ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 5.3
Audit programme risks
The programme has risks of its own: a lost auditor, an audit that cannot get access, a remote audit that cannot see the evidence, a schedule that avoids the difficult business unit, a team that is not competent for the sector.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 5.3 is followed (the audit client is shown the programme's identified risks and opportunities, covering planning, resources, team selection, communication, implementation, records control and monitoring, and the opportunities such as combining audits or reducing travel), and the measures that protect confidentiality and information security should be decided bearing in mind what auditees and other relevant parties require, their applicable contractual and legal requirements included.
The programme has risks of its own: a lost auditor, an audit that cannot get access, a remote audit that cannot see the evidence, a schedule that avoids the difficult business unit, a team that is not competent for the sector. Clause 5.3 asks the organisation to identify those risks and opportunities and to decide what to do about them.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The 19011:2026 revision expands programme risk to include loss of competent auditors, the choice between on-site and remote audits, departures from the programme, lack of leadership support and the security of IT and data platforms.
Evidence an auditor asks for
- Audit programmeProgramme risk and opportunity register including information security and confidentiality measures
- Audit programmeAgreements with auditees on confidentiality of audit information
The questions an auditor will ask
The assessor will ask for the programme risk review and for one decision it changed: a different method, a different team, a different date or a different scope.
Three tests to run before the next audit
- Ask for programme risk and opportunity register including information security and confidentiality measures and trace it to the clause it is meant to satisfy.
- Ask for agreements with auditees on confidentiality of audit information and trace it to the clause it is meant to satisfy.
Common gaps
- Audit programme risks confined to scheduling, with no measure for the sensitive information the audits will handle
- Contractual confidentiality obligations of the auditee never reflected in the programme
Prepare before the next audit
Add programme risks to the same risk process that already governs the ISMS, or keep a short programme risk log with owners and review dates. Show one risk that changed the plan.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.