Creating and updating documents

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

When documented information is created or updated the organization makes sure it has suitable identification and description (such as title, date, author or reference number), a suitable format (such as language, software version or graphics) and medium (paper or electronic), and is reviewed and approved as suitable and adequate.

How the 2020 guidance taught the audit

Auditors confirm that, when documented information is created or updated, the organization applies suitable identification and description (title, date, author or reference, for example), format (language, software version, graphics) and medium (paper or electronic), and a check and sign-off that each item is fit for purpose and complete enough. Identification, format and medium are the organization's choice and need not be text or a paper manual. Auditors should take the chance to check this whenever documented information is presented during the audit; a separate exercise is not needed, only enough checks to confirm conformity.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

No substantive change. Identification, description, format, review and approval still apply.

Evidence an auditor asks for

• Documented informationCommon identifying attributes on sampled documents allowing clear and unique identification
• Documented informationFormat and medium used for each sampled item
• Documented informationDate of last review or update and change history
• Documented informationNames of reviewer and approver

The questions an auditor will ask

Ask for a document that changed and for its review and approval record.

Common gaps

• Documents in use with no approval or review evidence
• Versions indistinguishable because identification is missing
• Change history absent, so what changed and when cannot be shown

Prepare before the next audit

Apply the identification, review and approval rules to the documents that changed in the last cycle.

Cross-references