ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 5.2
Audit programme objectives
Objectives turn the audit programme from a calendar into a managed activity.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 5.2 is followed (objectives that direct planning and conduct, consistent with the audit client's strategy and the ISMS policy and objectives), and ISMS-specific considerations for determining them can include the identified information security requirements, what ISO/IEC 27001 requires, how well the auditee performs as shown by how often information security events and incidents occur and the effectiveness of the ISMS (ISO/IEC 27004 gives more on performance measurement), and information security risks facing the audit client and the auditee. Example ISMS objectives: showing that legal, contractual and other requirements, and what they mean for security, are met; obtaining and maintaining confidence in the auditee's risk management capability; judging how well the actions on information security risks and opportunities work.
Objectives turn the audit programme from a calendar into a managed activity. They state what the programme is for: for example confirming that the ISMS meets its own requirements, testing whether controls work as described, following risk, or giving top management an independent reading. Each objective should be specific enough that a completed audit can be judged against it.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The clause carries over. Its reference point moves to ISO/IEC 27001:2022/Amd 1:2024 through the DIS normative references, so an objective phrased around the 2013 clause set should be reworded.
Evidence an auditor asks for
- Audit programmeDocumented programme objectives naming the ISMS requirements, incident performance and risks they respond to
- Audit programmeEvidence the objectives were used to plan individual audits
The questions an auditor will ask
The auditor will ask which objective a given audit served, and what would have counted as evidence that the objective was met.
Three tests to run before the next audit
- Ask for documented programme objectives naming the isms requirements, incident performance and risks they respond to and trace it to the clause it is meant to satisfy.
- Ask for evidence the objectives were used to plan individual audits and trace it to the clause it is meant to satisfy.
Common gaps
- Objectives copied from a generic quality audit programme
- Incident history and risk profile never consulted when setting objectives
Prepare before the next audit
Write three to five programme objectives for the current cycle, each tied to a risk, a clause or a management review input. Delete objectives that no planned audit can test.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.