Annex A 5.4 management responsibilities: what auditors check

The auditor asks for your newest joiner's security briefing, then compares its date with the day their account was created. The briefing came second. Annex A 5.4 management responsibilities turn that gap into a finding, because the control expects managers to require compliance rather than hope for it.

This guide covers what the control asks and how to contract, brief and resource your people. It also covers the reporting route, what auditors sample and how they grade it, and how to automate the loop. It is written for security managers, operations heads and compliance leads at 25–250-person firms preparing for ISO 27001:2022.

What does ISO 27001 Annex A 5.4 require?

Annex A 5.4 makes following security policy a management obligation: managers must require personnel and contractors to comply, not merely encourage it. People are briefed before access, know what their role expects, are contractually bound, and get the time and budget to comply. Auditors read it alongside clauses 5.1 and 7.3.

The 2022 control, named Management responsibilities, is deliberately harder than its 2013 ancestor. It bundles six obligations into one management duty:

• Briefing before access. People learn their security duties before they receive accounts.
• Role clarity. Each person knows what their role expects.
• Contractual force. Compliance is a stated condition of employment or engagement.
• Current skills. Training stays up to date.
• Time and budget. Staff can afford to do the secure thing.
• A confidential route. Violations can be reported safely.

Annex A 5.1 writes the rules, and A 5.4 makes following them a management job. Auditors test the same behaviours from the management-system side through clause 5.1, leadership and commitment, and clause 7.3, awareness. A weakness here tends to surface in all three places at once.

A practical test: can a manager point to the document that obliges a person to comply, the record showing they were told, and the consequence if they ignore it? Missing any of the three means the control is encouraging, not requiring.

In practice the evidence is split. Leadership holds the minutes and budget decisions; HR holds the contracts, onboarding records and training logs. Agree who owns each record before the auditor asks.

Why do Annex A 5.4 management responsibilities start with leadership?

Leadership comes first because it sets the tone and auditors sample it first: an executive who skipped the training everyone else completed signals that the rules are optional. NCSC and ICO guidance both place that responsibility at the top. In a 25–250-person firm, no compliance department absorbs that signal.

NCSC guidance on engagement and training is blunt about special treatment. When senior leaders ignore security policies or ask for a different device from the standard issue, it signals to everyone else that seniors don't think the rules are fit for purpose. The NCSC cyber security culture principles add that lasting impact needs leadership buy-in and advocacy, not only a capable security team.

ICO guidance on accountability and governance applies the same expectation to personal data: responsibility for UK GDPR compliance sits at the highest management level and throughout the organisation. The leadership records that prove security ownership for ISO 27001 therefore support your data protection accountability too.

A rule the founders skip is a rule the company has already repealed.

Auditors look for these executive patterns first:

• An exemption for the sales lead that nobody documented.
• Training that every employee completed except the leadership team.
• Tailgating through a secure door with a smile.
• A device or badge rule that applies to everyone but the founders.

A leadership team that completes the same training, visibly, turns the hardest audit sample into the easiest.

How do you make security compliance a contractual condition?

Put a security compliance clause in every employment contract and contractor agreement. Make it specific enough to mean something, and have whoever handles your employment law review it so it is enforceable. Fix existing staff at the next contract change or through a signed policy acknowledgement. Without it, an incident may leave you without recourse.

Specific wording is what makes the clause enforceable. A sentence requiring staff to comply with the information security policy set as updated, with breach handled under the disciplinary procedure, gives you something to enforce. A line about valuing security does not, and vague wording is usually found only when an incident makes it matter. Your employment lawyer decides the final form.

To bring existing staff and contractors onto the clause:

1. Update the templates. Add the clause to employment contracts and contractor agreements.
2. Record the version. Note which template each person signed.
3. Close the gap. Collect a signed policy acknowledgement from anyone on an older version, or wait for their next contract change.
4. Repeat on change. Re-run the process whenever the clause is revised.

Contractors need the clause in their own agreement, or in a master agreement that flows down to the individuals who actually work for you. Agency-supplied staff are the easiest group to miss.

The legal exposure is the reason this matters. After an incident caused by an employee or contractor, the first question is whether compliance was a binding condition of their engagement. Without the contract wording and the briefing records, you may face a harder conversation with your regulator and insurer as well.

How do you brief people before access and set role-specific expectations?

Gate access on the briefing. The onboarding flow must show the security briefing and policy acknowledgement happened before accounts were created, not sometime in the first month. Each role also gets a short statement of its security expectations, so the engineer's differ from the account manager's, instead of one generic lecture.

Auditors trace the ordering, so your evidence is a sequence of dates. Build the workflow to produce them in this order:

1. Offer accepted and contract signed, with the security clause.
2. Security briefing delivered.
3. Policy acknowledgement recorded.
4. Accounts created.
5. Role-specific expectations issued.

A briefing that arrives after the login isn't a briefing; it's a record of what already went wrong.

Role-specific expectations

The engineer's statement covers code review, secrets handling and production access. The account manager's covers customer data in email, device handling and reporting phishing. People remember a briefing that describes their own job. An auditor can tell that from a tick-box lecture in a single interview.

A lean training plan

Keep a simple plan that answers three questions:

• What does each role need to learn?
• When does each module refresh?
• Who is overdue today?

A spreadsheet or LMS view is enough, provided it shows completion across the whole company. Contractors and the leadership team are the groups auditors sample first, and the groups most often missing from the tracker.

Keep the content current as well. People cannot follow policies that no longer describe the business, so review the briefing whenever the policy suite changes.

How do you give staff a confidential way to report violations?

Stand up a route that bypasses line management: an anonymous form plus a named alternative contact is enough at 50 people. What matters is that staff know it exists and trust that using it won't rebound on them. At that size, the person you would normally tell might be the problem.

Make the route concrete:

• An anonymous form that lands in a restricted queue only the designated reviewer can open.
• A named alternative outside the reporting line, such as a director or HR lead who is not the reporter's manager.
• A no-retaliation statement in the policy, repeated in the briefing.

Decide in advance what happens to a report: who reads it, how quickly they respond and when it escalates to an incident. A report about a director needs a path that does not pass through that director.

Trust decides whether anyone uses the route. Auditors test it in interviews by asking staff how they would report a concern. Announce the route at onboarding and repeat it in training.

Test it before the auditor does. Submit a dummy report, confirm who sees it and record how long a response took. That log is proof that someone monitors the channel. Without a route at all, violations surface only when they have become incidents.

How do you show management has resourced security?

Make resourcing visible: security tasks in sprint planning, a budget line leadership approved, and minutes showing trade-offs were considered. Duties assigned with no time or budget to perform them are a finding, not a plan. Auditors look for evidence that the secure option was funded, not merely expected.

Three artefacts carry most of the weight:

• Sprint capacity. Security tasks appear in sprint planning with estimates, not in a backlog column that never moves.
• A budget line. Leadership approved a figure for security tooling and training, with a dated sign-off.
• Minutes. Records show leadership weighed trade-offs, such as moving a feature date to fund a remediation.

The pattern the control targets is leadership that expects security, funds none of it and then wonders why the control isn't operating at audit. At 50 people, the evidence can be a standing line on the quarterly leadership agenda rather than a separate committee.

Resourcing pairs with enforcement. When persistent violation links to the disciplinary process, the investigation trail shows an auditor that the process has teeth.

What do auditors ask about Annex A 5.4, and how do they grade it?

Auditors trace two or three recent joiners through contract, briefing, acknowledgement and account-creation dates, check executive names against training completion, and ask staff how they would report a concern. Missing contractual basis or visibly exempt leadership grades major; a late briefing or overdue refresher grades minor, aggregating to major as a pattern.

Expect these questions in the room:

• "Show me the security wording in your employment contract, and in a contractor's agreement."
• "For your newest joiner, prove the security briefing happened before their accounts were created."
• "Has your leadership team completed the same training as staff? Show me the log."
• "If an employee saw a colleague, or their manager, breaking security policy, how would they report it safely?"
• "What happened after your last policy violation?"

Interview answers that contradict the paperwork are what auditors are really hunting. A training log showing full completion means little if the sampled engineer cannot say when they were briefed or how to report a concern.

Run the sample yourself first. Trace your three newest joiners, check the executive names against the training log and ask two staff how they would report a concern. Correct what you find and keep the correction record. A logged, fixed exception reads as a working process, and that stops a minor from becoming a pattern.

Do you need a standalone document for Annex A 5.4?

No. Annex A 5.4 is evidenced through records you already keep: contract templates with a signed example, onboarding records, acknowledgement and training logs covering every tier, leadership minutes, the reporting procedure, and any disciplinary trail. What you cannot skip is being able to produce them on request.

Keep the records findable rather than gathered into one binder. An evidence index listing where each record lives and who owns it lets you answer "show me" in minutes.

Two items are easy to forget. One is the training plan with the competence tracking behind it. The other is proof that the reporting procedure reached staff, such as the dated onboarding slide or all-staff message that announced it.

A short management-responsibilities statement inside your existing policy set is harmless if it helps people navigate. An auditor will still test the records, not the statement, so it should never stand in for them.

How do you automate the Annex A 5.4 enforcement loop?

The enforcement loop is mostly workflow, so it automates. HR new-joiner events trigger briefing tasks and hold account set-up until they complete. Dashboards roll up completion with an executives filter. Contract-version tracking lists re-acknowledgement gaps, and a confidential intake form feeds a restricted case queue with response-time tracking.

Each automation converts a manual check into a structural guarantee. The identity provider will not create an account until the HR system records the briefing and acknowledgement. The ordering stops depending on memory, and the evidence is the workflow log.

Overdue refreshers chase themselves, and the question "including leadership?" is answered with one filter. At 50 people, that loop turns the auditor's sampling into an export, and gives a customer's security questionnaire a provable answer: management enforces its own policy, with dated records.

GRCMANA's Fractional CISO service writes the contract wording, briefing structure and training plan, and our GRC engineering work builds the workflows. The table shows what each automation catches and the evidence it leaves.

Frequently asked questions