ISO 27001 does not require a named qualification. Clause 7.2 asks you to define the competence a role needs, make sure the person has it and keep evidence of it. For the internal auditor, that evidence is what the certification auditor will ask to see.
Accepted evidence usually looks like this:
- For an employee: a certificate from an ISO 27001 internal auditor course, typically two to three days, or a lead auditor course, typically five days. Some audit experience helps, such as having shadowed an audit before.
- For an external auditor: their lead auditor certificate and a record of the audits they have performed, ideally including audits for certification bodies.
The training also shows in the result. A trained auditor knows how to grade findings as major, minor or observation, how to tie each finding to a specific requirement, and how to write a report in the form certification auditors expect. A report from someone untrained often lists opinions with no requirement attached, and the certification auditor then has to ask follow-up questions.
Keep the evidence in the ISMS records, next to the audit report, so it can be shown at Stage 1 without searching.