ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 5.5.7
Programme records
The programme keeps records that let another person reconstruct what was audited, by whom, against what criteria, with what evidence and what conclusion.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 5.5.7 is followed with nothing added: audit records demonstrating the programme's implementation are generated, managed and maintained with processes for their information security and confidentiality, covering the programme (schedule, objectives, extent, risks and issues, reviews), each audit (plans, reports, evidence and findings, nonconformities, corrections and corrective actions, follow-up) and the audit team (competence, evaluation, selection, maintenance and improvement).
The programme keeps records that let another person reconstruct what was audited, by whom, against what criteria, with what evidence and what conclusion. The records also protect the organisation if a finding is challenged later.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The 19011:2026 revision adds feedback from auditees, auditors and other interested parties to the audit records.
Evidence an auditor asks for
- RecordsProgramme, audit and auditor records with defined retention and access control
The questions an auditor will ask
The assessor will pick one audit and ask for the plan, the criteria, the evidence record, the report and the completion record as one file.
Three tests to run before the next audit
- Ask for programme, audit and auditor records with defined retention and access control and trace it to the clause it is meant to satisfy.
Common gaps
- Audit evidence holding client security detail stored without access control
- Auditor competence records missing
Prepare before the next audit
Define the record set for an audit and keep it together. Add the retention rule and the disposal decision.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.