ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 6.5.1
Preparing the audit report
The report is a record of the audit for the client, the auditee and the next audit.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 6.5.1 is followed with nothing added: a complete, accurate, concise and clear report that includes or refers to the objectives, scope, client, team and auditee participants, dates and locations, criteria, findings and evidence, conclusions, the degree of fulfilment of the criteria, unresolved diverging opinions and, as applicable, the plan, the summary of the process and its obstacles, confirmation of objectives achieved, uncovered areas, unresolved issues, improvement opportunities, good practice, action plans and confidentiality and distribution statements.
The report is a record of the audit for the client, the auditee and the next audit. It states the scope, criteria, method, dates, team, findings, conclusions and limitations, and it does not introduce new findings. It should be readable by someone who was not there.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The 19011:2026 revision asks the report to explain why a nonconformity does not meet the criteria and the basis for grading, and to avoid findings not discussed during the audit.
Evidence an auditor asks for
- Audit reportingAudit reports with the required contents including the confidentiality statement
The questions an auditor will ask
The assessor will check whether every finding in the report traces to the closing meeting and to an evidence record.
Three tests to run before the next audit
- Ask for audit reports with the required contents including the confidentiality statement and trace it to the clause it is meant to satisfy.
Common gaps
- Reports that omit uncovered areas and uncertainties
- No distribution statement, so sensitive reports travel freely
Prepare before the next audit
Use one report structure, write the limitations, and attach the evidence index. Remove any finding that was not discussed at the closing meeting.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.