Objectives, scope and criteria

The 2020 guidance as published

This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.

ISO 19011:2018, 5.5.2 is followed, and an ISMS audit may aim to judge whether the ISMS properly recognises and deals with information security requirements, and to establish how far the information security controls conform to the ISMS's procedures and requirements; when setting the scope, the information security risks should be considered along with the relevant risks and opportunities bearing on the ISMS of the auditee and the audit client; and the criteria may take in the auditee's information security policy and objectives, its policies and procedures, its contractual and other requirements, its risk criteria, its processes for assessing and for treating risk, the Statement of Applicability including any necessary controls, sector-specific or otherwise, why each control is included, whether it is in place, and why any Annex A control of ISO/IEC 27001:2013 is excluded, how controls that treat risks are defined, the methods and criteria used to monitor, measure, analyse and evaluate how the ISMS performs on information security and how effective it is, and information security requirements that a customer sets or that a supplier or outsourcer applies.

Every individual audit needs its own objectives, scope and criteria. For an ISMS the criteria are wider than the 27001 clauses: they include the information security policy and objectives, the risk criteria, the risk treatment process, the Statement of Applicability, contractual and legal requirements, and the organisation's own procedures. If the SoA is never a criterion, the audit cannot test whether the controls in it are real.

The DIS layer: what the public record shows

The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.

The criteria move to ISO/IEC 27001:2022/Amd 1:2024 and to the 2022 Statement of Applicability, including the 93 controls and the climate action amendment. The public DIS record does not quote the new 5.5.2 text.

Evidence an auditor asks for

• Audit planningPer-audit objectives, scope and criteria naming the SoA version, risk process and policies audited
• Audit planningCustomer and supplier security requirements included in the criteria where relevant

The questions an auditor will ask

The auditor will ask for the criteria of a recent audit and then for the SoA version that was used. A criteria list that stops at the 27001 clauses is the common gap.

Three tests to run before the next audit

• Ask for per-audit objectives, scope and criteria naming the soa version, risk process and policies audited and trace it to the clause it is meant to satisfy.
• Ask for customer and supplier security requirements included in the criteria where relevant and trace it to the clause it is meant to satisfy.

Common gaps

• Criteria limited to the ISO/IEC 27001 clauses, so the SoA and risk treatment plan are never criteria
• SoA exclusion justifications never audited

Prepare before the next audit

Put the SoA version, the risk process and the policy into every audit's criteria. For a supplier audit, add the contract and the supplier's own security commitments.

Cross-references

6.3.1 6.4.6