ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 6.7
Audit follow-up
Follow-up tests whether the corrective action was taken and whether it worked.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 6.7 is followed with nothing added: corrections, corrective actions and improvement opportunities arising from the audit are decided on and carried out by the auditee within the time agreed, their completion and effectiveness verified, possibly in a subsequent audit, and the outcome reported to those managing the programme and the client.
Follow-up tests whether the corrective action was taken and whether it worked. It is not a check that a form was filled in. The follow-up can be a desk review, a short on-site visit or a later audit, and the result goes back to the programme.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The clause carries over; the DIS aligns the follow-up with the 19011:2026 text and the 27001:2022 corrective action requirements.
Evidence an auditor asks for
- Audit follow-upFollow-up records verifying the completion and effectiveness of corrective actions
The questions an auditor will ask
The auditor will ask for a closed finding with the evidence of effectiveness, not only the evidence of the action.
Three tests to run before the next audit
- Ask for follow-up records verifying the completion and effectiveness of corrective actions and trace it to the clause it is meant to satisfy.
Common gaps
- Corrective actions accepted on a plan with no verification of effect
- Follow-up left to the next annual audit for a significant finding
Prepare before the next audit
Set a follow-up date for every finding, record the evidence of effectiveness, and feed the result into the programme review.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.