ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 6.3.4
Preparing audit documents
The team prepares the working documents it will use: checklists, sampling plans, evidence forms, the opening meeting agenda and the report template.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 6.3.4 is followed (members collect and review the information for their assignments and prepare checklists, sampling details and other work documents that do not restrict the audit, retained at least until completion), and the team leader should see that every audit work document carries a suitable classification and is handled as that classification requires.
The team prepares the working documents it will use: checklists, sampling plans, evidence forms, the opening meeting agenda and the report template. The documents should support the audit, not replace it, and they should be controlled so a later reader can see what was used.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The public DIS record does not show a change to this clause. The clause number and title are unchanged.
Evidence an auditor asks for
- Audit preparationAudit work documents carrying a classification and handled accordingly
- Audit preparationRetention and disposal rule for work documents
The questions an auditor will ask
The assessor will ask for the working documents of a recent audit and check whether they match the criteria and the version of the standard.
Three tests to run before the next audit
- Ask for audit work documents carrying a classification and handled accordingly and trace it to the clause it is meant to satisfy.
- Ask for retention and disposal rule for work documents and trace it to the clause it is meant to satisfy.
Common gaps
- Checklists containing client system details circulated unclassified
- Work documents kept on personal devices after the audit
Prepare before the next audit
Version the work papers, date them, and keep the completed set with the audit file. Remove fields that no one uses.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.