Knowledge and skills

The 2020 guidance as published

This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.

ISO 19011:2018, 7.2.3 applies, and 27007 adds to it in one place only. Without addition (7.2.3.1, 7.2.3.2, 7.2.3.4, 7.2.3.5): auditors hold the knowledge and skills to achieve the intended results of their audits, a generic competence plus discipline and sector knowledge, and team leaders the extra competence to lead; generic knowledge covers audit principles, processes and methods (risk-based auditing, planning and time management, prioritising, communicating, interviewing, observing and reviewing documented information, sampling, using technical experts, following a process end to end, verifying information, judging whether evidence is sufficient, weighing what affects reliability, documenting and reporting, and keeping information confidential and secure), management system standards and other references, the organization and its context, and the applicable statutory, regulatory and other requirements; team leaders can plan and assign work, discuss strategic issues with top management, keep the team collaborative, manage the audit process, represent the team, lead it to its conclusions and complete the report; auditors of combined or integrated systems understand how the systems interact and where their own competence ends. The ISMS addition is in 7.2.3.3: on top of the discipline and sector competence the audit team needs collectively (management system requirements and principles, the fundamentals of the discipline and sector, its methods and practices, and the means to evaluate the risks and opportunities tied to the audit objectives), ISMS auditors should also be able to understand the business requirements that apply to the auditee.

Knowledge and skills are the substance of auditor competence: audit principles and methods, management system standards, the organisation and its context, the applicable requirements, and the discipline and sector knowledge the audit needs. For an ISMS the discipline knowledge is information security risk, controls and technology, and the sector knowledge is the business the ISMS protects.

The DIS layer: what the public record shows

The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.

The 19011:2026 revision adds knowledge of data protection and information security as a competence, and the responsible use of emerging technologies in audit conduct.

Evidence an auditor asks for

• CompetenceAuditor competence profiles covering generic, ISMS-discipline and sector knowledge
• CompetenceEvidence that auditors understand the auditee's business requirements (briefings, prior sector audits)
• CompetenceTeam-leader competence records

The questions an auditor will ask

The assessor will match the auditor's competence record to the audit scope and ask where the auditor's knowledge ended and a technical expert was needed.

Three tests to run before the next audit

• Ask for auditor competence profiles covering generic, isms-discipline and sector knowledge and trace it to the clause it is meant to satisfy.
• Ask for evidence that auditors understand the auditee's business requirements (briefings, prior sector audits) and trace it to the clause it is meant to satisfy.
• Ask for team-leader competence records and trace it to the clause it is meant to satisfy.

Common gaps

• ISMS auditors who can recite controls but cannot relate them to the auditee's business
• Team competence never checked as a whole against the audit scope

Prepare before the next audit

Build the competence matrix from the audit scope, not from a generic course list. Record the gap and the expert who filled it.

Cross-references

7.2.4 7.3 7.4