ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 7.3
Auditor evaluation criteria
Evaluation criteria make the competence judgement repeatable.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 7.3 applies with no ISMS-specific addition: criteria for evaluating ISMS auditors should be both qualitative (behaviour, knowledge or skill demonstrated in training or at work) and quantitative (years of education and of work experience, how many audits conducted, how many hours of audit training).
Evaluation criteria make the competence judgement repeatable. They state what an auditor must be able to do, at what level, for the audit types and scopes the organisation runs. Without criteria, evaluation becomes a personality judgement.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The public DIS record does not show a change to this clause. The clause number and title are unchanged.
Evidence an auditor asks for
- CompetenceDocumented auditor evaluation criteria for the ISMS programme, qualitative and quantitative
The questions an auditor will ask
The assessor will ask for the criteria used for the last evaluation and for the evidence that they were applied consistently.
Three tests to run before the next audit
- Ask for documented auditor evaluation criteria for the isms programme, qualitative and quantitative and trace it to the clause it is meant to satisfy.
Common gaps
- Criteria that count audits and hours but never test demonstrated skill
Prepare before the next audit
Write criteria per competence and per audit type, with a rating scale and the evidence required for each level.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.