ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 5.5.3
Selecting audit methods
Method selection is a risk decision: interviews, document review, observation, sampling, technical testing, remote or on-site.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 5.5.3 is followed (methods chosen for the objectives, scope and criteria, on-site, remote or combined, balanced against risks and opportunities), and for a joint audit, special care should go into what information passes between the parties involved, with every interested party agreeing it before the audit starts.
Method selection is a risk decision: interviews, document review, observation, sampling, technical testing, remote or on-site. The method has to fit the evidence the audit needs, not the travel budget. A remote audit can be perfectly valid for a document and interview programme and weak for a physical control or a culture question.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The 19011:2026 revision expands guidance on remote auditing methods and folds the former virtual-location advice into remote audit. The DIS 27007 foreword aligns with that revision.
Evidence an auditor asks for
- Audit planningMethod selection per audit with the remote and on-site balance justified
- Audit planningJoint-audit disclosure agreements signed before the audit
The questions an auditor will ask
The assessor will ask why a method was chosen for a specific control and what evidence the method could not reach.
Three tests to run before the next audit
- Ask for method selection per audit with the remote and on-site balance justified and trace it to the clause it is meant to satisfy.
- Ask for joint-audit disclosure agreements signed before the audit and trace it to the clause it is meant to satisfy.
Common gaps
- Joint audits where one auditing organization sees the other's client information with no agreement
- Remote methods chosen without weighing what evidence cannot be seen remotely
Prepare before the next audit
Record the method per audit area and the reason. Where a remote method is used, state what was verified remotely and what was left to a later on-site visit.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.