ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 6.6
Completing the audit
Completion is a decision that the audit is finished: the report is issued, the records are complete, the evidence is stored or disposed of under the retention rule, and the programme is told.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 6.6 is followed with nothing added: the audit is complete when all planned activities are carried out or as otherwise agreed; documented information is retained or disposed of by agreement, the programme and applicable requirements; and, unless required by law, the team and programme manager disclose nothing from the audit or its report to anyone else unless the client, and where appropriate the auditee, has expressly approved it.
Completion is a decision that the audit is finished: the report is issued, the records are complete, the evidence is stored or disposed of under the retention rule, and the programme is told. Without it, audits stay open and the programme cannot measure completion.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The public DIS record does not show a change to this clause. The clause number and title are unchanged.
Evidence an auditor asks for
- Audit completionCompletion record with retention or disposal of audit information
- Audit completionNon-disclosure honoured after the audit
The questions an auditor will ask
The assessor will ask for the completion record and for the retention or disposal decision on the audit file.
Three tests to run before the next audit
- Ask for completion record with retention or disposal of audit information and trace it to the clause it is meant to satisfy.
- Ask for non-disclosure honoured after the audit and trace it to the clause it is meant to satisfy.
Common gaps
- Audit evidence retained indefinitely on auditors' devices
- Audit results disclosed to third parties without approval
Prepare before the next audit
Record the completion date, the report issue, the record location and the retention decision. Close the audit in the programme.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.