ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 6.4.8
Generating audit findings
A finding connects a criterion, the evidence and the requirement.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 6.4.8 is followed with nothing added: evidence is evaluated against the criteria to determine findings of conformity or nonconformity (and, where the plan specifies, good practice, improvement opportunities and recommendations), nonconformities and their evidence are recorded and may be graded, and findings are reviewed with the auditee so that the evidence is acknowledged and diverging opinions are resolved or recorded.
A finding connects a criterion, the evidence and the requirement. It says what was expected, what was found and why it matters. Grading has to be consistent across the team and explained to the auditee before the report.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The 19011:2026 revision asks for caution in making recommendations that could affect impartiality, and for the grading system to be defined and communicated.
Evidence an auditor asks for
- Audit conductFindings records with the criterion, the evidence and the auditee's acknowledgement
The questions an auditor will ask
The auditor will ask for a finding that was downgraded or withdrawn and for the evidence that changed the grade.
Three tests to run before the next audit
- Ask for findings records with the criterion, the evidence and the auditee's acknowledgement and trace it to the clause it is meant to satisfy.
Common gaps
- Nonconformities without the criterion breached stated
- Unresolved disagreements not recorded
Prepare before the next audit
Use one finding template with criterion, evidence, requirement, grade and owner. Calibrate the grades across the team before the closing meeting.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.