An auditor is a person who has the competency to conduct an audit. In the context of ISO 27001, an auditor is trained to systematically and independently evaluate an organisation’s Information Security Management System (ISMS) against the requirements of the standard. An auditor’s role is not to offer advice but to objectively collect evidence and report on the effectiveness of the ISMS.
Types & Roles
- Internal Auditor: A member of the organisation who has been trained to perform an audit. They help the organisation identify non-conformities and opportunities for improvement.
- External Auditor: An auditor from an accredited third-party certification body. Their independent assessment is required for an organisation to achieve and maintain its ISO 27001 certification.
Key Responsibilities
- Planning the Audit: Defining the scope, criteria, and objectives of the audit.
- Collecting Evidence: Gathering information through interviews, document reviews, and observations.
- Evaluating Findings: Objectively assessing the evidence against the ISO 27001 standard’s requirements.
- Reporting: Documenting the audit findings, including any non-conformities, to the organisation’s management.
ISO 27001 Context
The role of an auditor is vital for the Check phase of the Plan-Do-Check-Act (PDCA) cycle. The auditor’s findings provide the organisation with the necessary information to correct deficiencies and continually improve its information security posture.
