ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 5.7
Reviewing the audit programme
Review and improvement close the loop.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 5.7 is followed with nothing added: the programme is reviewed to assess whether its objectives were achieved, lessons learned feed improvement, overall implementation is reviewed, improvement areas identified, changes applied, auditors' continual professional development reviewed and the results reported to the audit client and interested parties, considering results and trends, conformity with procedures, evolving interested-party needs, records, alternative or new methods, effectiveness of actions on risks and opportunities, and confidentiality and information security issues.
Review and improvement close the loop. The programme is reviewed at planned intervals and after a significant change, and the review decides what to keep, change or stop. The input is the monitoring data, the audit results, the feedback and the risks.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The 19011:2026 revision asks the review to consider advances in information and communication technologies, and to treat opportunities to improve the programme as part of the review.
Evidence an auditor asks for
- Audit programmeProgramme review records with lessons learned and changes made
The questions an auditor will ask
The assessor will ask for the last programme review, its inputs, its decisions and the change that followed.
Three tests to run before the next audit
- Ask for programme review records with lessons learned and changes made and trace it to the clause it is meant to satisfy.
Common gaps
- Programme review that never asks whether the objectives were met
- Confidentiality incidents during audits not reviewed
Prepare before the next audit
Hold a programme review with the monitoring data in front of you. Record three decisions: one to continue, one to change and one to stop.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.