The standard sets two conditions: the auditor must be competent (Clause 7.2), and the audit must be objective and impartial (Clause 9.2).
Impartial means the auditor does not check their own work. The ISMS manager cannot audit the ISMS they run, and the IT lead cannot audit the access controls they configured. Competent means they understand ISO 27001 and know how to audit: sampling, interviewing, tracing a control from policy to record.
In a small company the two conditions often pull in opposite directions. The people who know the ISMS well usually helped build it, and the people who did not build it rarely know the standard. Some typical cases:
- The compliance manager of a 30-person company wants to audit the ISMS she runs. Not possible.
- The CEO of an eight-person startup wants to do the audit. The CEO approved the policies and risk decisions, so they can own the audit programme, while someone else performs the audit.
- A finance colleague who completed an internal auditor course audits the IT controls. Possible, because finance had no part in them and the course shows competence.
- Engineering audits HR and HR audits engineering. This works if both auditors are trained.
Many companies under 50 people end up with an external auditor, because finding someone both trained and uninvolved takes more effort than it saves.