Communicating during the audit

The 2020 guidance as published

This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.

ISO 19011:2018, 6.4.4 is followed with nothing added: the team meets at intervals to share what it has found, judge progress and move work between members; the leader communicates progress, significant findings and concerns to the auditee and client; evidence of immediate and significant risk is reported without delay; and where the objectives become unattainable or the scope must change, the reasons are reported to the client and auditee.

Communication during the audit is planned, not improvised. The team agrees who speaks to whom, how often, in what language and through what channel, and how a serious issue is raised before the closing meeting.

The DIS layer: what the public record shows

The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.

The public DIS record does not show a change to this clause. The clause number and title are unchanged.

Evidence an auditor asks for

• Audit conductRecords of interim communications and any scope changes

The questions an auditor will ask

The auditor will ask how a mid-audit concern reached the auditee and how the team kept the client informed without breaking confidentiality.

Three tests to run before the next audit

• Ask for records of interim communications and any scope changes and trace it to the clause it is meant to satisfy.

Common gaps

• A live security exposure found during the audit and reported only in the final report
• Scope narrowed during the audit without telling the client

Prepare before the next audit

Agree the communication route at the opening meeting: daily check-in, escalation contact, language and channel. Record the decisions.

Cross-references

6.4.3 6.4.5 6.4.10