ISO & IEC / Guidance
ISO/IEC 27007:2020 Audit the ISMS
ISO/IEC 27007 helps plan and conduct audits of an ISMS and consider auditor competence. It focuses on how to examine the management system, including whether its processes work in the defined scope.
The place in the system
Where it fits
It supports internal and external audits of an ISO/IEC 27001 ISMS and sits alongside, rather than replacing, the certifier rules in 27006-1.
Practical interpretation
How to use this reference
These are editorial starting points, not copied requirements or an implementation checklist from the standard.
Questions and actions
- Set audit objectives and boundaries before selecting samples.
- Match auditor skills to the technology and risk being examined.
- Track findings through correction and effectiveness checks.
Evidence to look for
- Audit programme
- Sample and interview plan
- Finding follow-up record
Illustrative example
What it could look like
An internal audit finds that risk reviews happen on schedule but do not reflect recent service changes. The audit team traces the handoff failure and checks that corrective action changes the process.
Boundary to keep clear
An audit guide does not itself grant certification and should not be confused with technical assessment of individual controls.
Source and edition check
Open the official record
Research checked 2026-10-20. Catalogue status and edition can change; the official publisher record controls. Full standard text is not reproduced here.