ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 7.2.2
Personal behaviour
Personal behaviour is the observable side of auditor competence: ethical, open, diplomatic, observant, perceptive, adaptable, tenacious, decisive, self-reliant and able to act with fortitude.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 7.2.2 applies with no ISMS-specific addition: ISMS auditors should have the attributes that let them act on the principles of auditing and should behave professionally while auditing, being ethical (honest, fair, truthful, sincere and discreet), diplomatic, open-minded, perceptive, observant, tenacious, versatile, self-reliant, decisive, able to act with fortitude when a finding is unwelcome, open to improvement, culturally sensitive and working well with the auditee's people and with the rest of the audit team.
Personal behaviour is the observable side of auditor competence: ethical, open, diplomatic, observant, perceptive, adaptable, tenacious, decisive, self-reliant and able to act with fortitude. For an ISMS audit the behaviour that matters most is the willingness to keep asking for evidence when the first answer is a policy document.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The 19011:2026 revision removes the ability to act with fortitude from the list of personal behaviours. The behaviour is still tested through the other attributes and through audit conduct.
Evidence an auditor asks for
- CompetenceAuditor evaluation records covering professional behaviour
- CompetenceWitnessed-audit or peer feedback on conduct
The questions an auditor will ask
The assessor will ask for evidence of an auditor's behaviour under pressure: a finding maintained against a senior manager, or a judgement changed when the evidence changed.
Three tests to run before the next audit
- Ask for auditor evaluation records covering professional behaviour and trace it to the clause it is meant to satisfy.
- Ask for witnessed-audit or peer feedback on conduct and trace it to the clause it is meant to satisfy.
Common gaps
- Behaviour never evaluated, only knowledge
- Complaints from auditees about auditor conduct not fed into evaluation
Prepare before the next audit
Include behaviour in the competence evaluation, with examples from audit feedback and observation. Do not rely on a self-assessment alone.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.