Auditor competence: ISO 27007 revision

Auditor competence

The competence expectations move with the 19011 revision: data protection and information security knowledge are added, the responsible use of emerging technologies is added to audit conduct, the personal behaviour "fortitude" is removed, and competence monitoring has to use feedback from auditees and stakeholders.

The 2020 edition already required ISMS auditors to understand the business requirements that apply to the auditee, on top of the generic and discipline competence. The revision sharpens the knowledge set and adds two areas that an ISMS audit now needs: data protection and information security as competence in their own right, and the responsible use of emerging technologies in audit conduct.

The removal of "fortitude" from the personal behaviour list is not a softening. The other behaviours (ethical, open, diplomatic, observant, perceptive, adaptable, tenacious, decisive, self-reliant) still carry the duty to hold a finding when the evidence supports it. The point is that a single word is a poor competence criterion; the evaluation should test the behaviour through an observed audit and through feedback.

The evaluation method has to match the criterion. A written test can evidence knowledge of the 2022 clause set; it cannot evidence the judgement to grade a nonconformity or the behaviour to raise one with a senior manager. The competence record should say which method evidenced which criterion.

What to keep

A competence matrix for generic, ISMS discipline and sector knowledge
Evidence of data protection and information security knowledge
An observed audit or a feedback record for behaviour
A development action from the last competence review

Common gaps

Competence recorded as course attendance only
No evidence of data protection knowledge
Feedback from auditees collected but never analysed

What this means for your programme

Put the change in the programme record with a date, an owner and the source you checked. Do not rewrite the whole procedure on the strength of a draft. The kit's crosswalk and dated plan are built for this: one row per clause or annex row, with the current position and the draft position side by side.

This page is our reading of the public record. The DIS body is not public in full. Where a statement depends on the 19011:2026 change summary rather than on the DIS text, the page says so.