ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 6.4.9
Audit conclusions
The audit conclusion is the team's answer to the audit objectives, not a summary of every finding.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 6.4.9 is followed with nothing added: before the closing meeting the team reviews the findings against the objectives, agrees conclusions allowing for the inherent uncertainty of auditing, and prepares recommendations and follow-up where the plan specifies; conclusions address the extent of conformity, the effectiveness of the ISMS in meeting its intended outcomes, the effectiveness of the management processes, the achievement of the objectives and coverage of the scope, and the fulfilment of the criteria.
The audit conclusion is the team's answer to the audit objectives, not a summary of every finding. It states whether the criteria were met, where the evidence was sufficient, and what the team could not conclude. A conclusion that overreaches the sample is the most common defect.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The public DIS record does not show a change to this clause. The clause number and title are unchanged.
Evidence an auditor asks for
- Audit conductConclusion record addressing conformity, effectiveness and the uncertainty of the audit
The questions an auditor will ask
The assessor will ask which objective the conclusion answers and what the team could not conclude from the evidence.
Three tests to run before the next audit
- Ask for conclusion record addressing conformity, effectiveness and the uncertainty of the audit and trace it to the clause it is meant to satisfy.
Common gaps
- Conclusions that list findings without an effectiveness judgement
- Uncertainty from sampling and withheld evidence never stated
Prepare before the next audit
Write the conclusion against the objectives, with the limitations and the areas not sampled. Keep it separate from the findings list.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.