ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 5.6
Monitoring the audit programme
Monitoring asks whether the programme is doing what it said: are the audits happening, on time, with the planned methods and teams, and are the results being used? The evidence is a comparison, not a list of completed audits..
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 5.6 is followed with nothing added: those managing the ISMS audit programme evaluate whether schedules are met and objectives achieved, the performance of team members, leaders and technical experts, the teams' ability to implement audit plans, feedback from clients, auditees and auditors, and the sufficiency of documented information, with changes to the auditee's context, risks, the ISMS or the criteria prompting programme changes.
Monitoring asks whether the programme is doing what it said: are the audits happening, on time, with the planned methods and teams, and are the results being used? The evidence is a comparison, not a list of completed audits.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The public DIS record does not show a change to this clause. The clause number and title are unchanged.
Evidence an auditor asks for
- Audit programmeProgramme monitoring records and auditor performance evaluations
- Audit programmeChange log of the programme against ISMS and context changes
The questions an auditor will ask
The auditor will ask for the programme's measures and for the last period's actual against plan, including the audits that slipped and why.
Three tests to run before the next audit
- Ask for programme monitoring records and auditor performance evaluations and trace it to the clause it is meant to satisfy.
- Ask for change log of the programme against isms and context changes and trace it to the clause it is meant to satisfy.
Common gaps
- Programme unchanged after a major incident or scope change at the auditee
- Auditor performance never evaluated
Prepare before the next audit
Choose a small set of measures (completion, coverage, finding closure, feedback) and review them on a fixed date. Record the action taken when a measure missed.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.