ISMS review process
Independent review is a governance control, so it can be counted.
What the published 2016 guidance says
Independent review is a governance control, so it can be counted. The construct divides reviews conducted by a third party by the reviews planned, as a ratio. An illustrative target is between 0.8 and 1.1 for no action, with above 0.6 accepted if the primary condition is missed. Evidence is the count of conducted and planned third-party reviews. It is collected, analysed and reported quarterly, and reviewed every two years. The management system leads own it, internal audit and the quality manager collect, and the management system and quality leads are clients. A bar graph shows compliance against the thresholds.
What it means in practice
Independent review is a governance control. Count third-party reviews conducted against those planned. The threshold reflects the reality that not every planned review happens; the trend shows whether the programme is slipping.
Status of this record. For B.36, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the third-party review plan and the reports. Count the reviews conducted against the plan. Report the ratio and the trend. Record the reason for each review not done.
Evidence an assessor asks for
- Independent reviewPlan of independent reviews
- Internal auditThird-party review reports against the plan
- Independent reviewQuarterly bar graph
The question an assessor will ask
An assessor will ask for plan of independent reviews. The test for B.36 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Independent reviews planned nowhere, so the ratio is undefined
- Internal audits counted as independent reviews
Before the next review
Before the next review, test this against one live record: independent reviews planned nowhere, so the ratio is undefined.
What to check when the revision publishes
When DIS 27004 is published, compare the B.36 ISMS review process record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.