Auditing ISO 27001 Clause 7: Competence, Awareness and Documented Information
Clause 7 is audited by leaving the room where the documents are kept. Competence is tested against the roles the risk assessment says matter, awareness is tested by asking someone at a desk rather than reading a training record, and document control is tested by asking the person doing the work which version they are using.
Clause 7 is audited by leaving the room where the documents are kept. Competence is tested against the roles the risk assessment says matter, awareness is tested by asking someone at a desk rather than reading a training record, and document control is tested by asking the person doing the work which version they are using.
The clause reference sets out what 7.1 to 7.5.3 require. This page is about where the evidence is, and Clause 7 is unusual in that the evidence is almost never where the organisation offers it.
The worked findings on this page are invented, and so are the organisations in them. They are written to show how a finding is built and graded, not to catalogue the findings you should expect.
ISO 27001 Clause 7.1 Resources: short clause, useful question
Determine and provide the resources the ISMS needs. That is all it says, and on its own it is hard to audit — an organisation that is under-resourced rarely says so.
The productive approach is to look for resource requests that were made and not met. Management review records, risk treatment plans with items overdue for want of people, an internal audit programme that slipped because nobody was available. Each is evidence at 7.1, and each is also evidence about leadership commitment at 5.1.
ISO 27001 Clause 7.2 Competence: the mistake is auditing the wrong people
The clause asks for the competence necessary for people whose work affects information security performance, that they are competent on education, training or experience, that action is taken where a gap exists and its effectiveness evaluated, and that documented information is retained as evidence of competence.
Most auditors ask the security team for training records. Two better moves.
Start from the risk assessment. Which roles do the highest risks depend on? A risk treated by privileged access management depends on whoever administers it. That is a person whose work affects information security performance, and they may not sit in the security team at all.
Ask what competence was determined to be necessary, before asking what training happened. An organisation with training records and no statement of required competence has done the second half of the requirement without the first, and cannot say whether the training was the right training.
Note the internal audit connection, and keep the citations apart. Auditor competence is a Clause 7.2 matter, because an internal auditor’s work affects information security performance. Clause 9.2.2 requires auditors to be selected and audits conducted so as to ensure objectivity and the impartiality of the audit process — a different requirement. An internal auditor with no evidence of competence is 7.2; one auditing their own work is 9.2.2.
Looking for an approved provider?3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP 6039853.
ISO 27001 Clause 7.3 Awareness is not training, and the standard is precise about it
The requirement is that people doing work under the organisation’s control are aware of three things: the information security policy, their contribution to the effectiveness of the ISMS, and the implications of not conforming.
An attendance record shows someone was present. It does not show awareness, and the standard does not ask for a record. The test is to ask a person. Pick someone who is not in the security function — a warehouse supervisor, a finance clerk, a developer — and ask what the information security policy is for and what would happen if they did not follow it. You are not examining them; you are establishing whether the awareness activity reached anyone.
Do not confuse this with A.6.3. Annex A control A.6.3 is information security awareness, education and training — training is expressly in scope of the control. Clause 7.3 is about awareness alone. A finding that security training is not delivered belongs to A.6.3. A finding that people are unaware of the policy belongs to 7.3.
ISO 27001 Clause 7.4 Communication: the clause nobody audits
Determine what needs communicating internally and externally about the ISMS: on what, when, with whom, and how. It is four questions and takes five minutes.
The one that finds things is external. Ask how a security incident affecting a customer would be communicated, and to whom. An organisation whose answer is improvised has not determined its external communication, and the gap connects to the incident controls and often to a contractual requirement identified at Clause 4.2. Asking who would do the communicating is a fair question and good practice — but the previous edition required it and the current one does not, so it is not a requirement to cite.
ISO 27001 Clause 7.5 Documented information: where the findings are
Three sub-clauses, and 7.5.3 is where a first audit most often finds something in Clause 7.
7.5.1 requires the documented information the standard demands, plus whatever the organisation determines is necessary for the ISMS to be effective. That second half is the one with consequences: an organisation’s own documented procedures become part of what it must conform to.
7.5.2 covers creating and updating — identification and description, format and media, and review and approval for suitability and adequacy.
7.5.3 covers control: available and suitable for use where and when needed; adequately protected; with distribution, access, retrieval and use, storage and preservation, change control including version control, and retention and disposition all addressed. And documented information of external origin determined necessary must be identified and controlled.
Preparing for the PR373 exam?Full-length mock exams and exam application support are included.
The ISO 27001 document control test that works
Not asking the document owner for the current version. Asking the person doing the work to show you the version they use.
Do it at a desk, on their screen or in their folder, and compare what you find to the approved register afterwards. What you are testing is whether the controlled copy is the one actually in use, and the failure modes are more varied than people expect: a procedure held in three places with nothing indicating which is authoritative; a laminated card at a workstation with no version marking at all; a controlled and current document that is not available at the point where the work is done; a record whose retention period has expired with no disposition recorded. None of these is visible from the document management system, and all are obvious from the desk.
Two more tests worth the time. Ask for a document you would expect to be controlled but that nobody thinks of as a document: a spreadsheet the security team maintains, a runbook, a supplier list. And ask about external documents — the standard itself, a regulator’s guidance, a customer’s security schedule. External origin documented information determined necessary must be identified and controlled, and it almost never is.
A worked ISO 27001 finding on Clause 7.5.3
Elmwood Diagnostics runs a document management system with approvals and version control for its own documents. Its ISMS also depends on documents it did not write.
| Statement | Documented information of external origin determined by the organisation to be necessary for the ISMS is not identified and controlled. |
|---|---|
| Objective evidence | The ISMS manual states that the organisation’s controls are implemented in accordance with a named external code of practice, and that a named regulator’s security guidance applies to its processing. Neither document appears in the document register. The copy of the regulator’s guidance held on the security team’s shared drive was two issues behind the version published at the time of the audit, and the security manager confirmed that no arrangement exists for identifying when either document is revised. Internally originated documented information sampled was under control. |
| Requirement | ISO/IEC 27001 Clause 7.5.3 requires documented information of external origin determined by the organisation to be necessary for the planning and operation of the ISMS to be identified as appropriate and controlled. |
| Grade | Minor — the document control process operates as required for internally originated documented information, which is the substantial majority of the ISMS’s documented information; the failure is confined to two identified external documents. |
Two things about that finding are worth copying. It quotes the organisation’s own statement that the external documents are necessary, which is what makes 7.5.3 engage at all — the requirement bites on what the organisation determined, not on what an auditor thinks it needs. And it records what conformed, which narrows the finding to what the evidence supports.
Want structured preparation?One year of LMS access and HD recordings come with the course.
A worked ISO 27001 finding on Clause 7.2
Redgate Utilities uses a managed service partner for network operations. Fourteen of the partner’s engineers work under Redgate’s direction on in-scope systems.
| Statement | Documented information has not been retained as evidence of competence for three individuals whose work affects information security performance. |
|---|---|
| Objective evidence | The role profile for network operations (ROL-07) states the competence required. Competence records were produced for eleven of the fourteen managed service engineers working on in-scope systems, and for the nine permanent staff sampled in equivalent roles. No evidence of education, training or experience was held for engineers ENG-114, ENG-118 or ENG-121. The contract manager was unable to account for the three omissions and confirmed that the verification step applies to all engineers. |
| Requirement | ISO/IEC 27001 Clause 7.2 d) requires the organisation to retain appropriate documented information as evidence of competence for persons doing work under its control that affects its information security performance. |
| Grade | Minor — the necessary competence has been determined and the process operates for the great majority of the same population; the failure is confined to three identified individuals and does not show the requirement is unperformed. |
Statement, objective evidence, requirement: miss one and the finding is not defensible. The Clause 6 page sets out what examination items do with a nonconformity that is missing a part.
Major or minor on ISO 27001 Clause 7
Grade from the evidence and its reach, never from how serious it feels. A major is a significant or systemic failure — a requirement absent, a process that is not operating, a breakdown that raises doubt the ISMS can achieve its intended results. A minor is an isolated or occasional lapse that does not by itself break the system. Several related minors can together show a systemic problem and become a major.
Major territory: no document control at all; no competence requirements determined for any role; documented information required by the standard simply absent.
Minor territory: competence evidence missing for a defined group; one gap in awareness; external documents identified but not kept current.
Escalation: the same control failing in several functions — competence records absent in three departments, say — is where related minors together show a systemic problem and the grade moves.
And keep the opportunity for improvement in its place. It is advice the organisation may take or leave, and it must never be used to avoid raising a genuine nonconformity.
Where ISO 27001 Clause 7 connects
| Connection | What it gives you |
|---|---|
| Clause 5.1 | Resources requested and not provided is evidence about commitment as well as about 7.1 |
| Clause 9.2 | Internal auditor competence, and whether the programme slipped for want of people |
| A.6.3 | Awareness, education and training as a control — distinct from Clause 7.3 |
| A.5.37 | Documented operating procedures, which is where an operational procedure’s existence belongs; its control is 7.5.3 |
| A.5.31 and A.5.33 | Legal and regulatory requirements, and protection of records — both lean on document control |
Frequently asked questions about auditing ISO 27001 Clause 7
What is the difference between competence and awareness in ISO 27001?
Competence is the ability to do a job, evidenced by education, training or experience and recorded. Awareness is knowing the policy, your contribution to the ISMS and the implications of not conforming. Clause 7.2 requires records; Clause 7.3 does not.
How do you audit awareness under ISO 27001?
By asking someone outside the security function what the policy is for and what happens if they do not follow it. A training attendance record shows attendance, not awareness.
Is a training record enough for ISO 27001 Clause 7.2?
Not on its own. The clause also requires the necessary competence to have been determined, and action taken and evaluated where a gap exists. Records with no statement of required competence answer half the requirement.
Which ISO 27001 clause covers document version control?
7.5.3, which covers control of changes including version control, along with availability, protection, distribution, retrieval, storage and retention.
Do external documents have to be controlled under ISO 27001?
Documented information of external origin that the organisation determines is necessary for the ISMS must be identified and controlled. Standards, regulatory guidance and customer security schedules commonly qualify and commonly are not.
Where to go next: more ISO 27001 Lead Auditor exam preparation
Clause 6.3 planning of changes, the clause people miss
3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.
Booking a PR373 course? See the schedule, trainers and what’s included.
Leave a reply