Auditor is a competent professional responsible for systematically and independently evaluating an organisation’s Information Security Management System. The Primary Implementation Requirement involves conducting objective evidence-based assessments against standards, providing the Business Benefit of identifying technical vulnerabilities while ensuring sustained compliance and continuous improvement.
What is an auditor?
An auditor is a person who has the competency to conduct an audit. In the context of ISO 27001, an auditor is trained to systematically and independently evaluate an organisation’s Information Security Management System (ISMS) against the requirements of the standard. An auditor’s role is not to offer advice but to objectively collect evidence and report on the effectiveness of the ISMS.
Types & Roles
- Internal Auditor: A member of the organisation who has been trained to perform an audit. They help the organisation identify non-conformities and opportunities for improvement.
- External Auditor: An auditor from an accredited third-party certification body. Their independent assessment is required for an organisation to achieve and maintain its ISO 27001 certification.
Key Responsibilities
- Planning the Audit: Defining the scope, criteria, and objectives of the audit.
- Collecting Evidence: Gathering information through interviews, document reviews, and observations.
- Evaluating Findings: Objectively assessing the evidence against the ISO 27001 standard’s requirements.
- Reporting: Documenting the audit findings, including any non-conformities, to the organisation’s management.
ISO 27001 Context
The role of an auditor is vital for the Check phase of the Plan-Do-Check-Act (PDCA) cycle. The auditor’s findings provide the organisation with the necessary information to correct deficiencies and continually improve its information security posture.
How to implement Auditor
Implementing a rigorous ISO 27001 auditor process is the primary mechanism for verifying that your Information Security Management System (ISMS) is functioning as intended. By following these ten structured steps, you will establish a professional audit capability that identifies technical gaps, satisfies the requirements of Clause 9.2, and ensures your organisation is prepared for accredited certification body assessments.
1. Formalise Auditor Competency Requirements
Define the mandatory skills and qualifications required for individuals performing the audit to ensure credible results. This result provides the organisation with a qualified baseline for selecting internal or external personnel.
- Identify the need for IRCA-accredited Lead Auditor training: result: verified expert status.
- Document required industry-specific knowledge relevant to the organisational scope.
- Establish a requirement for regular Continuous Professional Development (CPD) to track evolving cyber threats.
2. Establish Independence and Impartiality
Verify that the selected auditor is independent of the processes being audited to prevent conflicts of interest. This result ensures that audit findings are objective and will be respected by external certification bodies.
- Rotate internal auditors across different departments to maintain fresh perspectives.
- Ensure the auditor does not assess their own work or management systems.
- Obtain a signed impartiality declaration for every audit cycle.
3. Provision Read-Only IAM Roles
Grant the auditor specific Identity and Access Management (IAM) roles that allow for evidence collection without risking unauthorised changes. This result protects the integrity of the technical estate during the assessment.
- Configure “Read-Only” permissions for cloud consoles, servers, and databases.
- Mandate Multi-Factor Authentication (MFA) for all auditor accounts.
- Set automated expiry dates for temporary auditor access to prevent long-term security risks.
4. Map Scope to the Asset Register
Provide the auditor with the centralised Asset Register to ensure 100% visibility of the technical environment. This result allows the auditor to verify that no critical data sets or hardware components have been omitted from the ISMS.
- Identify all Information Asset Owners (IAOs) associated with scoped assets.
- Verify that hardware, software, and cloud services are correctly classified.
- Cross-reference the register with network discovery scans to identify “Shadow IT.”
5. Draft the Audit Rules of Engagement (ROE)
Document the formal protocol for the audit, including the schedule, technical boundaries, and communication paths. This result prevents operational disruption and establishes a professional framework for the fieldwork.
- Define the “No-Go” zones for technical testing during peak business hours.
- Identify the primary technical contacts for evidence requests and interview scheduling.
- Specify the method for reporting “Critical” vulnerabilities discovered mid-audit.
6. Execute Systematic Fieldwork
Conduct technical reviews and staff interviews to gather objective evidence of control effectiveness. This result provides the data-driven foundation for the final audit findings.
- Review configuration settings against best practices: result: technical assurance.
- Interview staff to verify that organisational policies are followed in practice.
- Observe physical security controls including clean desk policies and data centre access.
7. Analyse and Categorise Non-Conformities
Evaluate the gathered evidence against the ISO 27001:2022 standard to identify gaps. This result ensures that findings are prioritised based on the risk they pose to the business.
- Identify “Major Non-Conformities”: total failure of a mandatory requirement.
- Identify “Minor Non-Conformities”: partial failures or process lapses.
- Document “Opportunities for Improvement” (OFI) to drive continual improvement.
8. Produce the Formal Audit Report
Synthesise all findings into a professional document for senior management review. This result serves as the official record of compliance and the roadmap for remediation.
- Include an executive summary defining the overall health of the ISMS.
- List every finding with a direct reference to the corresponding ISO 27001 control.
- Provide objective evidence for every non-conformity to facilitate management understanding.
9. Audit the Remediation Actions
Verify that the Information Asset Owners have implemented effective corrective actions to close identified gaps. This result ensures that risk treatment plans are actually executed rather than just documented.
- Perform follow-up testing on high-risk technical gaps.
- Require digital signatures from IAOs confirming that the remediation is sustainable.
- Update the Risk Register to reflect the reduced threat levels after gap closure.
10. Monitor for Continuous Audit Readiness
Audit the organisation’s ongoing compliance through quarterly “spot checks” to maintain an audit-ready state. This result prevents the common “audit panic” and ensures security remains a daily operational priority.
- Schedule mini-audits focused on specific Annex A controls.
- Report monthly compliance metrics to the management board.
- Verify that new technical implementations are added to the audit programme immediately.
Auditor FAQ
What is an ISO 27001 auditor?
An ISO 27001 auditor is a trained professional responsible for evaluating an organisation’s Information Security Management System (ISMS) to ensure it meets the mandatory requirements of the standard. Auditors verify that 100% of applicable technical controls and policies are implemented effectively to mitigate security risks and protect information assets.
What qualifications does an ISO 27001 auditor need?
Professional auditors typically hold a Lead Auditor certification from an IRCA-accredited training provider, requiring a minimum of 40 hours of formal training and a successful examination. To maintain their status, auditors must demonstrate continuous professional development and have conducted at least 20 days of audits within a three-year cycle.
What is the difference between internal and external auditors?
The primary difference is independence: internal auditors are often employees or consultants who perform self-assessments (Clause 9.2) to identify gaps, while external auditors work for accredited Certification Bodies to grant the formal certificate. Research indicates that 95% of organisations that pass their certification audit first conducted a rigorous independent internal audit.
How much does a professional ISO 27001 auditor cost?
In the United Kingdom, engaging a professional ISO 27001 auditor typically costs between £800 and £1,500 per day. For a full Stage 2 certification assessment, a small organisation can expect to pay between £5,000 and £12,000, depending on the industry sector and the number of employees within the audit scope.
What are the key responsibilities of an auditor during an assessment?
The auditor’s responsibilities include reviewing technical documentation, interviewing staff, and observing operational practices to gather objective evidence of compliance. They are specifically tasked with identifying “Non-Conformities,” where a major non-conformity results in a 0% recommendation for certification until the security gap is fully remediated and verified.
I’ve sat in the Auditor’s chair for 20 years. These are the exact tools I use to guarantee a pass.
About the author
