Roles of the programme manager

The 2020 guidance as published

This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.

ISO 19011:2018, 5.4.1 applies: whoever manages the ISMS audit programme sets its extent from the objectives and known constraints; determines the internal and external issues, risks and opportunities that can affect it and builds the responses into the audit work; makes sure audit teams are selected and competent by assigning roles, responsibilities and authorities; establishes the processes for coordinating and scheduling audits, setting each audit's objectives, scope, criteria and methods and selecting its team, evaluating auditors, communicating internally and externally, resolving disputes and complaints, following up and reporting; determines and provides the resources; keeps the documented information and programme records; monitors, reviews and improves the programme; communicates it to the audit client and relevant parties; and asks the audit client to approve it. The clause also says that the guidance of 5.4.1.2 applies, but the published text contains no 5.4.1.2: the English text (as adopted in EN ISO/IEC 27007:2022) and the French edition both pass straight from that sentence to 5.4.2, so the pointer is an editorial slip and 5.4.1 adds nothing ISMS-specific to ISO 19011.

Someone has to own the programme and be accountable for it, and that person needs the authority to schedule audits, pick teams and stop an audit that cannot proceed. The clause also asks for the roles around the owner: who approves the programme, who receives its results and who acts on them.

The DIS layer: what the public record shows

The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.

The 19011:2026 revision says the individual managing the programme must protect its integrity and keep it free from undue influence. That is a sharper duty than the 2018 wording.

Evidence an auditor asks for

• Audit programmeAppointment and terms of reference of the audit programme manager
• Audit programmeProgramme processes for scheduling, auditor evaluation, complaints and follow-up
• Audit programmeAudit client approval of the programme

The questions an auditor will ask

The auditor will ask the programme owner to describe a decision they took without asking permission, and to show the approval route for the programme itself.

Three tests to run before the next audit

• Ask for appointment and terms of reference of the audit programme manager and trace it to the clause it is meant to satisfy.
• Ask for programme processes for scheduling, auditor evaluation, complaints and follow-up and trace it to the clause it is meant to satisfy.
• Ask for audit client approval of the programme and trace it to the clause it is meant to satisfy.

Common gaps

• Programme managed by the ISMS manager whose work it audits
• No record that the audit client approved the programme
• Dispute and complaint handling for audits never defined

Prepare before the next audit

Name the owner, the approver and the recipient of results in the programme document. If one person holds all three roles, record how the conflict is managed.

Cross-references

5.1 5.4.2 5.5.6 5.7