A Practical Guide to Auditing ISO 27001 Clause 7.2: Competence

While the ISO 27001 standard can appear daunting, Clause 7.2 on “Competence” is where compliance becomes intensely practical. It focuses on your people—your first and last line of defence. This guide serves as your blueprint, moving beyond theory to detail precisely what ISO 27001 auditors scrutinise, the evidence they demand, and how to demonstrate staff competence with confidence.

Key Takeaways for ISO 27001 Compliance

• Mandatory Requirement: Clause 7.2 is a non-negotiable part of the standard. It mandates that all personnel impacting the Information Security Management System (ISMS) must possess the necessary skills and experience.
• Implementation Focus: Organisations must engage with trained ISO 27001 resources, formally assign roles, and identify specific information security skills for those positions.
• Auditor Verification: Auditors verify compliance by reviewing documented roles, examining concrete evidence (such as an ISO 27001 competency matrix), and looking for training plans that address skill gaps.
• Common Audit Failures: Frequent mistakes include a lack of ISO 27001 experience within the team, failure to document roles, and neglecting forward-looking training plans.

Demystifying Clause 7.2: What Are You Actually Auditing?

ISO 27001 competence ensures the individuals performing work that affects your information security performance have the necessary skills, knowledge, and experience. You cannot achieve certification if your team lacks fundamental knowledge of the ISO 27001 framework.

The Official ISO 27001 Clause 7.2 Requirement

The organisation shall:

• Determine the necessary competence of persons doing work under its control.
• Ensure these persons are competent based on appropriate education, training, or experience.
• Take actions to acquire necessary competence and evaluate the effectiveness of those actions.
• Retain documented information as evidence of competence.

This clause extends beyond the IT department to include HR, legal, regulatory compliance, and commercial teams.

The Auditor’s Checklist: What Evidence Will Be Examined?

Auditors follow a structured process to verify implementation. They typically focus on two primary areas:

1. Documented and Assigned Roles

The auditor verifies that the organisation has clearly defined all ISMS roles and formally assigned them to specific individuals to ensure accountability.

2. Documented Evidence of Competence

Auditors prize the competency matrix. It serves as a “single source of truth,” mapping roles to individuals, skills to requirements, and gaps to training plans.

Step-by-Step Internal Audit Process for Clause 7.2

Use these steps as a “dress rehearsal” for your ISO 27001 certification audit:

1. Verify Competency Requirements: Review job descriptions and competency frameworks.
2. Assess Competence Levels: Ensure skills are defined (e.g., novice, proficient, expert).
3. Evaluate Assessment Methods: Review manager evaluations, self-assessments, or skills tests.
4. Examine Training Plans: Ensure plans align with security objectives.
5. Assess Training Effectiveness: Review post-training quizzes and performance data.
6. Evaluate Competence Maintenance: Check records for certification renewals and continuous learning.
7. Examine Competence Records: Inspect HR databases for accuracy and completeness.
8. Assess the Competence Review Process: Ensure requirements evolve alongside new threats.
9. Evaluate Training Resources: Confirm budget and leadership commitment.
10. Assess the Learning Culture: Check if the organisation rewards skills development.

The Competency Matrix: Your Single Source of Truth

The ISO 27001 competency matrix is the most effective tool for demonstrating compliance. Typically a spreadsheet, it should include:

• All personnel with defined ISMS roles.
• Required info-sec qualifications (e.g., CISSP, CISM, or ISO 27001 Lead Auditor).
• Competence in business technologies critical to the ISMS.
• A visual key representing status (e.g., Trained, Gap, or Training Planned).

Note: This should include external consultants. Their contracts and resumes are valid evidence of competence.

Top 3 Mistakes in Clause 7.2 and How to Fix Them

• Mistake 1: No ISO 27001 Experience. You cannot run an ISMS without understanding the standard.
  
  
  The Fix: Send staff to accredited training or hire an external ISO 27001 consultant.
• Mistake 2: Roles Not Documented. Informal assignments lead to audit failure.
  
  
  The Fix: Create a formal Accountability Matrix mapping every clause and control to a named individual.
• Mistake 3: No Training Plans. Auditors look for proactive management.
  
  
  The Fix: Document a 12-month training plan that explicitly addresses gaps in your competency matrix.

Frequently Asked Questions (FAQ)

What is the difference between “Competence” (7.2) and “Awareness” (7.3)?

Competence is role-specific (skills to do a job), while Awareness is universal (everyone understanding the security policy).

Is a competency matrix mandatory?

While the name isn’t mandatory, the standard requires “documented information as evidence.” A matrix is the industry best practice.

Does experience count as competence?

Yes. ISO 27001 explicitly allows competence to be based on “appropriate education, training, or experience.”

Conclusion: Turning Competence into a Strategic Advantage

Meeting ISO 27001 Clause 7.2 requirements builds a foundation of human capability. By using a competency matrix and a structured audit process, you protect your organisation’s most critical assets through a skilled and resilient team.