ISO 27001 requires organizations to identify and manage information security risks, including those that originate in software. Annex A of the standard includes controls related to secure development, supplier relationships, and protection of information assets – all of which a code audit can assess.
A code audit provides documented evidence that you’ve assessed your software’s security posture, which supports the risk assessment and treatment process that ISO 27001 certification requires. It’s the kind of evidence that certification bodies and internal auditors want to see.
Reference
ISO/IEC 27001:2022 – Information Security Management – iso.org