ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 6.2.3
Feasibility of the audit
Feasibility is a real decision: can this audit be done with the access, time, people and method available, and is it safe and appropriate to proceed? A remote audit with no connectivity, an on-site audit in a restricted area, or an audit during an incident are all feasibility questions..
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 6.2.3 is followed (sufficient information, cooperation, time and resources), and before the audit begins, the auditee should be asked if any ISMS audit evidence will be withheld from review, for instance because it holds personally identifiable, confidential or sensitive information; whoever manages the audit programme then decides if a proper audit of the ISMS is possible without it and, if it is not, tells the auditee the audit must wait until access is given or other means are agreed; if the audit proceeds, the plan takes the access limitations into account.
Feasibility is a real decision: can this audit be done with the access, time, people and method available, and is it safe and appropriate to proceed? A remote audit with no connectivity, an on-site audit in a restricted area, or an audit during an incident are all feasibility questions.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The 19011:2026 revision adds local, regional and world geopolitical events to the feasibility considerations, and asks for the continuing feasibility of the audit to be reviewed if an incident affects it.
Evidence an auditor asks for
- Audit initiationFeasibility record listing unavailable evidence and the decision taken
- Audit initiationAlternative means agreed for restricted evidence
The questions an auditor will ask
The assessor will ask for a feasibility decision that changed the plan, and for the risk to the auditee that was considered.
Three tests to run before the next audit
- Ask for feasibility record listing unavailable evidence and the decision taken and trace it to the clause it is meant to satisfy.
- Ask for alternative means agreed for restricted evidence and trace it to the clause it is meant to satisfy.
Common gaps
- Audits that proceed and then report on evidence nobody was allowed to see
- Unavailable evidence discovered mid-audit rather than before
Prepare before the next audit
Record the feasibility check with the access, connectivity, language, safety and disruption factors. If the answer is no, record the alternative.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.