How to Become a Freelance ISO 27001 Auditor in Canada

Freelance ISO 27001 auditors in Canada do one of two jobs. They work as contracted auditors for an accredited certification body, which issues the certificate, or they run internal audits under clause 9.2 for companies that want an independent auditor without hiring one. Both start with Lead Auditor training and real ISMS experience. Certification body work adds a competence evaluation and witnessed audits. Internal audit work mostly comes through consultancies and referrals.

Two kinds of ISO 27001 audit work

"ISO 27001 auditor" covers two jobs that run on different rules, and it is worth being clear which you want before you invest in getting there.

Certification audits

A certification audit is third-party work. An accredited certification body audits the organization's information security management system and decides whether to grant, maintain or withdraw the certificate. The certificate runs for three years, with surveillance audits in the years between and a recertification audit at the end. In Canada, the Standards Council of Canada accredits ISMS certification bodies against ISO/IEC 17021-1 and the ISO/IEC 27006 family, and bodies accredited elsewhere under the International Accreditation Forum arrangements also certify Canadian companies. If you want to issue certificates, you work for, or under contract to, one of these bodies. You cannot do it as an independent alone.

Internal audits

Clause 9.2 of ISO 27001 requires the organization to audit its own ISMS at planned intervals, with auditors chosen to ensure objectivity and impartiality. Small and mid-sized companies rarely have someone independent of the ISMS to do it, so they bring in an outside auditor. This is the larger and more open market for freelancers. You plan the audit programme, audit against the standard and the company's own requirements, report nonconformities and opportunities for improvement, and the certification body later reviews your work as evidence that clause 9.2 operated. Our guide to the ISO 27001 internal audit under clause 9.2 shows what a good one contains.

What you need before you start

Real ISMS experience

The best auditors have been on the other side of the table. If you have implemented an ISMS, run a risk assessment and treatment plan, written a Statement of Applicability or operated controls through a surveillance cycle, you know what good evidence looks like and where companies cut corners. Our Statement of Applicability example is a useful reference for the kind of document you will be testing.

Lead Auditor training and certification

ISO/IEC 27001 Lead Auditor training is the near-universal starting credential. It is offered by training providers under personnel certification schemes such as PECB and Exemplar Global. These schemes usually have tiers, from a provisional credential after the exam to auditor and lead auditor grades that need logged professional experience and audit hours. The exact requirements are in each scheme's current documentation, and they change, so read them before you pay for a course.

Audit skills

Auditing is a different skill from implementing. You need to sample, interview without leading, separate a nonconformity from an opinion, and write findings that cite the requirement, what you saw and why it falls short. ISO 19011, the guidance standard for auditing management systems, is the reference for how audits should be planned and run.

Becoming a contracted auditor for a certification body

Certification bodies have to show that every auditor they use is competent for the audits they do. In practice that means:

• Application and evaluation. The body reviews your training, ISMS work history and audit experience against its competence criteria.
• Witnessed audits. New auditors usually take part in audits under a qualified lead before leading their own. Expect to be observed.
• Technical areas. Bodies often approve auditors for particular sectors or technical areas, and your history decides which.
• Impartiality declarations. You will be asked to declare consulting work. You cannot audit an organization whose ISMS you helped build, and bodies check this before each assignment.
• Ongoing monitoring. Your audits are reviewed, and competence is re-evaluated over time.

Look on certification bodies' careers pages for "associate auditor", "contract auditor" or "freelance auditor" roles. Some recruit year-round. Others recruit when demand in a region outpaces their staff. Travel to client sites may be expected, though some audit stages are done remotely.

Building a freelance internal audit practice

Internal audit work reaches freelancers through three routes:

• Consultancies that help companies through certification and need an auditor who did not build the ISMS. This is the most common route.
• Referrals from implementation consultants, who cannot audit their own work, and from compliance platform users who need a human internal auditor.
• Direct clients already certified and looking for a better or more independent internal auditor than last year's.

A typical engagement is a few days of work: planning, interviews and document review, sampling, a closing meeting and a written report. Many companies also want help with the management review that follows, covered in our surveillance audit preparation guide, because certification bodies look closely at both.

Protecting your independence

The commercial temptation is to audit a company and then sell it the fixes. Do not combine the two on the same ISMS. An internal auditor who designs controls and then audits them is not objective, and a sharp certification auditor will notice. Keep a simple register of which clients you have advised and which you have audited.

Senior and analyst routes

If you are a senior practitioner with years of ISMS work, Lead Auditor certification and a few logged audits, you can approach certification bodies and lead internal audits directly. If you are an analyst with three or more years of experience, the realistic start is supporting a lead: preparing the audit plan, reviewing documents, sampling evidence and drafting findings for review. That builds the audit hours most personnel schemes ask for. Readiness work on SOC 2 and ISO 27001 is a natural partner practice, and our post on contract SOC 2 and ISO 27001 consulting work in Canada covers it.

Where the TrazTech Associate Network fits

We run the TrazTech Associate Network, so weigh this accordingly. Internal audit and compliance readiness are both practices in the network, and we keep the two apart on any one client. The network is for practitioners with at least three years of relevant experience who can give at least five hours a week and whose employment allows side work. The assessment is a realistic simulated client engagement of about three hours, with 72 hours to submit, followed by a 30-minute call, an identity check and a background declaration. Work comes as fixed-scope work orders with the scope and fee shown before you accept, and you can decline without penalty. We are a consultancy, not a certification body, so this is internal audit and readiness work, not certification audits. Work follows client demand. You can apply here.

Frequently asked questions about freelance ISO 27001 auditing

Can I issue ISO 27001 certificates as a freelancer?

No. Only a certification body can issue a certificate, and accredited certificates come from bodies accredited by an accreditation body such as the Standards Council of Canada. Freelancers can audit on a body's behalf under contract.

Do I need ISO 27001 Lead Auditor certification to do internal audits?

The standard does not require it, but clients and certification bodies expect auditors to be competent, and the Lead Auditor credential is the usual evidence. Most internal audit clients ask for it.

Can I implement ISO 27001 for a client and then do their internal audit?

You should not. Clause 9.2 requires objectivity and impartiality, and auditing your own work undermines both. Pass the audit to someone independent.

How long does an ISO 27001 internal audit take?

It depends on the scope, sites and number of controls. A small single-site ISMS can be audited in a few days, including reporting. Larger or multi-site scopes take longer.

Are remote ISO 27001 audits allowed?

Internal audits can be remote if the method is sound. For certification audits, remote techniques are allowed within accreditation rules, though some activities may still need a site visit.