2

In one company, due to GDPR, a DPO was designated, who was later given additional role and a new task: to conduct an internal audit of information security according to ISO 27001. Is there a conflict of interest here or not? Is this combination of functions (DPO and internal auditor) correct? Will at some point such an auditor not audit his own work as a DPO?

3

It's not necessarily a conflict, since both roles will be aiming for compliance and they're not inherently adversarial. The best outcome for the company would be that non-conformities and observations were raised on audit, and these were addressed in a satisfactory way.

[External auditors prefer to see evidence of issues being addressed than a clean bill of health.]

I don't have access to a copy of ISO 27001, but there was a change in ISO 9001 at 2015. Previously this had said "Auditors shall not audit their own work", but it was generally recognised that this was impossible for smaller companies and sole traders. It now says that the organization shall "select auditors and conduct audits to ensure objectivity and the impartiality of the audit process". That sentence was there before, but the sentence that followed it has been removed.

If the latest ISO 27001 has the earlier wording this could constitute a technical non-conformity, but external auditors were aware that this would sometimes be impractical.

  • "External auditors prefer to see evidence of issues being addressed than a clean bill of health" - This If they don't, it means that the internal audits were just box-ticking. – Martin Bonner Feb 11 at 14:56

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.