Auditing ISO 27001 Clause 8: Operational Planning and Control
Clause 8 is where you find out whether the design in Clause 6 is real. It has three short sub-clauses: operational planning and control, performing the risk assessment at planned intervals or on significant change, and implementing the risk treatment plan. Most Clause 8 findings look like Clause 6 findings until you ask when something last happened.
Clause 8 is where you find out whether the design in Clause 6 is real. It has three short sub-clauses: operational planning and control, performing the risk assessment at planned intervals or on significant change, and implementing the risk treatment plan. Most Clause 8 findings look like Clause 6 findings until you ask when something last happened.
The worked findings on this page are invented, and so are the organisations in them. They are written to show how a finding is built and graded, not to catalogue the findings you should expect.
The distinction ISO 27001 Clause 8 turns on
Clause 6 is the design. Clause 8 is whether it runs. Two pairs of requirements say almost the same thing in different places, and knowing which is which decides a great many findings.
| The design, in Clause 6 | The operation, in Clause 8 |
|---|---|
| 6.1.2 — define and apply a risk assessment process producing consistent, valid and comparable results | 8.2 — perform assessments at planned intervals or when significant changes are proposed or occur, retaining the results |
| 6.1.3 — define a treatment process, produce a Statement of Applicability, formulate a treatment plan | 8.3 — implement the plan, retaining the results |
So an organisation with an excellent, documented risk method that has not reassessed anything since certification has a Clause 8.2 problem. Its method is fine. Citing 6.1.2 for it is a wrong answer, and a common one.
The test is one question: is the requirement about having a process, or about the process having run?
ISO 27001 Clause 8.1, and the part that is easy to miss
Clause 8.1 asks for five things. Four of them were in the previous edition in much the same words; the second is the one the 2022 revision added, and it is missing from most inherited checklists.
- Plan, implement and control the processes needed to meet requirements and to implement the actions determined in Clause 6 — note Clause 6, not 6.1, so the objectives at 6.2 and the change planning at 6.3 are in scope.
- Establish criteria for those processes and control them in accordance with the criteria. This is the sentence auditors skip, and it is a genuine requirement: an organisation running a process with no stated criteria for what good looks like cannot show it is controlling it.
- Documented information shall be available to the extent necessary to have confidence the processes were carried out as planned. Note the verb: the current text asks for it to be available, where the previous edition asked the organisation to keep it.
- Control planned changes and review the consequences of unintended changes, taking action to mitigate adverse effects.
And the fifth, in the clause’s closing sentence: externally provided processes, products or services that are relevant to the ISMS must be controlled. That wording is wider than the “outsourced processes” phrase it replaced — a purchased service reaches it as readily as an outsourced function.
Preparing for the PR373 exam?Full-length mock exams and exam application support are included.
The audit trail for ISO 27001 Clause 8
Start from the Statement of Applicability, not from the clause text. Take three controls it marks as implemented, chosen by you, and go and watch them operate. That is what auditing this clause looks like in practice: the paperwork lives in Clause 6, the reality lives here.
Then ask three date questions. When was the risk assessment last performed? What changes have happened since, and were any of them significant? When did the treatment plan last move? Dates do more work in this clause than documents.
Then take one externally provided service that is relevant to the ISMS — not one the organisation offers you — and ask how it is controlled. Not whether there is a contract: what the organisation does to satisfy itself that the arrangement is working.
A worked ISO 27001 finding on Clause 8.1
Weybridge Foods operates a documented user access provisioning process. It runs, and requests are actioned.
| Statement | Criteria have not been established for a process needed to meet requirements and to implement the actions determined in Clause 6. |
|---|---|
| Objective evidence | The access provisioning process (OPS-11) describes the steps for raising, approving and actioning an access request. It states no criteria: no required approver by system or by privilege level, no time within which a request is to be actioned, and no definition of a valid approval. Twelve requests were sampled from the period. In four (AR-0148, AR-0163, AR-0201, AR-0227) the approver held no role identified in any documented information as an approver for the system concerned; in two (AR-0179, AR-0244) the request record shows no approval at all. The service desk manager confirmed that approvals are accepted from any manager. |
| Requirement | ISO/IEC 27001 Clause 8.1 requires the organisation to plan, implement and control the processes needed to meet requirements and to implement the actions determined in Clause 6, by establishing criteria for the processes and implementing control of the processes in accordance with the criteria. |
| Grade | Major — criteria are absent for the process as a whole rather than for particular requests, and the service desk manager’s account confirms the gap is how the process is run, so the absence is in the design of the process rather than in individual records. |
One discipline in writing any of these. Record what you were told as fact where it establishes how far the failure reaches; do not write your own diagnosis of why it happened. “The service desk manager confirmed that approvals are accepted from any manager” is evidence of extent — it tells the reader the gap is not confined to the twelve records sampled. “This happened because the process was written without thinking it through” is a cause. Causes are the organisation’s to establish under Clause 10.2, and supplying one hands the auditee something to argue about instead of something to answer.
Want structured preparation?One year of LMS access and HD recordings come with the course.
A worked ISO 27001 finding on Clause 8.3
Ashcroft Pensions has a current risk treatment plan with owners and dates, produced through a functioning Clause 6 process.
| Statement | The information security risk treatment plan has not been implemented for six of the nine items that had fallen due, and documented information of the results of risk treatment has not been retained for any item. |
|---|---|
| Objective evidence | The risk treatment plan (RTP-04, current version) contains nineteen items. Nine carry completion dates that had passed at the time of the audit. For six of those nine (items 2, 5, 8, 11, 15 and 17) no record of completion, partial progress or revised date was produced, and the owners of items 2, 8, 11 and 17 confirmed that no work had begun. Items 4, 9 and 13 are recorded as complete. The remaining ten items are not yet due. No documented information recording the results of risk treatment was produced for any completed item. |
| Requirement | ISO/IEC 27001 Clause 8.3 requires the organisation to implement the information security risk treatment plan and to retain documented information of the results of the information security risk treatment. |
| Grade | Major — two thirds of the items that have fallen due are neither done nor recorded, and no results are retained for the three recorded as complete either, so the failure runs across the plan’s due population rather than affecting particular items. |
Note what this finding is not. It is not a Clause 6.1.3 e) finding: the plan exists and was properly formulated. The failure is that it has not been carried out, which is squarely 8.3. The same evidence read at the wrong clause produces a finding the auditee can defeat by showing you the plan.
Major or minor on ISO 27001 Clause 8
Grade from the evidence and its reach, never from how serious it feels. A major is a significant or systemic failure — a requirement absent, a process that is not operating, a breakdown that raises doubt the ISMS can achieve its intended results. A minor is an isolated or occasional lapse that does not by itself break the system. Several related minors can together show a systemic problem and become a major.
- Major territory: the risk assessment never repeated since certification; a treatment plan that has not moved; no criteria for the processes the ISMS depends on; externally provided services relevant to the ISMS with nothing in place to control them.
- Minor territory: one process where the stated criteria were not applied on a single occasion; one significant change where reassessment was late; documented information thinner than the confidence requirement asks for in one process.
And keep the opportunity for improvement in its place: advice the organisation may take or leave, never a way of avoiding a nonconformity.
Where ISO 27001 Clause 8 connects
| Connection | What it gives you |
|---|---|
| Clause 6.1.2 and 6.1.3 | The design behind everything you are testing here — and the pair most often cited by mistake |
| Clause 6.3 | Whether a change to the ISMS itself was planned, as distinct from 8.1’s control of operational change |
| Annex A, all four themes | Every selected control operates here or nowhere |
| A.5.19 to A.5.23 | Supplier and cloud controls sit alongside 8.1’s requirement on externally provided services — the control and the clause are separate findings |
| Clause 9.1 | Whether anyone measures the processes 8.1 requires to be controlled |
Frequently asked questions about auditing ISO 27001 Clause 8
What does ISO 27001 Clause 8 require?
Operational planning and control, including establishing criteria for the processes and controlling externally provided processes, products and services; performing risk assessments at planned intervals or on significant change; and implementing the risk treatment plan. Documented information is required for each.
What is the difference between ISO 27001 Clause 6 and Clause 8?
Clause 6 requires the processes to be defined. Clause 8 requires them to be performed. A good method never used is a Clause 8 finding.
Which ISO 27001 clause covers suppliers?
Clause 8.1 requires externally provided processes, products or services relevant to the ISMS to be controlled. The supplier-specific controls are A.5.19 to A.5.23. They are different requirements and can be separate findings.
What counts as a significant change under ISO 27001 Clause 8.2?
The standard does not define it, so the organisation must. An organisation with no working definition of significance cannot show it reassessed when it should have, and that is worth asking about before you look at the dates.
Does ISO 27001 Clause 8 require documented information?
Yes, at all three sub-clauses: enough to have confidence the processes were carried out as planned, the results of risk assessments, and the results of risk treatment.
Where to go next: more ISO 27001 Lead Auditor exam preparation
- Auditing Clause 9: monitoring, internal audit and management review
- Auditing Clause 10: nonconformity and continual improvement
- The clause map: what each clause asks, on one page
- Where the evidence lives: clauses matched to records
The earlier clauses have deep dives of their own: Clause 4, Clause 5, Clause 6, Clause 6.3, Clause 7.
3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is PR373. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.
Booking a PR373 course? See the schedule, trainers and what’s included.
Leave a reply