Auditor Competence and Evaluation

There are three different aspects of auditor competence that are identified in the ISO 19011 standard for management system auditing – personal behavior, technical competence, and auditing competence.

Auditors are required to have the relevant characteristics, knowledge, and abilities in each of these three domains. The key step to determining auditor competence is to determine which traits, knowledge, and abilities are required for each individual auditor for them to accomplish the goals that have been set for the audit and the audit program.

The required competency of an audit team can be determined based on a few factors, including the nature of the organization being audited, the nature and level of complexity of the audit that will be performed, the composition of the audit team, and any specific requirements that have been imposed by stakeholders.

It is not necessary for every auditor to possess the same level of expertise to...

Personal conduct

Clause 4 of ISO 19011 (https://www.iso.org/) describes the principles of auditing (explained in Chapter 8). Auditors are expected to exhibit attributes that enable them to abide by these principles. The individual behavior of an auditor should be professional during the conduct of an audit. ISO 19011 lists certain desired attributes for auditors, such as the following:

• Ethical: Auditors must base their findings on objective evidence and not falsify them for vested interests. Their reports should be truthful, have a defined objective, and be unbiased. Special care should be taken to refrain from unprofessional behavior, such as gossip or the disclosure of confidential information.
• Open-minded: Auditors must not let their own biases get in the way of assessing a process implementation by the auditee. Ultimately, the checks should be performed on whether the requirements are met or not and how effective they are in achieving the objectives set by an organization...

Knowledge and skills

There are two types of intellectual skills that help auditors:

• Generic capability and sector-specific skills
• Competence in conducting audits

Let us see each in detail.

Generic knowledge and skills

The generic knowledge and skills of management system auditors are constituted by the following:

• Knowledge of audit principles, processes, and methods: This helps auditors in the effective conduct of an audit. With such competency, the auditor can plan the audit effectively as well as stick to the plan. They will also be able to implement a risk-based approach to auditing, as the auditor is aware of such approaches. The auditor will be able to plan and prioritize tasks efficiently to achieve the objectives. Communication as an important tool would be well understood by the auditor, and this would reflect in the audit interview process, enabling a more successful gathering of information and evidence. They will also verify the relevance...

Auditor evaluation

The evaluation of auditors is an essential part of the ISO 19011 standard and one of its most important components. The evaluation of auditors is done with the intention of ensuring that those conducting audits have the requisite level of expertise, knowledge, and experience to carry out successful audits.

The evaluation of auditors can be carried out in several different ways, including self-assessment, a review by peers, and an evaluation by a higher level of management. The assessment must take into account not just the auditor’s level of technical expertise but also their capacity to carry out the audit procedure in a manner that is compliant with the ISO 19011 standard. The standard also recommends that organizations establish a process for the selection and appointment of auditors and that they regularly review the performance of auditors to ensure that they continue to meet the necessary qualifications and requirements. This recommendation relates...

Maintaining and improving auditor competence

Auditors build, maintain, and improve their level of competence through consistent participation in audits, as well as regular professional development activities. Competence should be something that auditors and leaders of audit teams consistently work to improve. Auditors should keep their auditing competence up to date by actively participating in management system audits regularly and engaging in ongoing professional development. This might be accomplished by the acquisition of further job experience, training, self-study, mentoring, attendance at meetings, seminars, and conferences, or participation in any number of other pertinent activities.

The audit program manager is responsible for aiding the continual evaluation of the auditor’s performance in the audit team. Different types of training should be provided to upskill auditors as well as audit team leaders, based on the latest developments in auditing processes and technology...

Summary

As you can see, a variety of skills should be taken into consideration to have the right individual to carry out efficient audits of your organization’s information security management system (ISMS). Some of these skills are required while others are only desired. Even though it is conceivable for a person who lacks sufficient competence to conduct an audit of parts of ISMS, a professional auditor or audit team is your best bet to move your company closer to its goal of incorporating audits into its ongoing cycle of continuous improvement.

In the next chapter, we will see case studies based on audit planning, reporting NCs, and drafting the final audit report.