A checklist covers the first half of an audit. It walks through the clauses and controls and asks whether a policy or procedure exists. That is useful for making sure nothing is skipped, and many auditors use one for exactly that.
The second half is evidence that the controls run, and it comes from sampling and interviews. Three examples:
- Access removal: take five employees who left in the last year and check in the identity provider when each account was disabled, compared with their last working day.
- Change management: pick five production changes from the deployment log and check that each had an approved ticket before it went live.
- Awareness: ask three people from different teams what they do with a suspicious email, and compare the answers with the policy.
A checklist with only yes or no answers shows none of this. If you work with one, add two columns: the evidence you looked at and the sample you took. With those filled in, the checklist becomes an audit record, and those two columns are what the certification auditor reads first.