An auditor is a person who has the competency to conduct an audit. In the context of ISO 27001, an auditor is trained to systematically and independently evaluate an organisation’s Information Security Management System (ISMS) against the requirements of the standard. An auditor’s role is not to offer advice but to objectively collect evidence and report on the effectiveness of the ISMS.
Types & Roles
- Internal Auditor: A member of the organisation who has been trained to perform an audit. They help the organisation identify non-conformities and opportunities for improvement.
- External Auditor: An auditor from an accredited third-party certification body. Their independent assessment is required for an organisation to achieve and maintain its ISO 27001 certification.
Key Responsibilities
- Planning the Audit: Defining the scope, criteria, and objectives of the audit.
- Collecting Evidence: Gathering information through interviews, document reviews, and observations.
- Evaluating Findings: Objectively assessing the evidence against the ISO 27001 standard’s requirements.
- Reporting: Documenting the audit findings, including any non-conformities, to the organisation’s management.
ISO 27001 Context
The role of an auditor is vital for the Check phase of the Plan-Do-Check-Act (PDCA) cycle. The auditor’s findings provide the organisation with the necessary information to correct deficiencies and continually improve its information security posture.
Further Reading
In this guide I show you step-by-step How to do ISO 27001 Internal Audit [+ Templates]
Stuart Barker
Stuart Barker is a qualified ISO 27001 Lead Auditor and veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigour with extensive operational experience, including a decade leading Data Governance for General Electric (GE).
He is the founder of High Table and the Lead Consultant driving the world’s number 1 dedicated ISO 27001 Consultancy.
