ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 7.6
Maintaining auditor competence
Competence is maintained and improved through continuing practice, professional development, feedback and the analysis of what audits reveal.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 7.6 applies: ISMS auditors and team leaders keep improving their competence by taking part regularly in management system audits and by continuing professional development (further work experience, training, private study, coaching, meetings, seminars and conferences); the programme manager sets up a way to evaluate their performance continually; and development takes account of the changing needs of the auditor and of the audit organization, developments in auditing practice including technology, the relevant standards and requirements, and changes in the sector or discipline.
Competence is maintained and improved through continuing practice, professional development, feedback and the analysis of what audits reveal. The record is a living file, not a one-off certificate.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The 19011:2026 revision asks competence monitoring to use what auditees and stakeholders say about the audit.
Evidence an auditor asks for
- CompetenceCPD records of ISMS auditors
- CompetenceContinual performance evaluation records kept by the programme manager
The questions an auditor will ask
The assessor will ask what changed in the auditor's competence in the last cycle and what evidence drove the change.
Three tests to run before the next audit
- Ask for cpd records of isms auditors and trace it to the clause it is meant to satisfy.
- Ask for continual performance evaluation records kept by the programme manager and trace it to the clause it is meant to satisfy.
Common gaps
- Auditors inactive for years still on the programme
- No development against revisions of the standards audited
Prepare before the next audit
Review competence annually and after a significant change. Use audit feedback and results as inputs, and record the development action.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.