ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 5.1
Establishing the audit programme
Clause 5.1 is the general duty behind the rest of Clause 5: the organisation establishes, implements, monitors, reviews and improves an audit programme, rather than running audits as isolated events.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 5.1 is followed (the third edition removed the former 27007 text here): an ISMS audit programme is established covering ISO/IEC 27001 and any other criteria, separately or combined, with an extent based on the auditee's size and nature and on the nature, complexity, risks and opportunities and maturity of the ISMS, particular attention to multiple sites and outsourced functions, scaling down for small organizations, taking into account the organization's objectives, external and internal issues, interested-party needs and its information security and confidentiality requirements, with those managing it protecting the integrity of audits from undue influence.
Clause 5.1 is the general duty behind the rest of Clause 5: the organisation establishes, implements, monitors, reviews and improves an audit programme, rather than running audits as isolated events. The programme is a management object with objectives, risks, resources, records and a review cycle.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The 19011:2026 revision clarifies the management of complex programmes and programmes across diverse locations, and asks programmes to take account of digital technologies and the organisation's context.
Evidence an auditor asks for
- Audit programmeThe documented ISMS audit programme and its scaling rationale
- Audit programmeProgramme ownership and its independence from the ISMS operation
The questions an auditor will ask
The auditor will ask for the programme document and then for the evidence that it is managed: the objectives, the risk review, the resource decision and the last programme review.
Three tests to run before the next audit
- Ask for the documented isms audit programme and its scaling rationale and trace it to the clause it is meant to satisfy.
- Ask for programme ownership and its independence from the isms operation and trace it to the clause it is meant to satisfy.
Common gaps
- An audit programme that is one annual internal audit with no basis in the ISMS's risks or sites
- Outsourced ISMS processes outside the programme
Prepare before the next audit
Put the programme in one place with an owner, a review date and a version. If audits are commissioned ad hoc, record the decision that created the programme and the first cycle.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.