Auditor evaluation method

The 2020 guidance as published

This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.

ISO 19011:2018, 7.4 applies with no ISMS-specific addition: each evaluation should use at least two of the methods in the 19011 table (review of records, feedback, interview, observation, testing and post-audit review), recognising that not every method suits every case and that their reliability differs, so that the combination gives an objective, consistent, fair and reliable result.

The evaluation method has to fit the criterion: a written test for knowledge, an observed audit for skills, an interview for judgement, feedback for behaviour. A single method cannot evidence the whole competence set.

The DIS layer: what the public record shows

The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.

The 19011:2026 revision asks competence assessment to include the use of emerging technologies in audit conduct; the method should therefore test remote and tool-assisted work.

Evidence an auditor asks for

• CompetenceEvaluation record per auditor naming the two or more methods used and their results

The questions an auditor will ask

The auditor will ask which method was used for which criterion and why.

Three tests to run before the next audit

• Ask for evaluation record per auditor naming the two or more methods used and their results and trace it to the clause it is meant to satisfy.

Common gaps

• Evaluation by record review alone
• Witnessed audits never used for ISMS auditors

Prepare before the next audit

Map each criterion to a method and record the result. Add remote audit observation where remote methods are used.

Cross-references

7.2.3 7.3 7.5 7.6