ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 5.4.4
Audit programme resources
Resources are the practical answer to whether the programme can be delivered: auditor time, travel or connectivity, access to evidence, tools, interpreters and the budget for a licensed copy of the standard.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 5.4.4 is followed (financial and time resources, methods, availability of competent auditors and technical experts, extent and risks, travel, time zones, ICT), and in particular ISMS auditors should be given enough time, for every significant risk that applies to the auditee and bears on the programme objectives, to review how effective the auditee's actions on information security risks, and on risks and opportunities related to the ISMS, have been.
Resources are the practical answer to whether the programme can be delivered: auditor time, travel or connectivity, access to evidence, tools, interpreters and the budget for a licensed copy of the standard. A programme that is ambitious on paper and unfunded in practice is a programme risk.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The 19011:2026 revision adds bandwidth checks for digital systems, travel restrictions such as visas and vaccinations, and the need for interpreters as part of planning.
Evidence an auditor asks for
- Audit programmeProgramme resource plan with audit time allocated per significant risk
- Audit programmeAvailability of technical experts for the technologies in scope
The questions an auditor will ask
The assessor will ask how the programme's resource estimate was built and what was cut when the budget or the team changed.
Three tests to run before the next audit
- Ask for programme resource plan with audit time allocated per significant risk and trace it to the clause it is meant to satisfy.
- Ask for availability of technical experts for the technologies in scope and trace it to the clause it is meant to satisfy.
Common gaps
- Audit time set by headcount alone with nothing reserved for the significant risks
- No technical expert available for the systems that carry the highest risk
Prepare before the next audit
Keep a resource line per audit: days, people, method, tools and cost. Show the decision that resolved a shortfall.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.