Audit programme risk

The 2020 edition already required the programme to identify risks and opportunities. The revision makes the list more concrete, which is useful because programme risk is often recorded as a generic sentence. The new factors are the ones that actually stop an audit: the only auditor who knows the payment system leaves, the remote platform cannot carry the evidence, the business unit quietly moves its audit date, or the programme has no sponsor when a difficult finding lands.

For an ISMS the platform risk is specific. Audit evidence includes configurations, logs and incident records, and moving that evidence through a collaboration tool creates a confidentiality question as well as an availability question. The programme risk review should name the tool, the access rule and the handling rule.

The audit evidence is a programme risk log with owners and review dates, and one decision that changed because of a risk. A log with no decision is a list, not a risk process.

What to keep

• A programme risk and opportunity log with owners and dates
• One decision that changed the programme
• A platform and access risk entry for remote evidence
• A leadership sponsor named for the programme

Common gaps

• Programme risk recorded as a generic sentence
• No owner for a programme risk
• Remote evidence handled without a confidentiality rule

What this means for your programme

Put the change in the programme record with a date, an owner and the source you checked. Do not rewrite the whole procedure on the strength of a draft. The kit's crosswalk and dated plan are built for this: one row per clause or annex row, with the current position and the draft position side by side.

This page is our reading of the public record. The DIS body is not public in full. Where a statement depends on the 19011:2026 change summary rather than on the DIS text, the page says so.