ISO/IEC DIS 27007, Edition 4 (unpublished), Clauses 5.5.3 and 6.2.3
Remote and hybrid audits
The revision of ISO 19011 expands guidance on remote auditing methods and folds virtual locations into remote audit. Because 27007 follows 19011, the DIS is expected to carry that expansion into ISMS audit method selection and feasibility.
ISO 19011:2026 was published on 2026-05-27. Its foreword names two main changes: expanded remote-audit guidance, drawing on ISO/IEC TS 17012, and expansion of Annex A to cover remote auditing methods and virtual locations. The DIS 27007 foreword says the document is aligned with the 19011 revision.
For an ISMS audit the change is not "remote is allowed". It is that the method choice has to be justified against the evidence the audit needs. A remote method can reach documents, interviews, screen shares and logs; it reaches physical access control, a data centre visit or a culture observation less well. The audit file should say what the method could not reach, what was verified remotely and what was left to an on-site visit.
The 19011:2026 change summary, a third-party interpretation held with the standard, also records that the audit programme should consider bandwidth and access to digital systems, and that the feasibility check should consider geopolitical events. Those points are labelled as the 19011 change, not as quoted 27007 text, because the 27007 DIS body is not public.
What to keep
- A method decision per audit area with the reason
- A record of what was verified remotely and what was not
- A bandwidth and access check for a remote audit
- A feasibility review after an incident or a travel restriction
Common gaps
- Remote audit chosen for cost with no evidence rationale
- No record of what the remote method could not reach
- Feasibility never revisited when an incident affected the audit
What this means for your programme
Put the change in the programme record with a date, an owner and the source you checked. Do not rewrite the whole procedure on the strength of a draft. The kit's crosswalk and dated plan are built for this: one row per clause or annex row, with the current position and the draft position side by side.
This page is our reading of the public record. The DIS body is not public in full. Where a statement depends on the 19011:2026 change summary rather than on the DIS text, the page says so.
ISO 19011:2026, Edition 4, standard page 88984. Held BS EN ISO 19011:2026 and the public change summary. ISO/IEC DIS 27007, Edition 4, standard page 92416.
Retrieved 2026-10-19. The licensed texts are not reproduced.