ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 7.2.4
Achieving auditor competence
Achieving competence is the evidence that the knowledge and skills were acquired and applied, not the certificate of attendance.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 7.2.4 applies (competence built from a mix of generic auditor training, experience in a technical, managerial or professional role calling for judgement, decisions and communication, education, training and experience in the discipline and sector, and audit experience supervised by an auditor who is competent in that discipline), and ISMS auditors should in addition have knowledge and competence in information technology and information security, which can be demonstrated for example by relevant certifications such as a personnel certification granted under ISO/IEC 17024; each ISMS auditor's professional experience should also contribute to building knowledge and competence in the ISMS field. A note points to ISO/IEC 27006 for further information on the certification of ISMS auditors.
Achieving competence is the evidence that the knowledge and skills were acquired and applied, not the certificate of attendance. It can come from education, training, work experience, audit experience and professional development, and it should be recorded against the competence it supports.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The clause carries over; the evidence should reflect the 19011:2026 competence set, including remote methods and data protection.
Evidence an auditor asks for
- CompetenceRecords of training, experience and supervised audits per auditor
- CompetenceEvidence of IT and information security competence, such as personnel certificates under an ISO/IEC 17024 scheme
- CompetenceProfessional experience records relevant to the ISMS scope
The questions an auditor will ask
The auditor will ask for the evidence behind one competence claim and for an audit where it was applied.
Three tests to run before the next audit
- Ask for records of training, experience and supervised audits per auditor and trace it to the clause it is meant to satisfy.
- Ask for evidence of it and information security competence, such as personnel certificates under an iso/iec 17024 scheme and trace it to the clause it is meant to satisfy.
- Ask for professional experience records relevant to the isms scope and trace it to the clause it is meant to satisfy.
Common gaps
- Competence claimed from a lead-auditor course alone with no IT or security background
- Supervised audit experience not recorded
Prepare before the next audit
Link each competence to its evidence: course, qualification, supervised audits, sector experience, feedback. Date the record.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.