The 2022 update to the ISO 27001 standard introduced a vital requirement: Clause 6.3, “Planning of changes.” While new clauses often cause concern for organisations undergoing certification, this addition simply formalises best-practice processes. In my 30 years as an auditor, I have found that this clause ensures modifications to the Information Security Management System (ISMS) are handled with foresight rather than as reactive adjustments.
This guide provides a straightforward roadmap for internal and external auditors to effectively audit this clause. It details exactly what auditors look for, enabling organisations to ensure their change management processes are robust, compliant, and effective.
Table of contents
What is ISO 27001 Clause 6.3?
Before auditing the clause, one must understand its strategic purpose. Clause 6.3 is a control designed to maintain the integrity, availability, and confidentiality of information during periods of evolution. It mandates that any changes an organisation makes to its ISMS must be managed in a planned and controlled manner.
The Official Definition
ISO 27001:2022 defines Clause 6.3 as follows:
“When the organisation determines the need for changes to the information security management system, the changes shall be carried out in a planned manner.”
This requirement connects foundational ISMS concepts such as continual improvement, incident management, and internal audits. It transforms the outcomes of these activities into a structured, predictable, and auditable process.
Your 10-Point Audit Checklist for Clause 6.3
A structured checklist is the most valuable tool for a consistent assessment. The following 10-point checklist deconstructs the requirements of Clause 6.3 into verifiable components.
1. Review the Change Management Process
The foundation of compliance is a formal, documented process. Evidence must show that changes are managed systematically from initiation to completion, rather than on an ad-hoc basis.
- Audit Method: Review documented policies and procedures related to change management.
- Audit Method: Interview IT and security personnel to confirm consistent use of the process.
- Audit Method: Compare the organisation’s process against best practices (e.g., ITIL).
2. Assess Impact Assessment Procedures
Auditors must verify that the organisation evaluates consequences before acting. There must be a procedure to assess the potential impact of a change on the ISMS, considering both security risks and opportunities.
- Audit Method: Review impact assessment templates and completed forms.
- Audit Method: Interview change management personnel regarding risk identification.
- Audit Method: Examine a sample of past change requests and associated assessments.
3. Evaluate Change Planning
The output of the impact assessment should drive a detailed implementation plan. Auditors look for a logical flow of information proving the organisation considers all components for successful implementation.
- Audit Method: Review detailed change implementation plans.
- Audit Method: Examine evidence of resource allocation (personnel, budget, tools).
- Audit Method: Analyse change schedules and timelines for realism.
4. Examine Change Authorisation
Significant changes require formal approval. Auditors require a clear, auditable trail of authorisation to ensure accountability.
- Audit Method: Review documented approval workflows and authority levels.
- Audit Method: Interview personnel with approval authority.
- Audit Method: Check a sample of records for proper signatures and dates.
5. Assess Change Implementation
The audit must confirm that the actual implementation aligned with the approved plan. Deviations can introduce unforeseen risks.
- Audit Method: Observe change implementation activities where possible.
- Audit Method: Review change logs and implementation records.
- Audit Method: Examine system logs (before and after) to verify planned outcomes.
6. Evaluate Change Testing
Inadequate testing is a common point of failure. Changes must be thoroughly tested in a non-production environment before deployment.
- Audit Method: Review formal test plans, cases, and documented results.
- Audit Method: Interview testing personnel regarding methodologies.
- Audit Method: Verify independent testing of implemented changes.
7. Assess Change Communication
A technically perfect change can fail if stakeholders are uninformed. Auditors verify a systematic process for communicating changes to interested parties.
- Audit Method: Review communication plans and records (emails, meeting minutes).
- Audit Method: Interview interested parties to gauge awareness.
- Audit Method: Request analysis of communication effectiveness.
8. Examine Change Review
Compliance extends beyond implementation. Organisations must conduct post-implementation reviews to assess effectiveness and capture lessons learned.
- Audit Method: Review post-implementation review reports.
- Audit Method: Check documentation for tracked “lessons learned.”
- Audit Method: Analyse change success rates and incident metrics.
9. Evaluate Change Documentation
A complete audit trail is non-negotiable. Auditors verify that the organisation maintains a reliable record for every modification to the ISMS.
- Audit Method: Review records within the change management system.
- Audit Method: Examine audit trails for integrity and completeness.
10. Assess Emergency Change Management
Urgent changes require speed but cannot bypass control. A robust process allows for expedited approval while ensuring documentation and review still occur.
- Audit Method: Review emergency change procedures and criteria.
- Audit Method: Examine past emergency change records.
- Audit Method: Test the process with a simulated scenario.
DO IT YOURSELF
STOP SPANKING £10,000s on CONSULTANTS and ISMS ONLINE PLATFORMS
Common Audit Failures and How to Avoid Them
Understanding common pitfalls allows organisations to remediate weaknesses before an audit. Below are frequent failures related to Clause 6.3.
The “Informal” Process Problem
The Failure: Staff describe a process that is not documented. Without formal policies, security practices are inconsistent.
How to Avoid It: Develop a concise change management policy and train all relevant personnel on its use.
Overlooking the Ripple Effect
The Failure: Changes are implemented without a risk assessment, overlooking potential impacts on the wider ISMS.
How to Avoid It: Use formal risk assessment methodologies to identify positive and negative consequences before approval.
The Failure of Inadequate Planning
The Failure: Records reveal a lack of resource allocation or timelines, leading to failed implementations.
How to Avoid It: create detailed implementation plans for every significant change, assigning clear responsibilities.
Unauthorised or Ambiguous Changes
The Failure: Changes are made without a clear authorisation trail, suggesting the ISMS is altered based on convenience rather than strategy.
How to Avoid It: Define clear approval levels for different change types and track them through a formal system.
Insufficient or Non-Existent Testing
The Failure: Incidents are traced back to changes that were not tested, indicating a weak control environment.
How to Avoid It: Mandate formal test plans and ensure results are reviewed as part of the approval process.
Conclusion: Embedding Planned Change into Your Security Culture
Auditing ISO 27001 Clause 6.3 verifies a systematic, risk-aware approach to ISMS evolution. Auditors seek tangible evidence that the process is understood and effective. For organisations, this is more than a compliance exercise; it is a framework for resilience. By embracing this discipline, you ensure your ISMS grows stronger and more secure over time.
About the author
Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.
Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.
As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.
His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.
