PDCA in ISO 27001: How the Clauses Fit Together

Plan-do-check-act maps onto ISO/IEC 27001 as: Clauses 4, 5 and 6 plan, Clauses 7 and 8 do, Clause 9 checks, Clause 10 acts. It is a useful way to hold the shape of the standard. It is also worth knowing that the current text contains no PDCA model, no cycle diagram, and no clause-to-cycle mapping.

Is PDCA in ISO 27001? The awkward fact first

Almost every explanation of this standard opens with a PDCA diagram, so it is reasonable to assume PDCA is in it. It is not. An earlier edition built the standard explicitly around the cycle, with a figure and a clause-by-clause mapping. That went in the same revision that adopted the shared management-system structure and has not come back.

Worth being accurate about why, because it is not the structure’s fault. The quality and environmental management standards adopted the same structure and kept an explicit discussion of the cycle. Its absence here was a choice by the committee that writes this standard, not a consequence of the harmonized clause numbering.

Why that matters is narrow but real. You cannot cite PDCA in a finding. There is no requirement to “follow PDCA” and no clause to point at, so a nonconformity written against the cycle is unciteable. What you cite is the clause — 9.2 for internal audit, 10.2 for corrective action — and the cycle is how you found your way to it.

Everything else about PDCA remains useful, which is why this page exists rather than simply saying the model is obsolete.

How ISO 27001 clauses map to plan-do-check-act

Where the mapping is arguable. Clause 7 Support is the contested one. Placing it in do reflects that resourcing, competence and document control are things you carry out. Placing it in plan reflects that you determine what is needed before you do anything. Both are defensible and neither is wrong, because the standard does not adjudicate.

Two more edges worth knowing. Clause 6.3, planning of changes, is plan by name but bites during operation. And Clause 8.2 and 8.3 — performing the risk assessment and implementing the treatment plan — sit in do while their design sits in plan at 6.1.2 and 6.1.3.

The one insight PDCA actually gives you about ISO 27001

Clause 6 is the design. Clause 8 is whether it runs.

The same two activities appear twice in the standard. Clause 6.1.2 requires a defined risk assessment process; Clause 8.2 requires it to be performed at planned intervals or when significant changes are proposed or occur, with results retained. Clause 6.1.3 requires a risk treatment process and a plan; Clause 8.3 requires the plan to be implemented, with results retained.

For an auditor that resolves a question that otherwise causes wrong answers: which clause does this finding belong to?

• An organisation with no defined risk assessment method, or one that does not produce consistent results — that is a design failure. Clause 6.1.2.
• An organisation with a good method that assessed its risks once at certification and never again — the design is fine and the operation is not. Clause 8.2.
• A risk treatment plan that exists but has not moved in two audit cycles — Clause 8.3, not 6.1.3.

Candidates lose marks by citing the planning clause for an operational failure, because the planning clause is the one they revised. The cycle is the fastest way to catch yourself doing it.

Using PDCA to plan an ISO 27001 audit

There is a second practical use, and it is the one experienced auditors get value from: the cycle tells you what order to look at things in.

Auditing in clause order means arriving at Clause 9 with no time left, which is unfortunate because Clause 9 and Clause 10 are where an ISMS’s real condition shows. Auditing in cycle order means starting where the evidence is richest.

A useful sequence: read the plan documents before the visit — scope, policy, risk assessment, Statement of Applicability — so that time on site goes on do and check. Then test a small number of controls properly rather than many superficially. Then go to the internal audit and management review records, which tell you whether the organisation finds its own problems. An organisation that does is in a different condition from one that does not, whatever its control evidence looks like.

What check and act look like when they are broken in an ISO 27001 ISMS

Most organisations do plan and do tolerably. The cycle breaks at the far end, and predictably.

Check without act. Internal audits happen, findings are raised, and the same findings appear the following cycle. Monitoring produces numbers nobody acts on. Management reviews record attendance rather than decisions. Clause 10.2 is where this surfaces — specifically, whether the need to eliminate causes was ever evaluated.

Act without check. Rarer and more interesting. An organisation improving energetically on instinct, with no measurement telling it whether anything got better. Clause 9.1 requires methods that ensure valid results — and 9.1 b) adds that the methods selected should produce comparable and reproducible results to be considered valid. Improvement with no baseline cannot demonstrate effectiveness.

The cycle that never turns. An ISMS assessed, documented, certified and then frozen. Every clause has a document; none has a second version. This is the pattern that certification exists to catch, and it is why surveillance audits happen at all.

Where PDCA still appears alongside ISO 27001

The cycle has not disappeared from the discipline. It is the shape most management systems are built on, it is how most training explains them, and it is why the standard shares its structure with the quality, environmental and health and safety standards — an organisation running an integrated management system plans, does, checks and acts once, with the information-security-specific requirements layered on at Clause 6, Clause 8 and Annex A.

So use it as a mental model and a diagnostic. Just do not cite it.

Frequently asked questions about PDCA in ISO 27001

Where to go next: more ISO 27001 Lead Auditor exam preparation

• ISO/IEC 27001 clauses 4 to 10, clause by clause
• All 93 Annex A controls, by theme
• The Statement of Applicability, and how it is audited
• The ISO/IEC 27000 family: which standard does what

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is PR373. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.