to save headcount.
5. Weak understanding of A.5.35: The team treated internal audit as a compliance checkbox rather than a governance control.

Remediation The company engaged Singahi to redesign the independent review function:

Phase 1, Restructure (Week 1-2):

• Created an Internal Audit Charter approved by the Board.
• Appointed a Head of Internal Audit reporting functionally to the Board and administratively to the CEO.
• Removed internal audit from the CISO's organization.
• Implemented conflict-of-interest declarations and auditor rotation.

Phase 2, Re-audit (Week 3-8):

• Re-performed the prior year's internal audit with the new independent team.
• Added external co-source for technical security testing.
• Audited the CISO function directly for the first time.
• Identified 18 findings, including 3 high-risk gaps in incident response and privileged access.

Phase 3, Close and Certify (Month 3-6):

• Tracked all findings to closure with verified evidence.
• Updated management review process to include unfiltered audit inputs.
• Passed follow-up external audit with no A.5.35 nonconformity.

Results

• Recertification achieved 6 months after initial suspension.
• Regained enterprise customer trust; both partnerships signed.
• Board established a quarterly Audit Committee agenda item for information security.
• Investment: Revenue protected/added: + crores.

Key Lessons

1. Independence is non-negotiable. A CISO cannot audit their own function.
2. Organizational design matters more than individual integrity.
3. Board/audit committee oversight is essential for credible assurance.
4. The impact of remediation far exceeds the impact of designing independence correctly from the start.
5. A.5.35 is a governance control, not a documentation exercise.

Illustrative Scenario 2: Mumbai NBFC, From Regulatory Warning to RBI-Ready Assurance

Background A mid-sized non-banking financial company (NBFC) in Mumbai with 800 employees and s in assets under management had grown rapidly through digital lending. The RBI Master Direction on IT Framework for NBFCs required periodic independent audits of IT and cyber security.

The Incident During an RBI thematic inspection, the regulator observed:

• No documented independent review of cyber security in the past 24 months.
• IT audit was performed by the IT department itself.
• Findings from previous external audits were not tracked to closure.
• No evidence that the board reviewed cyber security assurance.

RBI issued a warning letter requiring corrective action within 90 days and a follow-up submission.

Impact

• Board and senior management reputation risk.
• Potential restriction on onboarding new digital borrowers.
• Increased impact of compliance and external audit support.
• Customer and investor confidence shaken.

Root Cause Analysis

1. Compliance silos: The compliance team managed RBI reporting, the IT team managed controls, and internal audit focused on financial audits. Cyber security assurance fell through the gaps.
2. No risk-based IT audit plan: The annual internal audit plan did not include cyber security as a priority.
3. Inadequate board reporting: Cyber security was a single slide in the annual board presentation, with no assurance opinion.
4. Resource constraints: The internal audit team had financial audit expertise but no cyber security competence.

Remediation Singahi designed an integrated assurance program aligned with RBI and ISO 27001:

Phase 1, Setup (Week 1-3):

• Drafted Information Security Independent Review Policy and Charter.
• Appointed a Head of IT Audit with CISA and qualified lead auditor credentials.
• Established an IT Audit Sub-Committee of the Board.
• Created a 3-year risk-based audit plan covering RBI cyber security domains and ISO 27001 Annex A.

Phase 2, Execution (Week 4-10):

• Conducted complete independent review of cyber security governance, access control, incident management, vendor management, data protection, and business continuity.
• Used co-sourced technical testing (penetration testing, configuration review, log analysis).
• Identified 32 findings, including critical gaps in data localization logging and privileged access.

Phase 3, Closure and Reporting (Week 11-13):

• Management action plans approved by the Board.
• Follow-up testing verified closure of all critical and high findings.
• Submitted detailed assurance report to RBI within the deadline.

Results

• RBI accepted the remediation; no further enforcement action.
• Board now receives quarterly cyber security assurance dashboards.
• ISO 27001 surveillance audit passed with zero findings on A.5.35.
• Customer due diligence improved; two new institutional investors completed security assessments successfully.
• Investment: Regulatory and reputational risk: substantially reduced.

Key Lessons

1. Financial audit expertise does not equal information security audit expertise.
2. Regulators expect board-level oversight and independent assurance, not self-certification.
3. A risk-based audit plan must explicitly cover cyber security, data protection, and third parties.
4. Co-sourcing technical expertise is a practical way to build credibility quickly.
5. A.5.35 compliance directly supports regulatory compliance with RBI, SEBI, IRDAI, and DPDP Act expectations.

Multi-Framework Mapping

Implementation Roadmap

8-Week Implementation Roadmap

90-Day Sprint for New ISMS

FAQ

Is internal audit mandatory for ISO 27001?

Not explicitly. ISO 27001 requires an independent review of information security (A.5.35). Internal audit is the standard way to satisfy this, but other models are acceptable if they preserve independence and competence. For most organizations, a formal internal audit function or co-sourced/outsourced equivalent is expected by certification auditors.

Can the CISO perform the internal audit?

No. The CISO cannot independently review their own function. This is the most common A.5.35 failure. Independence requires separation. The CISO can support the audit by providing evidence and implementing corrective actions, but cannot be the auditor or approve the audit scope/report for their own area.

How often must the independent review be conducted?

At planned intervals, typically at least annually for the overall ISMS, and more frequently for high-risk areas. Additionally, reviews must be triggered by significant changes such as mergers, acquisitions, cloud migration, major incidents, new regulations, or major system launches.

What qualifications should an information security auditor have?

Ideal qualifications include:

• CISA (Certified Information Systems Auditor)
• qualified lead auditor
• certified or certified
• Relevant technical certifications (cloud, networking, etc.)
• Training in ISO 19011 auditing principles

For specialized technical testing, the auditor may be supported by penetration testers, cloud security engineers, or forensics experts.

What if we are too small to have a dedicated internal auditor?

Small organizations can:

• Outsource internal audit to a qualified firm.
• Use a part-time external auditor.
• Engage a virtual CISO / audit service.
• Document independence safeguards in the charter.

The key is that the reviewer is independent of the operations reviewed, not that they are a full-time employee.

Does A.5.35 require us to audit every Annex A control every year?

No. A.5.35 requires reviews at planned intervals. A risk-based audit plan typically covers all Annex A controls over a 2-3 year cycle, with high-risk controls audited annually. The plan must be justified by risk and approved by top management.

What is the difference between A.5.35 and ISO 27001 Clause 9.2 (internal audit)?

• Clause 9.2 is a management system requirement to conduct internal audits of the ISMS at planned intervals.
• A.5.35 is an Annex A control specifically requiring independent review of the information security approach and implementation, including people, processes, and technologies.

In practice, a well-designed internal audit program satisfies both requirements simultaneously.

How does A.5.35 relate to DPDP Act 2023 independent audits?

The DPDP Act 2023 requires significant data fiduciaries to conduct periodic independent audits. While the detailed rules are pending, A.5.35 implementation provides the foundation: an independent audit function, risk-based plan, competent auditors, and documented findings. Organizations should align their A.5.35 program with anticipated DPDP audit requirements.

What should be in an A.5.35 audit report?

An effective report includes:

• Executive summary and overall opinion.
• Scope, objectives, and criteria.
• Methodology and sampling.
• Risk-rated findings with condition, criterion, cause, effect, and recommendation.
• Management response and action plan.
• Appendices with detailed evidence references.

How do we demonstrate independence if we use an outsourced auditor?

Demonstrate that:

• The outsourced firm has no conflict of interest (e.g., did not design the controls being audited).
• The contract specifies independence and reporting lines.
• The firm reports directly to your board/audit committee/CEO.
• You maintain oversight and quality review of their work.

Can IT perform vulnerability assessments and still be independent?

IT can perform operational vulnerability management (first line). However, independent validation of whether vulnerability management is effective should be performed by someone independent of IT, such as internal audit or an external firm. This distinction is critical for A.5.35.

What triggers a change-driven review under A.5.35?

Examples include:

• Merger, acquisition, or divestiture.
• Major cloud migration or infrastructure change.
• Launch of a new product or service handling sensitive data.
• New regulation (e.g., DPDP Act, RBI update).
• Major security incident or breach.
• Significant organizational restructuring.
• New critical supplier or outsourcing arrangement.

The organization should define "significant change" in its audit policy.

What are the most common external audit findings on A.5.35?

1. Internal audit reports to the CISO or IT manager.
2. No annual risk-based audit plan.
3. Auditors lack competence or qualifications.
4. Findings not tracked to closure.
5. No evidence of change-triggered reviews.
6. Audit reports are only observations without risk ratings.
7. Working papers are missing or inadequate.

How much does it overhead to implement A.5.35 properly?

The impact of non-compliance, certification suspension, customer loss, regulatory penalties, typically far exceeds the investment.

References and Further Reading

Standards and Frameworks

Indian Regulations and Guidelines

Additional Reading