Four to six weeks before the Stage 2 audit, the useful question stops being “do we have a control for this?” and becomes “can we prove it, with a sample someone else could pull?” The People theme — the eight A.6 controls — is where that question bites hardest, because its evidence lives in HR, not in the ISMS tool. This self-audit walks all eight controls as an evidence pack: what to sample, what “tested” means, and how to fix findings before the auditor writes them.
Why sample the People theme before the auditor does
A.6 evidence is fast to sample and unusually telling. An auditor can pull three recent hires and trace them from contract to screening record to system access in under an hour — and whatever that trace shows stands for the whole control. The same is true internally. Running that trace yourself a month before Stage 2 converts surprises into fixable findings. If you have not yet read what auditors request in the opening hour, start with the ten requests auditors open with; this post is the rehearsal for exactly those requests. The underlying control expectations — what good A.6.1 evidence looks like — are set out in A.6.1 evidence expectations.
The self-audit method
Pick three to five records per control, recent ones plus at least one edge case (contractor, leaver, role change). Then trace each record the way an auditor would: from the event (hire, training, exit) to the evidence (record, sign-off, log) to the consequence (access granted or revoked, action taken). Two distinctions matter:
- Tested versus checked. ISO 19011 distinguishes examining evidence (checking) from independently verifying it works (testing). Sampling a record is checking; matching the record against the access log is testing. Stage 2 leans on testing.
- Exists versus applied. A policy that exists but cannot be shown in action for the last quarter is a documentation finding waiting for a reason to happen.
Findings go into a simple log: control, sample, observation, severity, fix, owner, date. That log becomes your corrective-action input.
A.6.1 Screening — the gate re-check
The screening controls are covered in depth in the personnel-security checklist; for the self-audit, run these rows against your last ten hires:
- Matrix current, and every recent hire classified into a tier.
- Screening record dated before first access, for each sampled hire.
- Contractors, temporary and agency staff in scope, with records.
- Rescreening triggers documented and at least one instance of a trigger handled.
- Incomplete-check path defined and, ideally, one case handled per it.
The two rows that fail most often: record-before-access (the gate) and contractor coverage. Both are visible in minutes if HR and IT records sit side by side.
A.6.2 and A.6.6 — contract and NDA terms
Employment contracts should carry the security duties the ISMS assumes — acceptable use, policy acknowledgment, reporting obligations — and NDAs/confidentiality agreements must extend to contractors and service providers, not just employees. Sample three recent contracts plus one contractor agreement: weak versions are generic HR boilerplate with no reference to the information security policy, signed and never revisited.
A.6.3 — awareness and training evidence
Evidence here means reach, content and dates: who was trained, on what, when — including at onboarding and then at a defined rhythm. A single onboarding session from two years ago is the weak spot auditors probe; a current, dated record per person is the strong form. Role-specific additions (phishing for all staff, secure development for engineers) earn credibility points at almost no cost.
A.6.4 and A.6.5 — disciplinary process and exit
For A.6.4, the artifact is a documented disciplinary process — and if no case has occurred, that is fine as long as the process exists and is communicated. If cases exist, they are sampled. For A.6.5, pick two recent leavers and two internal role changes and verify: access revoked, assets returned, confidentiality duties after termination communicated, and the exit recorded. The classic finding is the leaver whose access was never removed — an IT problem that reads as an HR evidence problem.
A.6.7 and A.6.8 — remote working and event reporting
For A.6.7, evidence is that remote-working rules were communicated and apply — the rules themselves, plus attestation or acknowledgment. For A.6.8, the reporting channel must exist, be known, and show at least some use; an empty log raises the question of whether anything is reported at all. One or two genuine entries (even minor incidents) beat a pristine blank.
The evidence pack: what to have open in 15 minutes
Assemble folders before the audit window, one per control, each with the sample pre-pulled: screening records with access grants for hires; contracts with policy acknowledgment; training records with dates; the exit checklist for leavers; the reporting log; the remote-work rules. The goal is that any request from the auditor’s opening list gets answered inside fifteen minutes. Speed of retrieval is itself a signal of a functioning control.
Scoring yourself and fixing findings before Stage 2
Score each control red / amber / green: red = no record exists, amber = records exist but are inconsistent or undated, green = sampled clean end-to-end. Fix in severity order — access-before-screening and missing contractor records are reds; undated training slips are ambers. Then document the fixes as corrective actions with owners and dates; auditors accept a recently-found-and-fixed gap far more readily than an undocumented one. If your timeline is tight, how long fixing the personnel gaps realistically takes gives the planning numbers; KRITIS operators can overlay sector-specific implementation guide for KRITIS.
Frequently asked questions
How deep should an internal audit go before Stage 2?
Deep enough to have pulled a real sample per control and traced it end-to-end. Three to five records per control, including one edge case, is the practical baseline — the point is to have already found what the auditor will find.
Who should run the self-audit?
Someone without ownership of the sampled processes. In larger firms that is the internal audit function; in smaller ones the ISMS lead can run it, with HR supplying records, as long as the trace is done honestly rather than defensively.
What if we find gaps two weeks before Stage 2?
Document them as corrective actions with owners and dates, fix the reds immediately (access gates, contractor records), and be ready to present the log. Auditors distinguish between gaps that surfaced and were being managed and gaps that were unknown.
Is this checklist relevant outside ISO 27001?
The People theme maps closely to NIS2/BSIG and KRITIS expectations, so the evidence pack doubles as preparation for those regimes — useful if you face more than one framework.
This article provides general information and does not constitute legal advice.