ISMS criteria, programme and independent audit planning
Establish the actual audit purpose
An information-security management-system audit compares relevant objective evidence with stated criteria within an agreed scope. The audit client, auditee, audit team and certification decision-maker have different roles. A lead auditor coordinates appropriate work and conclusions; that role does not automatically make the auditor the owner of the auditee’s controls or the person issuing every certificate. First-, second- and third-party audit arrangements have different relationships and authorities.
Separate programme and individual plan
An audit programme organizes relevant audits over a period to meet particular purposes, while an individual plan sets the scope, objectives, criteria, resources, timing and activities for one audit. Consider risk, prior results, change, complexity, information access and team competence. An ISMS scope statement and an audit scope need careful alignment rather than an assumption that every organization-wide system is always included. Independence, confidentiality and conflicts of interest affect team suitability.
Distinguish requirements and guidance
ISO/IEC27001 provides ISMS requirements under its actual edition, while ISO/IEC27002 provides control guidance and ISO19011 provides management-system audit guidance. ISO19011:2026 is now published; stored2018 examples on this page are explicitly historical and do not assert that2018 is the latest edition. Exact clauses, transition requirements and certification rules require the actual current authorized texts and programme. A control reference set is not a command that every organization implements every control identically without risk treatment and justification.
Prepare evidence-based work
Review relevant scope, risk method, treatment, Statement of Applicability, policies, objectives and prior results to plan useful sampling. A document review is not proof of operating effectiveness. Remote methods can support particular evidence questions while leaving physical or contextual observation limits. Confirm actual access, technology, confidentiality, safety and communication with the auditee. No audit system is accessed and no certification decision is made by these exercises. This is written audit reasoning for the named subject, not proof of completed competence assessment, current Exemplar Global credential eligibility or a complete official examination. Administrative qualification facts remain unknown and study allocations are editorial.