Which audit activity related to ISO/IEC 27001 may be carried out by a practitioner?

An ISO/IEC 27001 practitioner is an individual within an organization who is competent in the standard's requirements. According to Clause 9.2 of ISO/IEC 27001, the organization must conduct internal audits at planned intervals. These first-party audits are a fundamental activity for verifying the effectiveness and conformity of the Information Security Management System (ISMS). A qualified internal practitioner is the appropriate person to perform this function, ensuring they remain objective and impartial by not auditing their own direct responsibilities. The other options describe third-party audits that require specific accreditation and external authority, which are outside the practitioner's scope.

A. Surveillance audits are conducted by external Certification Bodies, not internal staff. Auditing one's own area also violates the core audit principle of impartiality.

C. Audits of Accredited Training Organizations are performed by the body that provides their accreditation (e.g., APMG), not by an unrelated practitioner.

D. Audits of Certification Bodies are conducted by a national Accreditation Body (e.g., UKAS, ANAB) to verify the CB's competence and independence.

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Clause 9.2, "Internal audit": This clause mandates that "The organization shall conduct internal audits at planned intervals..." and requires the selection of auditors to "ensure objectivity and the impartiality of the audit process." This directly supports the role of an internal practitioner in conducting internal audits.

2. ISO/IEC 19011:2018 - Guidelines for auditing management systems.

Clause 3.1, Note 3: This clause distinguishes between audit types. Internal audits (first-party audits) are conducted by the organization itself. This is the domain of the practitioner. Surveillance, certification, and accreditation audits are types of external (third-party) audits.

3. Humphreys, E. (2020). ISO/IEC 27001:2022 - A Pocket Guide. IT Governance Publishing.

Chapter 9, "Performance evaluation": This guide, often used in academic and professional training, explains that the internal audit programme (Clause 9.2) is a key internal process managed by the organization to prepare for external certification and ensure ongoing compliance. It is a function performed by competent internal resources.