ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 5.4.3
Extent of the audit programme
The extent of the programme is the answer to 'what is in and what is out': which sites, business units, shared services, cloud providers and suppliers are audited, how often, and on what cycle.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 5.4.3 is followed, and the extent of an ISMS audit programme can include the size of the ISMS (how many people work under the organization's control, its relationships with contractors and interested parties relevant to the ISMS, how many information systems and how many sites it has), how complex the ISMS is, including how many processes and activities there are, how critical they are and how sites differ, how much the identified information security risks matter to the business, how much the risks and opportunities found when planning the ISMS matter, the importance of preserving confidentiality, integrity and availability within the scope, the complexity of the information systems and technology audited, and the number of similar sites; which areas get closer examination should depend on business requirements and on how significant the information security risks are. ISO/IEC 27006, together with IAF MD 1, gives audit-time and multi-site sampling guidance that applies only to certification audits.
The extent of the programme is the answer to 'what is in and what is out': which sites, business units, shared services, cloud providers and suppliers are audited, how often, and on what cycle. The extent is a decision about coverage and risk, not a copy of the organisation chart.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The public DIS record does not show a change to this clause. The clause number and title are unchanged in the published contents.
Evidence an auditor asks for
- Audit programmeProgramme extent determination recording persons, systems, sites, complexity and risk significance
- Audit programmePrioritisation of audit depth by risk
The questions an auditor will ask
The auditor will compare the programme extent with the ISMS scope and with the Statement of Applicability, and ask why a site or a supplier is outside the cycle.
Three tests to run before the next audit
- Ask for programme extent determination recording persons, systems, sites, complexity and risk significance and trace it to the clause it is meant to satisfy.
- Ask for prioritisation of audit depth by risk and trace it to the clause it is meant to satisfy.
Common gaps
- Every site and process audited to the same depth regardless of risk
- Interested parties and contractors within the ISMS left outside the programme's extent
Prepare before the next audit
Draw the extent on one page, mark the sites and suppliers that are in scope, and give a reason for every exclusion. Reconcile it with the ISMS scope and the SoA.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.