ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 4
Principles of auditing
The seven audit principles are the test an audit programme is held to when no clause answers the question: honesty (integrity), a fair account of what was found, care appropriate to the task, confidentiality, independence, conclusions resting on evidence, and a risk-based choice of where to look.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018 clause 4, on the principles of auditing, is followed for ISMS audits with nothing added: confidentiality, integrity, fair presentation, independence, due professional care, and approaches grounded in evidence and in risk, which together let independent auditors reach similar conclusions in similar circumstances. For an ISMS audit the confidentiality principle carries extra weight, because the audit evidence itself (risk registers, incident records, configurations) is the auditee's sensitive information.
The seven audit principles are the test an audit programme is held to when no clause answers the question: honesty (integrity), a fair account of what was found, care appropriate to the task, confidentiality, independence, conclusions resting on evidence, and a risk-based choice of where to look. For an ISMS the confidentiality principle is not a formality, because the evidence an auditor handles (risk registers, incident records, configurations, supplier contracts) is often the most sensitive material the organisation holds.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The 19011:2026 revision amends the independence principle to recognise the practicalities of internal audit in small organisations, and names risk-based approaches for audit programmes as well as individual audits. The DIS 27007 foreword aligns the revision with that text.
Evidence an auditor asks for
- Audit principlesAudit programme policy citing the seven principles
- Audit principlesAuditor codes of conduct and confidentiality undertakings
The questions an auditor will ask
An auditor or accreditation assessor will ask how independence was preserved when the auditor had a prior role in the ISMS, and how the team kept confidential evidence out of the report and the retainer.
Three tests to run before the next audit
- Ask for audit programme policy citing the seven principles and trace it to the clause it is meant to satisfy.
- Ask for auditor codes of conduct and confidentiality undertakings and trace it to the clause it is meant to satisfy.
Common gaps
- Auditors who audit their own ISMS work
- Findings shaped by what the auditee wants to hear rather than the evidence
Prepare before the next audit
Record the independence decision for each auditor and each audit, and keep the confidentiality undertaking with the audit file. If the team is small, say how the practical limit was handled rather than claiming an independence the structure cannot give.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.