Personal Attributes and Behaviors of a Professional Auditor (ISO/IEC 27001 Lead Auditor)
Introduction
In the ISO/IEC 27001 Lead Auditor curriculum, the topic Personal Attributes and Behaviors of a Professional Auditor sits within the domain of Managing an ISO/IEC 27001 Audit Program. It is based mainly on ISO 19011:2018, Clause 7.2.2 (Personal behaviour). ISO/IEC 17021-1 and ISO/IEC 27006 support it for certification bodies. Technical knowledge of information security controls is essential, but it is not enough. An auditor's credibility, objectivity and effectiveness depend just as much on how they behave, think and interact with people. This guide explains what the topic is, why it matters, how it works in practice, and how to answer exam questions on it.
1. Why It Is Important
Audit credibility: Certification decisions, regulatory reliance and management decisions all depend on audit conclusions. If an auditor behaves unethically, shows bias or lacks diplomacy, the conclusions lose their value.
Evidence quality: Auditees share information more openly with auditors who are courteous, respectful and trustworthy. Better cooperation means better evidence.
Protecting the audit program: The person managing the audit program must select auditors who are competent. Under ISO 19011, competence means both knowledge/skills and personal behaviour.
Handling conflict and pressure: Audits often involve resistance, sensitive findings, time pressure and attempts to influence results. Personal attributes decide whether the auditor stays objective and professional.
Confidentiality of sensitive information: ISMS audits expose auditors to highly sensitive data, such as risk assessments, vulnerabilities and incident records. Integrity and discretion are therefore critical.
Reputation of the certification body and the profession: Unprofessional conduct damages trust in the whole certification scheme.
2. What It Is: The Principles and Attributes
2.1 The Principles of Auditing (ISO 19011 Clause 4)
Personal behaviour supports the seven principles of auditing:
1. Integrity: the foundation of professionalism (honesty, diligence, responsibility, impartiality, sensitivity to influences).
2. Fair presentation: the obligation to report truthfully and accurately.
3. Due professional care: diligence and judgement in auditing.
4. Confidentiality: security of information.
5. Independence: the basis for impartiality and objective conclusions.
6. Evidence-based approach: the rational method for reaching reliable and reproducible conclusions.
7. Risk-based approach: an approach that considers risks and opportunities.
2.2 Personal Behaviours Listed in ISO 19011 Clause 7.2.2
Auditors should possess the attributes needed to act according to the principles of auditing. An auditor should be:
• Ethical: fair, truthful, sincere, honest and discreet.
• Open-minded: willing to consider alternative ideas or points of view.
• Diplomatic: tactful in dealing with individuals.
• Observant: actively watching physical surroundings and activities.
• Perceptive: aware of and able to understand situations.
• Versatile: able to adjust readily to different situations.
• Tenacious: persistent and focused on achieving objectives.
• Decisive: able to reach timely conclusions based on logical reasoning and analysis.
• Self-reliant: able to act and function independently while interacting effectively with others.
• Acting with fortitude: able to act responsibly and ethically, even though these actions may not always be popular and may sometimes result in disagreement or confrontation.
• Open to improvement: willing to learn from situations.
• Culturally sensitive: observant and respectful of the auditee's culture.
• Collaborative: interacting effectively with others, including audit team members and the auditee's personnel.
2.3 Behaviours to Avoid
Exams often test what a professional auditor should NOT do:
• Offering consultancy or solutions for nonconformities (this threatens independence).
• Accepting gifts, hospitality or favours that could influence judgement.
• Arguing aggressively, humiliating auditees or being condescending.
• Jumping to conclusions without sufficient evidence.
• Sharing auditee information with unauthorized parties.
• Auditing their own work or an area where they have a conflict of interest.
• Letting personal opinions, preferences or prior relationships affect findings.
• Allowing the auditee to pressure them into downgrading or removing findings.
• Making promises about certification outcomes.
3. How It Works in Practice
3.1 Selection and Evaluation of Auditors (Audit Program Management)
The audit program manager evaluates auditors against defined competence criteria, including personal behaviour (ISO 19011 Clauses 7.1 to 7.6). Evaluation methods include:
• Review of records (education, training, employment, audit experience).
• Feedback (surveys, references, testimonials, complaints, performance ratings).
• Interviews.
• Observation (role playing, witnessed audits, on-the-job performance).
• Testing (oral and written exams, psychometric testing).
• Post-audit review (audit reports, feedback from the audit team leader and auditees).
Personal behaviour is best evaluated through observation and feedback, because written tests cannot easily measure it.
3.2 During the Opening Meeting
A professional auditor:
• Introduces the team courteously.
• Confirms confidentiality commitments.
• Explains the audit plan and methods.
• Sets a respectful, collaborative tone.
3.3 During Evidence Collection
• Uses open questions and listens actively (perceptive, observant).
• Stays calm when the auditee becomes defensive (diplomatic, fortitude).
• Follows audit trails until evidence is sufficient (tenacious).
• Considers explanations before concluding (open-minded).
• Respects working hours, local customs and safety rules (culturally sensitive).
• Adapts when scope or circumstances change (versatile).
3.4 During Findings and the Closing Meeting
• Presents nonconformities factually, backed by objective evidence (fair presentation, decisive).
• Holds firm on justified findings despite pressure (fortitude, integrity).
• Records diverging opinions and tries to resolve them. Unresolved divergences are recorded and may be referred to the audit program manager or certification body.
• Avoids offering consultancy, though the auditor may explain the requirement clearly.
3.5 After the Audit
• Protects audit documents and evidence according to confidentiality agreements.
• Reflects on lessons learned (open to improvement).
• Maintains competence through continual professional development.
3.6 Example Scenarios
Scenario A: The IT manager becomes angry during an interview and says the auditor does not understand the business.
Professional response: stay calm, acknowledge the concern, explain the purpose of the question, and continue to seek objective evidence. This shows diplomacy, fortitude and open-mindedness.
Scenario B: The top manager hints that a contract renewal depends on a clean report.
Professional response: politely decline any influence, report findings based on evidence, and inform the audit team leader or certification body if necessary. This shows integrity, ethics and independence.
Scenario C: An auditee asks the auditor how to fix a nonconformity.
Professional response: explain the requirement and the gap, but do not design the solution. This protects independence, especially for a third-party audit.
Scenario D: An auditor sees a door to a server room propped open while walking to a meeting.
Professional response: note the observation and verify it against access control requirements. This shows the auditor is observant.
Scenario E: An auditor discovers they audited the same organization's ISMS as a consultant last year.
Professional response: declare the conflict of interest to the audit program manager or certification body. ISO/IEC 17021-1 requires that consultancy not have been provided to the client by audit team members within the prior two years.
4. How to Answer Exam Questions on This Topic
Questions appear in several formats: multiple choice, scenario-based questions, and essay or case-study questions in some certification schemes.
Step 1: Identify the attribute or principle being tested. Look for keywords:
• "pressure", "unpopular", "confrontation" = fortitude
• "gift", "bribe", "honest" = ethical / integrity
• "alternative views", "explanation" = open-minded
• "tactful", "sensitive situation" = diplomatic
• "notices", "surroundings" = observant
• "understands situation", "reads body language" = perceptive
• "changes in schedule", "adapts" = versatile
• "persistent", "follows up" = tenacious
• "timely conclusion", "logical reasoning" = decisive
• "works independently" = self-reliant
• "local customs", "respect" = culturally sensitive
• "learns from experience" = open to improvement
• "teamwork" = collaborative
Step 2: Apply the auditing principles. Ask whether the action preserves integrity, fair presentation, due professional care, confidentiality, independence, and an evidence-based and risk-based approach.
Step 3: Eliminate unprofessional options. Remove answers involving consultancy, bias, aggressive behaviour, ignoring evidence, breaching confidentiality, or accepting influence.
Step 4: Choose the most balanced answer. The best answer usually combines firmness on evidence with respect for the auditee.
Step 5: For essay-type answers, use a structure.
(a) Name the attribute(s) involved.
(b) Define them using ISO 19011 wording.
(c) Explain why they matter in this situation.
(d) Describe the correct auditor action.
(e) Link the action to the audit principles and the audit outcome.
5. Exam Tips: Answering Questions on Personal Attributes and Behaviors of a Professional Auditor
• Memorize the ISO 19011 Clause 7.2.2 list. Ethical, open-minded, diplomatic, observant, perceptive, versatile, tenacious, decisive, self-reliant, acting with fortitude, open to improvement, culturally sensitive, collaborative. A mnemonic may help, for example: "Every Organized Detective Observes People; Versatile Teams Decide; Self-reliant Folks Improve Culture Cooperatively."
• Distinguish similar attributes:
- Observant means noticing physical things and activities. Perceptive means understanding situations and their meaning.
- Tenacious means persistence toward objectives. Fortitude means courage to act ethically when it is unpopular.
- Self-reliant means acting independently. Collaborative means working effectively with others. A good auditor balances both.
- Decisive means timely, logical conclusions, not hasty ones.
• Integrity is the foundation. When in doubt, the answer that preserves honesty and impartiality is usually correct.
• Never choose consultancy. In a certification audit, recommending specific solutions threatens impartiality. Auditors may identify opportunities for improvement, but must not prescribe solutions. Certification bodies under ISO/IEC 17021-1 are restricted from offering ISMS consultancy.
• Evidence beats opinion. Answers that base conclusions on verifiable evidence, not assumptions or hearsay, are preferred.
• Escalation is professional. If threats, conflicts of interest or serious obstacles arise, the correct action is often to inform the audit team leader, the audit program manager or the audit client. The auditor should not act alone in a way that compromises the audit.
• Calm and respectful behaviour wins. Options where the auditor argues, threatens or embarrasses the auditee are wrong.
• Confidentiality includes discretion. Discussing one client's findings with another client, or posting on social media, is a breach.
• Cultural sensitivity does not mean compromising requirements. Respect customs, but still evaluate conformity against the standard.
• Know how behaviour is evaluated. Observation, feedback and post-audit review are the most suitable methods. A written exam alone is weak for assessing behaviour.
• Watch for absolute words. Options with "always" or "never" can be traps. However, "never accept inducements" and "never audit your own work" are correct absolutes.
• Read the role in the scenario. Is the person the lead auditor, a team member, a technical expert or an observer? Technical experts and observers do not act as auditors, and responsibilities differ. For example, the team leader resolves disagreements within the team.
• Link behaviour to audit risk. Poor behaviour can produce unreliable conclusions, missed nonconformities or damaged relationships. Mentioning this in essay answers shows deeper understanding.
• Use the standard's vocabulary. Words like "objective evidence", "impartiality", "due professional care" and "fair presentation" signal mastery to examiners.
6. Quick Practice Questions
Q1: During an audit, the auditee strongly disagrees with a nonconformity, but the evidence is clear. The auditor maintains the finding politely. Which attribute is mainly demonstrated?
Answer: Acting with fortitude (supported by diplomacy and integrity).
Q2: An auditor notices that screens in an open office display confidential customer data visible to visitors. Which attribute is demonstrated?
Answer: Observant.
Q3: Which method is MOST appropriate to evaluate an auditor's personal behaviour?
Answer: Observation (for example, witnessed audits) combined with feedback.
Q4: The auditee offers the auditor an expensive dinner and tickets to an event. What should the auditor do?
Answer: Politely decline. Accepting would compromise integrity and independence. Report the offer if required by the certification body's policy.
Q5: The audit schedule changes suddenly because a key interviewee is unavailable. The auditor rearranges activities to still cover the scope. Which attribute is shown?
Answer: Versatile.
Conclusion
Personal attributes and behaviours turn technical knowledge into credible, reliable audit results. For the ISO/IEC 27001 Lead Auditor exam, know the ISO 19011 list of behaviours, understand how each one supports the audit principles, and recognize how they apply in realistic scenarios. In every question, choose the response that is ethical, evidence-based, impartial, confidential and respectful, and that keeps firmness on facts while showing courtesy toward people.
