ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 5.4.2
Competence of the programme manager
The person who manages the programme needs enough competence to judge audit scope, method, team composition and results.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 5.4.2 is followed with nothing added: those managing the ISMS audit programme have the competence to manage it and its risks, opportunities and issues, with knowledge of audit principles, methods and processes, of ISO/IEC 27001 and the other standards and references the programme uses, of the auditee and its context, of the applicable statutory, regulatory and other requirements, and of information security and its risk management where relevant to the programme.
The person who manages the programme needs enough competence to judge audit scope, method, team composition and results. That is a different competence from being a good auditor: it is the ability to design a programme and to challenge the people who deliver it.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The clause carries over and its competence expectations are read with the 19011:2026 knowledge and skills, including remote methods and data protection.
Evidence an auditor asks for
- CompetenceCompetence record of the audit programme manager
- CompetenceEvidence of maintained knowledge of ISO/IEC 27001 and the audit process
The questions an auditor will ask
The assessor will ask for the programme manager's competence record and for an example of a programme decision that depended on it.
Three tests to run before the next audit
- Ask for competence record of the audit programme manager and trace it to the clause it is meant to satisfy.
- Ask for evidence of maintained knowledge of iso/iec 27001 and the audit process and trace it to the clause it is meant to satisfy.
Common gaps
- A programme manager with audit competence but no information security knowledge
- Competence assumed from seniority
Prepare before the next audit
Add the programme manager to the competence matrix, with the programme-specific knowledge (risk, method selection, team composition, records) and the evidence behind it.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.