ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 5.5.6
Managing programme results
Results have to be managed, not just delivered.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 5.5.6 is followed with nothing added: the achievement of each audit's objectives is evaluated, reports are reviewed and approved for fulfilment of scope and objectives, the effectiveness of actions on findings is reviewed, reports are distributed to the relevant interested parties and the need for follow-up audits is determined, with results and good practice communicated to other areas where appropriate.
Results have to be managed, not just delivered. That means deciding who receives them, in what form, with what confidentiality, what happens to a finding that crosses a business unit, and how the programme uses the pattern across audits. A report that goes nowhere is an audit that changed nothing.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The public DIS record does not show a change to this clause. The clause number and title are unchanged.
Evidence an auditor asks for
- Audit programmeProgramme records of report review and approval, action effectiveness review and follow-up decisions
The questions an auditor will ask
The auditor will ask for the route from an audit finding to a management action, and for an example of a result that changed the programme.
Three tests to run before the next audit
- Ask for programme records of report review and approval, action effectiveness review and follow-up decisions and trace it to the clause it is meant to satisfy.
Common gaps
- Findings closed on the auditee's say-so with no effectiveness review
- Good practice found in one site never shared
Prepare before the next audit
Map the result route: team leader to programme owner to the responsible manager to management review. Record one result that changed a plan or a control.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.