ISO 27001 requires organizations to identify and manage information security risks, including those that originate in software. Annex A of the standard includes controls related to secure development, supplier relationships, and protection of information assets – all areas a code audit can assess.
A code audit gives you documented evidence that you’ve evaluated your software’s security posture. That’s exactly what certification bodies and internal auditors want to see when reviewing your risk assessment and treatment processes.
Reference
ISO/IEC 27001:2022 – Information Security Management – iso.org