ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 5.5.4
Selecting audit team members
Team selection is about collective competence for the scope, not a list of available names.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 5.5.4 is followed (the team appointed for the competence the objectives need, size and composition by scope, complexity, methods, languages and independence), and the audit team as a whole should know and understand information security risk management well enough to assess the auditee's methods, and understand information security and its management well enough to assess how controls are determined, planned, implemented and maintained and how effective the ISMS is.
Team selection is about collective competence for the scope, not a list of available names. The team needs the generic audit skills, the ISMS discipline knowledge and the sector or technology knowledge the audit will test, plus the language and access arrangements the auditee needs.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The 19011:2026 revision adds the responsible use of emerging technologies in audit conduct to the competence expectations, and clarifies the distinction between observers and technical experts.
Evidence an auditor asks for
- Audit planningTeam selection records showing risk-management and information-security competence in the team
- Audit planningTechnical experts assigned where the team lacks a technology
The questions an auditor will ask
The auditor will match the team's competence record to the audit scope and ask where the team's knowledge ended and a technical expert was used.
Three tests to run before the next audit
- Ask for team selection records showing risk-management and information-security competence in the team and trace it to the clause it is meant to satisfy.
- Ask for technical experts assigned where the team lacks a technology and trace it to the clause it is meant to satisfy.
Common gaps
- A team competent in management-system auditing with nobody able to evaluate the risk assessment method
- Control effectiveness judged by auditors with no information security knowledge
Prepare before the next audit
Build the team from the competence matrix. Record the gap that a technical expert filled and the limit of that expert's role.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.