ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 6.3.3
Assigning work to the team
Work assignment is how the team leader turns the plan into individual accountability.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 6.3.3 is followed with nothing added: the team leader, in consultation with the team, assigns each member responsibility for particular functions, processes, locations or activities, and any authority to take decisions, taking account of impartiality, objectivity, competence and the differing roles of technical experts, auditors-in-training and auditors, with reassignment as the audit proceeds.
Work assignment is how the team leader turns the plan into individual accountability. Each team member needs a clear area, a method, a time and a reporting line, and the team needs to know where one area ends and another begins.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The clause carries over; the assignment should use the 27001:2022 clause and control numbering.
Evidence an auditor asks for
- Audit preparationWork assignment record per team member
The questions an auditor will ask
The auditor will ask a team member what they were assigned and how they knew when their area was complete.
Three tests to run before the next audit
- Ask for work assignment record per team member and trace it to the clause it is meant to satisfy.
Common gaps
- Technical areas assigned to the member least competent in them
- Auditors-in-training left unsupervised
Prepare before the next audit
Write the assignment per auditor with the clauses, controls, sites and evidence they own. Record the interfaces between areas.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.