Reviewing documents during the audit

The 2020 guidance as published

This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.

ISO 19011:2018, 6.4.6 is followed (the auditee's documented information reviewed during the audit for conformity and to gather information, with inadequate documentation within the plan's time frame reported to the leader and possibly ending the audit), and ISMS auditors should check that the documented information the audit criteria call for, and that falls within the scope, exists and meets the criteria, and should confirm that the controls chosen within the scope link to what the risk assessment and treatment process produced and trace back to the information security objectives and policy; Annex A gives the practice for auditing the ISMS through its documented information.

Document review continues during the audit. The team checks the documents it sees against the criteria, samples the records, and follows a thread from a document to a practice and back. The document is evidence of a decision, not proof that the decision is followed.

The DIS layer: what the public record shows

The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.

The public DIS record does not show a change to this clause. The clause number and title are unchanged.

Evidence an auditor asks for

• Audit conductAudit records tracing each sampled control to the risk it treats and to the policy and objectives
• Audit conductVerification of the mandatory documented information of ISO/IEC 27001

The questions an auditor will ask

The auditor will ask for a document that was reviewed during the audit and for the practice it was compared with.

Three tests to run before the next audit

• Ask for audit records tracing each sampled control to the risk it treats and to the policy and objectives and trace it to the clause it is meant to satisfy.
• Ask for verification of the mandatory documented information of iso/iec 27001 and trace it to the clause it is meant to satisfy.

Common gaps

• Controls audited as a checklist with no trace to the risk assessment
• Mandatory documented information assumed rather than verified

Prepare before the next audit

Record the document, the version, the requirement it was tested against and the observation. Do not accept a document as proof of operation.

Cross-references

6.3.1 6.4.7 6.4.8