ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 6.3.2
Audit planning
The audit plan turns the scope and criteria into a schedule of activities, people and evidence.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 6.3.2 is followed (a risk-based plan, its detail matched to scope, complexity and the risk of not meeting the objectives, agreed among client, team and auditee), and the team leader should bear in mind that the audit team being there can itself create risk for the auditee: it can affect information security and add risk to the auditee's information, for example sensitive or confidential records or its system infrastructure, through unauthorized disclosure, accidental deletion or unintended change.
The audit plan turns the scope and criteria into a schedule of activities, people and evidence. It should be shared with the client, adjusted when the evidence changes, and kept as a record of what was actually done.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The 19011:2026 revision asks for the plan to be presented to the audit client, for changes to be documented, and for the risk to the auditee from the audit and any on-site activity to be managed.
Evidence an auditor asks for
- Audit preparationAudit plan with the risks the audit itself poses to the auditee's information and the measures taken
- Audit preparationRules of engagement for auditor access to systems
The questions an auditor will ask
The assessor will compare the plan with the actual audit and ask what changed, why, and who agreed the change.
Three tests to run before the next audit
- Ask for audit plan with the risks the audit itself poses to the auditee's information and the measures taken and trace it to the clause it is meant to satisfy.
- Ask for rules of engagement for auditor access to systems and trace it to the clause it is meant to satisfy.
Common gaps
- Auditors given production access with no rules on what they may touch
- Audit plans that never consider the risk of the audit to the auditee
Prepare before the next audit
Version the plan, send it to the client, and record changes with the reason and the agreement. Add the risk to the auditee from the audit activities.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.