ISO 27001 compliance question

Quick question that feels like obvious but I'm starting to second-guess myself, so maybe the ISO lead auditors around can clarify this to me.

When an ISO 27001 audit is done in organisation, and especially the implementation of its security controls, is the audit done against ISO 27001 or against the organisation policy?

Here's an example: A.9.2.5 requires that "Asset owners shall review user's access rights at regular intervals". But the organisation actual Security Policy may be more detailed, specifying …

access access rights asset audit compliance controls cybersecurity iso iso 27001 iso 27001 compliance may organisation policy question review rights security security controls security policy