If your team logs changes, incidents and corrective actions in Jira, most of the evidence an ISO 27001 auditor asks for already exists. The hard part comes the week before the audit, when someone has to turn hundreds of work items into something an auditor can read, sign and file.
This guide covers three things. What the auditor actually looks for, how to shape Jira so the evidence holds up, and how to freeze it into a document that counts as controlled.
What the auditor looks for
Three parts of the standard do most of the work here.
- Change management (Annex A 8.32). Auditors usually pull a sample of recent changes. For each one they want to see the request, the approval and when it happened, who carried out the change, and when it went live.
- Nonconformity and corrective action (clause 10.2). Each finding needs a record of what went wrong, the cause, the action taken, and evidence that the action worked.
- Control of documented information (clause 7.5.3). Whatever you hand over has to be identified, versioned, protected and kept for a defined period. A spreadsheet someone exported on a Tuesday afternoon rarely meets that bar.
Shape Jira so the evidence holds up
None of this needs an app. It needs a few decisions made before the audit, not during it.
- One work type per kind of record. A Change type and a Corrective action type let one filter pull exactly what the auditor asked for, with nothing extra.
- Put the checked facts in fields, not comments. Approver, approval date, implementer and rollback plan belong in custom fields. A field can be filtered, sorted and printed in a column. A comment has to be read one by one.
- Make approval a status. If "Approved" is a real step in the workflow, the record shows the approval happened before the work started. If it lives in a comment, you'll be explaining it in the audit room.
- Save one filter per audit period. For example:
project = OPS AND issuetype = Change
AND created >= 2026-07-01 AND created < 2026-10-01
ORDER BY created ASC
Name it after the period. Next quarter, copy it and change two dates.
Freeze it into a controlled document
A filter is live and keeps changing. An audit needs a snapshot that won't. That's where most teams lose a day, pasting exports into a Word template by hand.
For a document to count as controlled, auditors usually expect five things.
- A cover with the title, the scope and the organization.
- A version number and an issue date.
- Who issued it, and space to sign.
- Every page identified, with the document, its version and Page X of Y. Pages get printed and photocopied one by one, and loose pages are what end up on the auditor's desk.
- A way to tell two versions apart, so nobody argues over which one was handed in.
This is the gap we built Dossier for. You pick the project, the statuses and the period. Dossier writes one row per work item with the fields you chose, custom fields included. Then it adds the cover, the version, the issue date, the author, a content fingerprint and a signature line, and stamps every page. The same run produces Word and PDF and attaches both to a new work item, so the snapshot stays next to the work it describes. If your auditor already knows your report format, upload your own Word template and Dossier fills your table without touching your layout. It runs entirely on Atlassian, so nothing leaves your Jira.
A checklist for the week before
- Run the period filter and check that the count matches what you expect.
- Look for changes with an empty approver or approval date. Fix the record now, not in the meeting.
- Check that every corrective action links to the finding it closes.
- Produce the document, read it page by page, and sign it.
- Store it where your document control procedure says it lives, with its version.
If you track ISO 27001 work in Jira differently, I'd like to hear how in the comments. Especially how you handle approvals.
Disclosure: I'm part of Vortex Labs, the team that builds Dossier.
