Leading Audit Teams and Maintaining Auditor Competence
This domain tests the lead auditor's responsibility for team competence, independence, ethical conduct and continuing development.
Building and leading the team
Derive competence needs from the audit scope: application architecture, cloud and container platforms, CI/CD pipelines, cryptography, sector regulation and audit method. Select auditors and technical experts against those needs and document the rationale. Preserve independence: nobody audits their own work. Technical experts provide evidence and interpretation; auditors reach conclusions. Brief the team on criteria, sampling, evidence standards and escalation, and review evidence collectively before findings are issued.
Maintaining competence
Competence is more than a certificate. It combines education, training, audit experience and current technical knowledge. Maintain records: a competence matrix, audit logs, continuing professional development and calibration exercises. After each audit, collect feedback and review performance; use shadow audits for less experienced team members.
Worked example
A team is assigned a containerized payment application. The lead auditor knows 27034 and audit method but has limited Kubernetes experience. The lead adds a container technical expert, confirms the expert did not build the configuration under review, and assigns the expert to interpret evidence only. The lead auditor writes the finding and documents why the expert was needed. Reasoning: the competence gap is covered without compromising independence or auditor accountability.
Traps
- Equating certification with demonstrated competence.
- Using a technical expert to audit work they performed.
- Failing to document why team members were selected.
- Letting the lead auditor do all technical testing outside their competence.
- Ignoring conflicts of interest or client pressure on findings.