$-ѴѴ;uĹ !

;ˆbv-u Ѵov$࣐ulbmov ‹ ;=bmb1bom;v

7;";]†ub7-77;Ѵ-m=oul-1bॕm
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

60
3.1 Control de Acceso

;7bovr-u--v;]†u-ut†;;Ѵ-11;vo-Ѵov-1ঞˆov;v|࢙-†|oubŒ-7o‹u;v|ubm]b7o;m=†m1bॕm7;Ѵov
u;t†bvb|ov7;m;]o1bo‹7;v;]†ub7-7ĺ

ƒĺƑo7;Ѵom-Ѵझঞ1o
Ѵ]oub|loo1࢙Ѵ1†Ѵot†;1ol0bm-†m-ol࢙vmedidas básicasŐƒĺƐƏőoderivadasŐƒĺƑƑővb]†b;m7oѴov
1ub|;ubov7;7;1bvbॕm-vo1b-7ov-Ѵ-vlbvl-vĺ

3.3 Ataque
$;m|-ঞˆ-7;7;v|u†buķ;Šrom;uķ-Ѵ|;u-uķbm_-0bѴb|-uķuo0-uo-11;7;uvbm-†|oubŒ-1bॕmo_-1;u†m†vomo
-†|oubŒ-7o7;†m-1ঞˆoĺ

3.4 Atributo
uorb;7-7o1-u-1|;uझvঞ1-7;†mobjetoŐƒĺƔƔőt†;;v1†-mঞ|-ঞˆ-o1†-Ѵb|-ঞˆ-l;m|;7bvঞm]†b0Ѵ;
roul;7bov_†l-movo-†|ol࢙ঞ1ovĺ

Œ7-r|-7-7;"ņ ƐƔƖƒƖĹƑƏƏƕœ

3.5 Auditoría
ProcesoŐƒĺѵƐővbv|;l࢙ঞ1oķbm7;r;m7b;m|;‹7o1†l;m|-7or-u-o0|;m;u;ˆb7;m1b-v7;-†7b|ouझ-‹
;ˆ-Ѵ†-uѴ-v7;l-m;u-o0f;ঞˆ-1om;ѴCm7;7;|;ulbm-u;Ѵ]u-7o;m;Ѵt†;v;1†lrѴ;mѴov1ub|;ubov

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

7;-†7b|ouझ-ĺ

$ƐĹ&m--†7b|ouझ-r†;7;v;ubm|;um-Ő7;rubl;u-r-u|;őķo;Š|;um-Ő7;v;]†m7-o|;u1;u-r-u|;őķ
‹r†;7;v;u1ol0bm-7-Ő1ol0bm-m7o7ovol࢙v7bv1brѴbm-vőĺ

$ƑĹľ ˆb7;m1b-7;-†7b|ouझ-Ŀ‹ľ1ub|;ubov7;-†7b|ouझ-Ŀv;7;Cm;m;mѴ-oul-"ƐƖƏƐƐĺ

3.6 Alcance de la Auditoría

Š|;mvbॕm‹Ѵझlb|;v7;†m--†7b|ouझ-ŐƒĺƔőĺ

Œ"ƐƖƏƐƐĹƑƏƐƐœ

ƒĺƕ†|;mঞ1-1bॕm
rou|-1bॕm7;]-u-mঠ-v7;t†;vom1ouu;1|-vѴ-v1-u-1|;uझvঞ1-vt†;†m-;mঞ7-7u;bˆbm7b1-r-u-vझ
lbvl-ĺ

61
 ƒĺѶ†|;mঞ1b7-7
uorb;7-71omvbv|;m|;;mt†;†m-;mঞ7-7;vѴot†;7b1;v;uĺ

3.9 Disponibilidad
uorb;7-77;v;u-11;vb0Ѵ;‹;v|-uѴbv|or-u-v††voo7;l-m7-7;†m-;mঞ7-7-†|oubŒ-7-ĺ

3.10 Medida Básica

MedidaŐƒĺƓƕő7;Cmb7-roul;7bo7;†matributoŐƒĺƓő‹;Ѵl࣐|o7or-u-1†-mঞC1-uѴoĺ

Œ"ņ ƐƔƖƒƖĹƑƏƏƕœ

$Ĺ&m-l;7b7-0࢙vb1-;v=†m1bom-Ѵl;m|;bm7;r;m7b;m|;7;o|u-vl;7b7-vĺ

3.11 Competencia
-r-1b7-7r-u--rѴb1-u1omo1blb;m|ov‹_-0bѴb7-7;v1om;ѴCm7;Ѵo]u-uѴovu;v†Ѵ|-7ovru;ˆbv|ovĺ

ƒĺƐƑomC7;m1b-Ѵb7-7
uorb;7-77;Ѵ-bm=oul-1bॕmrouѴ-t†;v;l-mঞ;m;bm-11;vb0Ѵ;‹mov;u;ˆ;Ѵ--bm7bˆb7†ovķ
;mঞ7-7;voprocesosŐƒĺѵƐőmo-†|oubŒ-7ovĺ

3.13 Conformidad
†lrѴblb;m|o7;†mrequisitoŐƒĺѵƒőĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

3.14 Consecuencia
!;v†Ѵ|-7o7;†msucesoŐƒĺƑƔőt†;-=;1|--Ѵovo0f;ঞˆovŐƒĺƔѵőĺ

Œ†झ-"ƕƒĹƑƏƏƖœ

$ƐĹ&mv†1;vor†;7;1om7†1bu-†m-v;ub;7;1omv;1†;m1b-vĺ
$ƑĹ&m-1omv;1†;m1b-r†;7;v;u1b;u|-obm1b;u|-‹moul-Ѵl;m|;;vm;]-ঞˆ-;m;Ѵ1om|;Š|o7;
Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ
$ƒĹ-v1omv;1†;m1b-vv;r†;7;m;Šru;v-u7;=oul-1†-Ѵb|-ঞˆ-o1†-mঞ|-ঞˆ-ĺ
$ƓĹ-v1omv;1†;m1b-vbmb1b-Ѵ;vr†;7;m1omˆ;uঞuv;;mu;-11bom;v;m1-7;m-ĺ

ƒĺƐƔ;fou-omঞm†-
1ঞˆb7-7u;1†uu;m|;r-u-l;fou-u;ѴdesempeñoŐƒĺƔƖőĺ

62
3.16 Control
;7b7-t†;lo7bC1-†mriesgoŐƒĺѵѶőĺ

Œ"†झ-ƕƒĹƑƏƖƏœ

$ƐĹov1om|uoѴ;vbm1Ѵ†‹;m1†-Ѵt†b;uruo1;voķroѴझঞ1-ķ7bvrovbঞˆoķru࢙1ঞ1-ķ†o|u-v-11bom;v
t†;lo7bCt†;m†mub;v]oĺ

$ ƑĹ ov 1om|uoѴ;v mo vb;lru; r†;7;m ruorou1bom-u ;Ѵ ;=;1|o 7; lo7bC1-1bॕm ru;ˆbv|o o
-v†lb7oĺ

ƒĺƐƕ0f;ঞˆo7;om|uoѴ
;1Ѵ-u-1bॕmt†;7;v1ub0;Ѵot†;v;t†b;u;Ѵo]u-u1olou;v†Ѵ|-7o7;Ѵ-blrѴ;l;m|-1bॕm7;controles
ŐƒĺƐѵőĺ

3.18 Corrección
11bॕmr-u-;Ѵblbm-u†m-no conformidadŐƒĺƔƒő7;|;1|-7-ĺ

ƒĺƐƖ11bॕmouu;1ঞˆ-
11bॕmr-u-;Ѵblbm-uѴ-1-†v-7;†m-no conformidad ŐƒĺƔƒő‹ru;ˆ;mbut†;ˆ†;Ѵˆ--o1†uubuĺ

3.20 Datos
omf†m|o7;ˆ-Ѵou;v-vo1b-7ov-medidas básicasŐƒĺƐƏőķ medida derivadasŐƒĺƑƑő‹ņo indicadores
ŐƒĺƒƏőĺ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

Œ"ņ ƐƔƖƒƖĹƑƏƏƕœ

$Ĺ v|-7;Cmb1bॕmvoѴov;-rѴb1-;m;Ѵ1om|;Š|o7;Ѵ-oul-"ņ ƑƕƏƏƓĹƑƏƏƖĺ

3.21 Criterios de Decisión

&l0u-Ѵ;vķo0f;ঞˆovor-|uom;vt†;v;†ঞѴbŒ-mr-u-7;|;ulbm-uѴ-m;1;vb7-77;†m--11bॕmo7;†m-
l-‹oubmˆ;vঞ]-1bॕmķor-u-7;v1ub0bu;Ѵmbˆ;Ѵ7;1omC-mŒ-;m†mu;v†Ѵ|-7o7;|;ulbm-7oĺ

Œ"ņ ƐƔƖƒƖĹƑƏƏƕœ

3.22 Medida Derivada

Medida ŐƒĺƓƕőt†;v;7;Cm;;m=†m1bॕm7;7ovol࢙vˆ-Ѵou;v7;l;7b7-v0࢙vb1-vŐƒĺƐƏőĺ

Œ"ņ ƐƔƖƒƖĹƑƏƏƕœ

63
 3.23 Información Documentada
m=oul-1bॕmt†;†m-organizaciónŐƒĺƔƕőঞ;m;t†;1om|uoѴ-u‹l-m|;m;uķ‹;Ѵl;7bo;m;Ѵt†;;v|࢙
1om|;mb7-ĺ

$ƐĹ-bm=oul-1bॕm7o1†l;m|-7-r†;7;;v|-u;m1†-Ѵt†b;u=oul-|o‹l;7boķ‹r†;7;ruoˆ;mbu
7;1†-Ѵt†b;u=†;m|;ĺ

$ƑĹ-bm=oul-1bॕm7o1†l;m|-7-r†;7;_-1;uu;=;u;m1b--Ĺ
վ Ѵsistema de gestiónŐƒĺƓѵőķbm1Ѵ†b7ovѴovprocesosŐƒĺѵƐőu;Ѵ-1bom-7ovĺ
վ -bm=oul-1bॕm1u;-7-r-u-t†;Ѵ-ou]-mbŒ-1bॕmor;u;Ő7o1†l;m|-1bॕmőĺ
վ -;ˆb7;m1b-7;Ѵovu;v†Ѵ|-7ov-Ѵ1-mŒ-7ovŐu;]bv|uovőĺ

ƒĺƑƓ C1-1b-
u-7o;m;Ѵ1†-Ѵv;u;-ѴbŒ-mѴ-v-1ঞˆb7-7;vrѴ-mbC1-7-v‹v;Ѵo]u-mѴovu;v†Ѵ|-7ovrѴ-mbC1-7ovĺ

3.25 Evento
1†uu;m1b-o1-l0bo7;†m1omf†m|or-uঞ1†Ѵ-u7;1bu1†mv|-m1b-vĺ

Œ t†bˆ-Ѵ;m|;-ľv†1;voĿ;m†झ-"ƕƒĹƑƏƏƖœ

NOTA 1:&m;ˆ;m|or†;7;v;uিmb1oou;r;ঞuv;ķ‹v;r†;7;7;0;u-ˆ-ub-v1-†v-vĺ

NOTA 2:&m;ˆ;m|or†;7;1omvbvঞu;m-Ѵ]ot†;mov;ѴѴ;]--ruo7†1buĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

NOTA 3:Ѵ]†m-vˆ;1;vķ†m;ˆ;m|ov;r†;7;1-ѴbC1-u1olo†mľbm1b7;m|;Ŀo†mľ-11b7;m|;Ŀĺ

ƒĺƑѵ bu;11bॕm f;1†ঞˆ-

;uvom-o]u†ro7;r;uvom-;mѴ-Ővőt†;Ѵovórganos de gobiernoŐƒĺƑƖő_-m7;Ѵ;]-7oѴ-u;vromv-0bѴb7-7
7;blrѴ;l;m|-u;v|u-|;]b-v‹roѴझঞ1-vr-u--Ѵ1-mŒ-uѴ-lbvbॕm7;Ѵ-organizaciónŐƒĺƔƕőĺ

$Ĺ-7bu;11bॕm;f;1†ঞˆ--ˆ;1;vv;ѴѴ-l--Ѵ|-7bu;11bॕm‹r†;7;bm1Ѵ†bu7bu;1|ou;v];m;u-Ѵ;vķ
7bu;1|ou;vCm-m1b;uovķ7bu;1|ou;v7;Ѵ-bm=oul-1bॕm‹o|uovuoѴ;vvblbѴ-u;vĺ

3.27 Contexto Externo

m|oumo;Š|;umo;m;Ѵt†;Ѵ-ou]-mbŒ-1bॕm0†v1--Ѵ1-mŒ-uv†vo0f;ঞˆovĺ

Œ†झ-"ƕƒĹƑƏƏƖœ

$Ĺ Ѵ;m|oumo;Š|;umor†;7;bm1Ѵ†buĹ

64
վ Ѵ;m|oumo1†Ѵ|†u-Ѵķvo1b-ѴķroѴझ|b1oķѴ;]-Ѵķu;]†Ѵ-|ouboķ=bm-m1b;uoķ|;1moѴॕ]b1oķ;1omॕlb1oķm-|†u-Ѵ‹
1olr;|b|bˆoķ-mbˆ;Ѵbm|;um-1bom-Ѵķm-1bom-Ѵķu;]bom-ѴoѴo1-Ѵĺ
վ ov =-1|ou;v‹ Ѵ-v |;m7;m1b-v t†; |;m]-m blr-1|o vo0u; Ѵov objetivos ŐƒĺƔѵő 7; Ѵ- organización
ŐƒĺƔƕőĺ
վ Las relaciones con las partes interesadas;Š|;um-vŐƒĺѶƑőķv†vr;u1;r1bom;v‹v†vˆ-Ѵou;vĺ

3.28 Gobernanza de la Seguridad de la Información

omf†m|o7;rubm1brbov‹procesosŐƒĺѵƐől;7b-m|;Ѵov1†-Ѵ;v†m-organizaciónŐƒĺƔƕő7bub];‹
v†r;uˆbv-Ѵ-v-1ঞˆb7-7;vu;Ѵ-1bom-7-v1omѴ-v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ

3.29 Órgano de Gobierno

omf†m|o 7; r;uvom-v t†; u;vrom7;m‹ ubm7;m 1†;m|-v 7;Ѵ desempeño ŐƒĺƔƖő 7; Ѵ- organización
ŐƒĺƔƕőĺ

$Ĺ m-Ѵ]†m-vf†ubv7b11bom;vķ;Ѵॕu]-mo7;]o0b;umor†;7;v;u;Ѵ1omv;fo7;-7lbmbv|u-1bॕmĺ

3.30 Indicador
MedidaŐƒĺƓƕőt†;ruorou1bom-†m-;vঞl-1bॕmo†m-;ˆ-Ѵ†-1bॕm7;7;|;ulbm-7ov-|ub0†|ovŐƒĺƓő
†v-m7o†mlo7;Ѵo-m-Ѵझঞ1oŐƒĺƑőr-u-v-ঞv=-1;u†m-v7;|;ulbm-7-vnecesidades de información
ŐƒĺƒƐőĺ

3.31 Necesidades de Información

omo1blb;m|om;1;v-ubor-u-];vঞom-uѴovo0f;ঞˆovķѴ-vl;|-vķ;Ѵub;v]o‹Ѵovruo0Ѵ;l-vĺ

Œ"ņ ƐƔƖƒƖĹƑƏƏƕœ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

3.32 Recursos (instalaciones) de Tratamiento de Información
†-Ѵt†b;uvbv|;l-7;|u-|-lb;m|o7;Ѵ-bm=oul-1bॕmķv;uˆb1bovobm=u-;v|u†1|†u-ķoѴovѴ†]-u;vࣱvb1ov
t†;Ѵov-Ѵ0;u]-mĺ

3.33 Seguridad de la Información

u;v;uˆ-1bॕm 7; Ѵ- 1omC7;m1b-Ѵb7-7 ŐƒĺƐƑőķ Ѵ- integridad ŐƒĺƓƏő‹ Ѵ- disponibilidad ŐƒĺƖő 7; Ѵ-
bm=oul-1bॕmĺ

$ņ7b;m7oķ-7;l࢙vķ-0-u1-uo|u-vruorb;7-7;vķ1oloѴ--†|;mঞ1b7-7ŐƒĺѶőķѴ-u;vromv-0bѴb7-7ķ
el no repudioŐƒĺƔƓő‹Ѵ-C-0bѴb7-7ŐƒĺѵƑőĺ

65
 ƒĺƒƓomঞm†b7-77;Ѵ-";]†ub7-77;Ѵ-m=oul-1bॕm
ProcesosŐƒĺѵƐő‹ruo1;7blb;m|ovr-u--v;]†u-uѴ-1omঞm†b7-77;Ѵ-v-1ঞˆb7-7;vu;Ѵ-1bom-7-v1omѴ-
seguridad de la informaciónŐƒĺƒƒőĺ

3.35 Evento o Suceso de Seguridad de la Información

1†uu;m1b-7;|;1|-7-;m;Ѵ;v|-7o7;†mvbv|;l-ķv;uˆb1boou;7t†;bm7b1-†m-rovb0Ѵ;ˆboѴ-1bॕm
7;Ѵ-roѴझঞ1-7;v;]†ub7-77;Ѵ-bm=oul-1bॕmķ†m=-ѴѴo7;Ѵov1om|uoѴ;vo†m-vb|†-1bॕm7;v1omo1b7-
_-v|-;Ѵlol;m|o‹t†;r†;7;v;uu;Ѵ;ˆ-m|;r-u-Ѵ-v;]†ub7-7ĺ

3.36 Incidente de Seguridad de la Información

ˆ;m|ovbm]†Ѵ-uov;ub;7;eventos de la seguridad de la informaciónŐƒĺƒƔőķbm;vr;u-7ovomo
7;v;-7ovķt†;ঞ;m;m†m-ruo0-0bѴb7-7vb]mbC1-ঞˆ-7;1olruol;|;uѴ-vor;u-1bom;v7;Ѵm;]o1bo‹
7;-l;m-Œ-uѴ-seguridad de la informaciónŐƒĺƒƒőĺ

ƒĺƒƕ;vঞॕm7;m1b7;m|;v7;";]†ub7-77;Ѵ-m=oul-1bॕm
ProcesosŐƒĺѵƐőr-u-Ѵ-7;|;11bॕmķmoঞC1-1bॕmķ;ˆ-Ѵ†-1bॕmķu;vr†;v|-ķ|u-|-lb;m|oķ‹-ru;m7bŒ-f;7;
incidentes de la seguridad de la informaciónŐƒĺƒѵőĺ

ƒĺƒѶoѴ;1ঞˆot†;olr-u|;m=oul-1bॕm
u†ro7;ou]-mbŒ-1bom;vt†;-1†;u7-m1olr-uঞubm=oul-1bॕmĺ
$Ĺ&m-ou]-mbŒ-1bॕmr†;7;v;u†mbm7bˆb7†oĺ

3.39 Sistema de Información

rѴb1-1bom;vķv;uˆb1bovķ-1ঞˆov7;|;1moѴo]झ-v7;Ѵ-bm=oul-1bॕm‹o|uo1olrom;m|;vr-u-l-m;f-u
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

bm=oul-1bॕmĺ

3.40 Integridad
uorb;7-77;;Š-1ঞ|†7‹1olrѴ;ঞ|†7ĺ

3.41 Parte Interesada

;uvom-†organizaciónŐƒĺƔƕőt†;r†;7;-=;1|-uķ;v|-u-=;1|-7-ķor;u1b0but†;;v|࢙-=;1|-7-rou
†m-7;1bvbॕmo-1ঞˆb7-7ĺ

3.42 Contexto Interno

m|oumobm|;umo;m;Ѵt†;Ѵ-ou]-mbŒ-1bॕm0†v1--Ѵ1-mŒ-uv†vo0f;ঞˆovĺ

Œ†झ-"ƕƒĹƑƏƏƖœ

$Ĺ Ѵ1om|;Š|obm|;umor†;7;bm1Ѵ†buĹ

66
վ Ѵ]o0b;umoķѴ-;v|u†1|†u-7;Ѵ-ou]-mbŒ-1bॕmķѴ-v=†m1bom;v‹Ѵ-o0Ѵb]-1bॕm7;u;m7bu1†;m|-vĺ
վ -vroѴझ|b1-vķѴovo0f;|bˆov‹Ѵ-v;v|u-|;]b-vt†;v;;v|-0Ѵ;1;mr-u-1omv;]†buѴoĺ
վ -v1-r-1b7-7;vķ;m|;m7b7-v;m|࣐ulbmov7;u;1†uvov‹1omo1blb;m|ovŐrou;f;lrѴoķ1-rb|-Ѵķ|b;lroķ
r;uvom-vķruo1;vovķvbv|;l-v‹|;1moѴo]झ-vőĺ
վ ovvbv|;l-v7;bm=oul-1bॕmķѴov=Ѵ†fov7;bm=oul-1bॕm‹Ѵovruo1;vov7;|ol-7;7;1bvbom;vŐ|-m|o
=oul-Ѵ;v1olobm=oul-Ѵ;vőĺ
վ -vu;Ѵ-1bom;vķr;u1;r1bom;v‹Ѵovˆ-Ѵou;v7;Ѵ-vr-u|;vbm|;u;v-7-vbm|;um-vĺ
վ -1†Ѵ|†u-7;Ѵ-ou]-mbŒ-1bॕmĺ
վ -vmoul-vķѴ-v7bu;1|ub1;v‹Ѵovlo7;Ѵov-7or|-7ovrouѴ-ou]-mbŒ-1bॕmĺ
վ -=oul-‹-lrѴb|†77;Ѵ-vu;Ѵ-1bom;v1om|u-1|†-Ѵ;vĺ

3.43 Proyecto del SGSI

1ঞˆb7-7;v;v|u†1|†u-Ѵ;vѴѴ;ˆ-7-v-1-0orou†m-ou]-mbŒ-1bॕmŐƒĺƔƕőr-u-blrѴ;l;m|-u†m""ĺ

3.44 Nivel de Riesgo

-]mb|†77;†mriesgoŐƒĺѵѶőo1ol0bm-1bॕm7;ub;v]ovķ;Šru;v-7ov;m|࣐ulbmov7;Ѵ-1ol0bm-1bॕm
de las consecuenciasŐƒĺƐƓő‹7;v†probabilidadŐƒĺƓƔőĺ

Œ†झ-"ƕƒĹƑƏƏƖœ

3.45 Probabilidad (likehood)

ovb0bѴb7-77;t†;-Ѵ]িm_;1_ov;ruo7†Œ1-ĺ

Œ†झ-"ƕƒĹƑƏƏƖœ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

ƒĺƓѵ"bv|;l-7;;vঞॕm
omf†m|o 7; ;Ѵ;l;m|ov 7; †m- organización ŐƒĺƔƕő bm|;uu;Ѵ-1bom-7ov o t†; bm|;u-1|ি-m r-u-
;v|-0Ѵ;1;uroѴझঞ1-vŐƒĺѵƏőķo0f;ঞˆovŐƒĺƔѵő‹procesosŐƒĺѵƐőr-u-Ѵo]u-u;v|ovo0f;ঞˆovĺ

$ƐĹ&mvbv|;l-7;];vঞॕmr†;7;|u-|-u†m-voѴ-7bv1brѴbm-oˆ-ub-v7bv1brѴbm-vĺ

$ ƑĹ ov ;Ѵ;l;m|ov 7;Ѵ vbv|;l- bm1Ѵ†‹;m Ѵ- ;v|u†1|†u- 7; Ѵ-ou]-mbŒ-1bॕmķ Ѵov uoѴ;v‹ Ѵ-v
u;vromv-0bѴb7-7;vķѴ-rѴ-mbC1-1bॕmķѴ-or;u-1bॕmķ;|1ĺ

$ƒĹ Ѵ-Ѵ1-m1;7;†mvbv|;l-7;];vঞॕmr†;7;bm1Ѵ†buѴ-|o|-Ѵb7-77;Ѵ-ou]-mbŒ-1bॕmķ
=†m1bom;v;vr;1झC1-v;b7;mঞC1-7-v7;Ѵ-ou]-mbŒ-1bॕmķv;11bom;v;vr;1झC1-v;b7;mঞC1-7-v
de laou]-mbŒ-1bॕmķo†m-ol࢙v=†m1bom;v7;m|uo7;†m]u†ro7;ou]-mbŒ-1bom;vĺ

67
 3.47 Medida
(-ub-0Ѵ;-Ѵ-t†;v;Ѵ;-vb]m-†mˆ-Ѵou1olou;v†Ѵ|-7o7;†m-mediciónŐƒĺƓѶőĺ

Œ"ņ ƐƔƖƒƖĹƑƏƏƕœ

$Ĺ Ѵ|;ulbmoľl;7b7-vĿv;†ঞѴbŒ-r-u-_-1;uu;=;u;m1b-1omf†m|-l;m|;-l;7b7-v7;0-v;ķ7;
Ѵ-v7;ubˆ-7-vķ;bm7b1-7ou;vĺ

3.48 Medición
ProcesoŐƒĺѵƐőr-u-7;|;ulbm-u†mˆ-Ѵouĺ

$Ĺ m;Ѵ1om|;Š|o7;seguridad de la informaciónŐƒĺƒƒőķ;Ѵruo1;vor-u-7;|;ulbm-u†mˆ-Ѵou

u;t†b;u; bm=oul-1bॕm vo0u; Ѵ- ;C1-1b- ŐƒĺƑƓő 7; †m vbv|;l- 7; ];vঞॕm ŐƒĺƓѵő 7; v;]†ub7-7 7; Ѵ-
bm=oul-1bॕm‹v†v1ouu;vrom7b;m|;vcontrolesŐƒĺƐѵő†ঞѴbŒ-m7o†mmétodo de mediciónŐƒĺƔƏőķ†m-
función de mediciónŐƒĺƓƖőķ†mlo7;Ѵo-m-Ѵझঞ1oŐƒĺƑőķ‹†movcriterios de decisiónŐƒĺƑƐőĺ

3.49 Función de Medición

Ѵ]oub|loo1࢙Ѵ1†Ѵou;-ѴbŒ-7or-u-1ol0bm-u7ovol࢙vmedidas básicasŐƒĺƐƏőĺ

Œ"ņ ƐƔƖƒƖĹƑƏƏƕœ

3.50 Método de Medición

";1†;m1b- Ѵॕ]b1- 7; or;u-1bom;vķ 7;v1ub|-v ];m࣐ub1-l;m|;ķ †ঞѴbŒ-7- ;m Ѵ- 1†-mঞC1-1bॕm 7; †m
atributoŐƒĺƓő1omu;vr;1|o-†m-escalaŐƒĺѶƏő;vr;1bC1-7-ĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

Œ"ņ ƐƔƖƒƖĹƑƏƏƕœ

$Ĺ Ѵঞro7;l࣐|o7o7;l;7b1bॕm7;r;m7;7;Ѵ-m-|†u-Ѵ;Œ-7;Ѵ-vor;u-1bom;v†ঞѴbŒ-7-vr-u-
1†-mঞC1-u†m-|ub0†|oĺ";r†;7;m7bvঞm]†bu7ovঞrovĹ

վ "†0f;|bˆoĹ-1†-m|b=b1-1bॕmv;0-v-;m;Ѵf†b1bo_†l-moĺ
վ 0f;|bˆoĹ-1†-m|b=b1-1bॕmv;0-v-;mu;]Ѵ-vm†l࣐ub1-vĺ

3.51 Resultados de las Mediciones

&mool࢙vbm7b1-7ou;vŐƒĺƒƏő‹v†v1ouu;vrom7b;m|;vbm|;uru;|-1bom;vt†;-0ou7-m†m-m;1;vb7-7
7;bm=oul-1bॕmŐƒĺƒƐőĺ

68
3.52 Supervisión, Seguimiento o Monitorización (monitoring)
;|;ulbm-1bॕm7;Ѵ;v|-7o7;†mvbv|;l-ķ†mprocesoŐƒĺѵƐőo†m--1ঞˆb7-7ĺ

$Ĺ -u- 7;|;ulbm-u ;Ѵ ;v|-7o r†;7; v;u m;1;v-ubo ˆ;ubC1-uķ v†r;uˆbv-u † o0v;uˆ-u ;m =oul-
1uझঞ1-ĺ

3.53 No Conformidad
m1†lrѴblb;m|o7;†mrequisitoŐƒĺѵƒőĺ

3.54 No Repudio
-r-1b7-7r-u-1ouuo0ou-ut†;;v1b;u|-Ѵ-u;bˆbm7b1-1bॕm7;t†;o1†uubॕ†m1b;u|ov†1;voov;
u;-ѴbŒॕ†m-1b;u|--11bॕmrour-u|;7;Ѵ-v;mঞ7-7;vt†;Ѵooub]bm-uomĺ

3.55 Objeto
Ѵ;l;m|o1-u-1|;ubŒ-7oroul;7bo7;Ѵ-l;7b1bॕmŐƒĺƓѶő7;v†v-|ub0†|ovŐƒĺƓőĺ

ƒĺƔѵ0f;ঞˆo
!;v†Ѵ|-7o-Ѵo]u-u

$ƐĹ&mo0f;ঞˆor†;7;v;u;v|u-|࣐]b1oķ|࢙1ঞ1o†or;u-ঞˆoĺ

$ƑĹovo0f;ঞˆovr†;7;mu;=;ubuv;-7b=;u;m|;v7bv1brѴbm-vŐ1oloCm-m1b;u-vķ7;v;]†ub7-7
‹v-Ѵ†7‹-l0b;m|-Ѵ;vő‹v;r†;7;m-rѴb1-u;m7b=;u;m|;vmbˆ;Ѵ;vŐ1olo;v|u-|࣐]b1ovķr-u-|o7-Ѵ-
ou]-mbŒ-1bॕmķr-u-ruo‹;1|ovķruo7†1|ov‹procesosŐƒĺѵƐőőĺ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

$ƒĹ&mo0f;ঞˆov;r†;7;;Šru;v-u7;o|u-vl-m;u-vķrou;f;lrѴoķ1olo†mu;v†Ѵ|-7oru;ˆbv|oķ
†mruorॕvb|oķ†m1ub|;uboor;u-ঞˆoķ†mo0f;ঞˆo7;v;]†ub7-77;Ѵ-bm=oul-1bॕmķol;7b-m|;;Ѵ†vo
7;|࣐ulbmov1om†mvb]mbC1-7ovblbѴ-uŐrou;f;lrѴoķCm-Ѵb7-7ol;|-őĺ

$ƓĹ m;Ѵ1om|;Š|o7;vbv|;l-v7;];vঞॕm7;Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕmķѴ-ou]-mbŒ-1bॕm
;v|-0Ѵ;1;Ѵovo0f;ঞˆov7;Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕmķ;m1om1ou7-m1b-1omѴ-roѴझঞ1-7;
v;]†ub7-77;Ѵ-bm=oul-1bॕmķr-u-Ѵo]u-uu;v†Ѵ|-7ov;vr;1झC1ovĺ

3.57 Organización
;uvom-o]u†ro7;r;uvom-vt†;ঞ;m;mv†vruorb-v=†m1bom;v1omu;vromv-0bѴb7-7;vķ-†|oub7-7;v
‹u;Ѵ-1bom;vr-u-;ѴѴo]uo7;v†vo0f;ঞˆovŐƒĺƔѵőĺ

$Ĺ Ѵ 1om1;r|o 7; ou]-mbŒ-1bॕm bm1Ѵ†‹;ķ r;uo mo v; Ѵblb|- -ķ ;lru;v-ubov †mbr;uvom-Ѵ;vķ
;lru;v-vķ1ourou-1bom;vķCul-vķ-†|oub7-7;vķ-vo1b-1bom;vķ;|1ĺķ;mvblbvl-vķr-u1b-Ѵl;m|;o]u†ro
7;;ѴѴ-vķv;-mrি0Ѵb1-vorubˆ-7-vĺ

69
 3.58 Contratar Externamente (verbo)
v|-0Ѵ;1;u†m-1†;u7ol;7b-m|;;Ѵ1†-Ѵ†m-organizaciónŐƒĺƔƕő;Š|;um-u;-ѴbŒ-r-u|;7;†m-=†m1bॕm
o procesoŐƒĺѵƐő7;†m-ou]-mbŒ-1bॕmĺ

$ƐĹ&m-ou]-mbŒ-1bॕm;Š|;um-;v|࢙=†;u-7;Ѵ-Ѵ1-m1;7;Ѵvbv|;l-7;];vঞॕmŐƒĺƓѵőķ-†mt†;Ѵ-
=†m1bॕmoruo1;vo1om|u-|-7o;Š|;um-l;m|;=oul;r-u|;7;Ѵ-Ѵ1-m1;ĺ

3.59 Desempeño
!;v†Ѵ|-7ol;7b0Ѵ;ĺ

$ƐĹ Ѵ7;v;lr;ोov;r†;7;u;Ѵ-1bom-u1om_-ѴѴ-Œ]ov1†-mঞ|-ঞˆovo1†-Ѵb|-ঞˆovĺ

$ƑĹ Ѵ7;v;lr;ोov;r†;7;u;Ѵ-1bom-u1omѴ-];vঞॕm7;-1ঞˆb7-7;vķprocesosŐƒĺѵƐőķ
ruo7†1|ovŐbm1Ѵ†b7ovv;uˆb1bovőķvbv|;l-v†organizaciones ŐƒĺƔƕőĺ

ƒĺѵƏoѴझঞ1-
m|;m1bom;v‹7bu;11bॕm7;†m-organizaciónŐƒĺƔƕőķ1oloѴ-v;Šru;v-=oul-Ѵl;m|;v†alta dirección
ŐƒĺѶƓőĺ

3.61 Proceso
omf†m|o7;-1ঞˆb7-7;vbm|;uu;Ѵ-1bom-7-vot†;bm|;u-1|ি-mķt†;|u-mv=oul-;Ѵ;l;m|ov7;;m|u-7-
;m;Ѵ;l;m|ov7;v-Ѵb7-ĺ

3.62 Fiabilidad
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

uorb;7-7u;Ѵ-ঞˆ--Ѵ-1omvbv|;m1b-;m;Ѵ1olrou|-lb;m|o‹;mѴovu;v†Ѵ|-7ov7;v;-7ovĺ

3.63 Requisito
;1;vb7-7o;Šr;1|-ঞˆ-t†;;v|࢙;v|-0Ѵ;1b7-ķ];m;u-Ѵl;m|;blrѴझ1b|-†o0Ѵb]-|oub-ĺ

$ƐĹľ;m;u-Ѵl;m|;blrѴझ1b|-Ŀvb]mbC1-t†;;v†m-1ov|†l0u;oru࢙1ঞ1-1olিm;mѴ-ou]-mbŒ-1bॕm
‹;mѴ-vr-u|;vbm|;u;v-7-vķt†;Ѵ-m;1;vb7-7o;Šr;1|-ঞˆ-t†;v;1omvb7;u-;v|࢙blrѴझ1b|-ĺ

$ ƑĹ &m u;t†bvb|o ;vr;1bC1-7o ;v ;Ѵ t†; ;v|࢙ 7;1Ѵ-u-7oķ rou ;f;lrѴoķ ;m bm=oul-1bॕm
7o1†l;m|-7-ĺ

3.64 Riesgo Residual

RiesgoŐƒĺѵѶőu;l-m;m|;7;vr†࣐v7;Ѵtratamiento del riesgoŐƒĺƕƖőĺ

$ƐĹ Ѵub;v]ou;vb7†-Ѵr†;7;1om|;m;uub;v]ovmob7;mঞC1-7ovĺ

$ƑĹ Ѵub;v]ou;vb7†-Ѵ|-l0b࣐mv;r†;7;1omo1;u1oloľub;v]ou;|;mb7oĿĺ

70
3.65 Revisión
1ঞˆb7-7t†;v;u;-ѴbŒ-r-u-7;|;ulbm-uѴ-b7om;b7-7ķѴ--7;1†-1bॕm‹Ѵ-;C1-1b-ŐƒĺƑƓő7;Ѵ|;l-
;v|†7b-7or-u-1omv;]†buѴovo0f;ঞˆov;v|-0Ѵ;1b7ovĺ

Œ†झ-"ƕƒĹƑƏƏƖœ

3.66 Objeto en Revisión

Ѵ;l;m|o;vr;1झC1ot†;;v|࢙vb;m7ou;ˆbv-7oĺ

ƒĺѵƕ0f;ঞˆo7;Ѵ-!;ˆbvbॕm
;1Ѵ-u-1bॕmt†;7;v1ub0;Ѵot†;v;t†b;u;Ѵo]u-u1olou;v†Ѵ|-7o7;†m-u;ˆbvbॕmĺ

3.68 Riesgo
=;1|o7;Ѵ-bm1;uঞ7†l0u;vo0u;Ѵ-1omv;1†1bॕm7;Ѵovo0f;ঞˆovĺ

Œ†झ-"ƕƒĹƑƏƏƖœ

$ƐĹ&m;=;1|o;v†m-7;vˆb-1bॕmķrovbঞˆ-‹ņom;]-ঞˆ-ķu;vr;1|o-Ѵoruoˆbv|oĺ

$ƑĹ-bm1;uঞ7†l0u;;v;Ѵ;v|-7oķbm1Ѵ†vor-u1b-Ѵķ7;7;C1b;m1b-;mѴ-bm=oul-1bॕmu;Ѵ-ঞˆ--
la 1olru;mvbॕmo-Ѵ1omo1blb;m|o7;†msucesoŐƒĺƑƔőķ7;v†vconsecuenciasŐƒĺƐƓőo7;v†
probabilidadŐƒĺƓƔőĺ
$ƒĹom=u;1†;m1b-ķ;Ѵub;v]ov;1-u-1|;ubŒ-rouu;=;u;m1b--sucesosŐƒĺƑƔőro|;m1b-Ѵ;v‹-v†v
consecuenciasŐƒĺƐƓőo†m-1ol0bm-1bॕm7;-l0ovĺ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

$ ƓĹ om =u;1†;m1b-ķ ;Ѵ ub;v]o v; ;Šru;v- ;m |࣐ulbmov 7; 1ol0bm-1bॕm 7; Ѵ-v consecuencias
ŐƒĺƐƓő7;†mv†1;voŐbm1Ѵ†‹;m7oѴov1-l0bov;mѴ-v1bu1†mv|-m1b-vő‹7;v†probabilidadŐƒĺƓƔőĺ

$ƔĹ m;Ѵ1om|;Š|o7;vbv|;l-7;];vঞॕm7;Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕmķѴovub;v]ov7;v;]†ub7-7
7;Ѵ-bm=oul-1bॕmv;r†;7;m;Šru;v-u1olo;Ѵ;=;1|o7;Ѵ-bm1;uঞ7†l0u;vo0u;Ѵovo0f;ঞˆov7;v;]†ub7-7
7;Ѵ-bm=oul-1bॕmĺ

$ѵĹ Ѵub;v]o7;v;]†ub7-77;Ѵ-bm=oul-1bॕmv;u;Ѵ-1bom-1omѴ-rovb0bѴb7-77;t†;Ѵ-vamenazas
ŐƒĺѶƒő ;ŠrѴo|;m vulnerabilidades ŐƒĺѶƖő 7; †m -1ঞˆo o ]u†ro 7; -1ঞˆov 7; bm=oul-1bॕm‹ 1-†v;m
7-ोo-†m-ou]-mbŒ-1bॕmĺ

71
 3.69 Aceptación del Riesgo
;1bvbॕmbm=oul-7-;m=-ˆou7;|ol-u†mriesgoŐƒĺѵѶőr-uঞ1†Ѵ-uĺ

Œ†झ-"ƕƒĹƑƏƏƖœ

$ƐĹ--1;r|-1bॕm7;Ѵub;v]or†;7;|;m;uѴ†]-uvbmt†;;Šbv|-tratamiento del riesgoŐƒĺƕƖőo

7†u-m|;;Ѵruo1;vo7;|u-|-lb;m|o7;Ѵub;v]oĺ

$ƑĹovub;v]ov-1;r|-7ovvomo0f;|o7;seguimientoŐƒĺƔƑő‹7;revisiónŐƒĺѵƔőĺ

3.70 Análisis del Riesgo

uo1;vot†;r;ulb|;1olru;m7;uѴ-m-|†u-Ѵ;Œ-7;ѴriesgoŐƒĺѵѶő‹7;|;ulbm-u;Ѵnivel de riesgoŐƒĺƓƓőĺ

Œ†झ-"ƕƒĹƑƏƏƖœ

$ƐĹ Ѵ-m࢙Ѵbvbv7;Ѵub;v]oruorou1bom-Ѵ-v0-v;vr-u-Ѵ-evaluación del riesgoŐƒĺƕƓő‹r-u-|ol-u

Ѵ-v7;1bvbom;vu;Ѵ-ঞˆ-v-Ѵtratamiento del riesgoŐƒĺƕƖőĺ

$ƑĹ Ѵ-m࢙Ѵbvbv7;Ѵub;v]obm1Ѵ†‹;Ѵ-;vঞl-1bॕm7;Ѵub;v]oĺ

3.71 Apreciación del Riesgo

ProcesoŐƒĺѵƐő]Ѵo0-Ѵt†;1olru;m7;Ѵ-b7;mঞC1-1bॕm7;Ѵub;v]oŐƒĺƕƔőķ;Ѵanálisis del riesgoŐƒĺƕƏő‹
la evaluación del riesgoŐƒĺƕƓőĺ

Œ†झ-"ƕƒĹƑƏƏƖœ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

3.72 Comunicación y Consulta del Riesgo

uo1;vovb|;u-ঞˆov‹1omঞm†ovt†;u;-ѴbŒ-†m-ou]-mbŒ-1bॕmr-u-ruorou1bom-uķ1olr-uঞu†o0|;m;u
bm=oul-1bॕm‹r-u-;v|-0Ѵ;1;u;Ѵ7b࢙Ѵo]o1omѴ-vpartes interesadasŐƒĺѶƑőķ;mu;Ѵ-1bॕm1omѴ-];vঞॕm
del riesgoŐƒĺѵѶőĺ

Œ†झ-"ƕƒĹƑƏƏƖœ

$ƐĹ-bm=oul-1bॕmr†;7;1ouu;vrom7;u-Ѵ-;Šbv|;m1b-ķѴ-m-|†u-Ѵ;Œ-ķѴ-=oul-ķѴ-ruo0-0bѴb7-7ķ
Ѵ-blrou|-m1b-ķѴ-;ˆ-Ѵ†-1bॕmķѴ--1;r|-0bѴb7-7‹;Ѵ|u-|-lb;m|o7;Ѵ-];vঞॕm7;Ѵub;v]oĺ

$ƑĹ-1omv†Ѵ|-1omvঞ|†‹;†mruo1;vo7;1ol†mb1-1bॕmbm=oul-7-7;7o0Ѵ;v;mঞ7o;m|u;†m-
ou]-mbŒ-1bॕm‹v†vr-u|;vbm|;u;v-7-vķvo0u;†m-1†;vঞॕm-m|;v7;|ol-u†m-7;1bvbॕmo7;|;ulbm-u
†m-oub;m|-1bॕmvo0u;7b1_-1†;vঞॕmĺ-1omv†Ѵ|-;vĹ

վ &mruo1;vot†;blr-1|-vo0u;†m-7;1bvbॕm-|u-ˆ࣐v7;Ѵ-bm=Ѵ†;m1b-l࢙vt†;rouѴ--†|oub7-7ĺ
վ &m-1om|ub0†1bॕmr-u-†m-|ol-7;7;1bvbॕm‹mo†m-|ol-7;7;1bvbॕm1omf†m|-ĺ

72
3.73 Criterios de Riesgo
$࣐ulbmov7;u;=;u;m1b-u;vr;1|o-Ѵovt†;v;;ˆ-Ѵি-Ѵ-blrou|-m1b-7;†m riesgoŐƒĺѵѶőĺ

Œ†झ-"ƕƒĹƑƏƏƖœ

$ƐĹov1ub|;ubov7;ub;v]ov;0-v-m;mѴovo0f;ঞˆov7;Ѵ-ou]-mbŒ-1bॕm‹;m;Ѵ1om|;Š|o
;Š|;umo;bm|;umoĺ

$ƑĹov1ub|;ubov7;ub;v]ov;r†;7;o0|;m;u7;moul-vķѴ;‹;vķroѴझঞ1-v‹o|uovu;t†bvb|ovĺ

3.74 Evaluación del Riesgo

ProcesoŐƒĺѵƐő7;1olr-u-1bॕm7;Ѵovu;v†Ѵ|-7ov7;Ѵ-m࢙Ѵbvbv7;ub;v]oŐƒĺƕƏő1omѴovcriterios de
riesgoŐƒĺƕƒőr-u-7;|;ulbm-uvb;ѴriesgoŐƒĺѵѶő‹ņov†l-]mb|†7vom-1;r|-0Ѵ;vo|oѴ;u-0Ѵ;vĺ

Œ†झ-"ƕƒĹƑƏƏƖœ

NOTA:-;ˆ-Ѵ†-1bॕm7;Ѵub;v]o-‹†7--Ѵ-|ol-7;7;1bvbom;vvo0u;;Ѵtratamiento del riesgoŐƒĺƕƖőĺ

ƒĺƕƔ7;mঞC1-1bॕm7;Ѵ!b;v]o
uo1;vot†;1olru;m7;Ѵ-0িvt†;7-ķ;Ѵu;1omo1blb;m|o‹Ѵ-7;v1ubr1bॕm7;Ѵovriesgos ŐƒĺѵѶőĺ

Œ†झ-"ƕƒĹƑƏƏƖœ

$ƐĹ-b7;mঞC1-1bॕm7;Ѵub;v]oblrѴb1-Ѵ-b7;mঞC1-1bॕm7;Ѵ-v=†;m|;v7;ub;v]ovķѴovv†1;vovķ
v†v1-†v-v‹v†v1omv;1†;m1b-vro|;m1b-Ѵ;vĺ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

$ ƑĹ - b7;mঞC1-1bॕm 7;Ѵ ub;v]o r†;7; blrѴb1-u 7-|ov _bv|ॕub1ovķ -m࢙Ѵbvbv |;ॕub1ovķ orbmbom;v
bm=oul-7-v‹7;;Šr;u|ovķ-vझ1olom;1;vb7-7;v7;ѴѴ-vr-u|;vbm|;u;v-7-vĺ

ƒĺƕѵ;vঞॕm7;Ѵ!b;v]o
1ঞˆb7-7;v1oou7bm-7-vr-u-7bub]bu‹1om|uoѴ-u†m-ou]-mbŒ-1bॕmŐƒĺƔƕő;mѴou;Ѵ-ঞˆo-Ѵub;v]oŐƒĺѵѶőĺ

Œ†झ-"ƕƒĹƑƏƏƖœ
ƒĺƕƕuo1;vo7;;vঞॕm7;Ѵ!b;v]o
rѴb1-1bॕm vbv|;l࢙ঞ1- 7; roѴझঞ1-vķ ruo1;7blb;m|ov ‹ ru࢙1ঞ1-v 7; ];vঞॕm - Ѵ-v -1ঞˆb7-7;v 7;
1ol†mb1-1bॕmķ 1omv†Ѵ|-ķ ;v|-0Ѵ;1blb;m|o 7;Ѵ 1om|;Š|oķ ; b7;mঞC1-1bॕmķ -m࢙Ѵbvbvķ ;ˆ-Ѵ†-1bॕm,
|u-|-lb;m|oķv;]†blb;m|o‹u;ˆbvbॕm7;ѴriesgoŐƒĺѵѶőĺ

Œ†झ-"ƕƒĹƑƏƏƖœ
$Ĺ-oul-"ņ ƑƕƏƏƔ†ঞѴbŒ-;Ѵ|࣐ulbmoľruo1;voĿr-u-7;v1ub0buѴ-];vঞॕmbm|;]u-Ѵ7;Ѵ
ub;v]oĺov;Ѵ;l;m|ov7;m|uo7;Ѵruo1;vo7;];vঞॕm7;Ѵub;v]ov;7;molbm-mľ-1ঞˆb7-7;vĿĺ

73
 3.78 Dueño del Riesgo
;uvom-o;mঞ7-7t†;ঞ;m;Ѵ-u;vromv-0bѴb7-7‹-†|oub7-7r-u-];vঞom-u†mub;v]oŐƒĺѵѶőĺ

Œ†झ-"ƕƒĹƑƏƏƖœ

3.79 Tratamiento del Riesgo

uo1;voŐƒĺѵƐő7;vঞm-7o-lo7bC1-u;Ѵub;v]oŐƒĺѵѶőĺ

Œ†झ-"ƕƒĹƑƏƏƖœ

$ƐĹ Ѵ|u-|-lb;m|o7;Ѵub;v]or†;7;blrѴb1-uĹ

վ ˆb|-u;Ѵub;v]oķ7;1b7b;m7omobmb1b-uo1om|bm†-u1omѴ--1|bˆb7-7t†;lo|bˆ-;Ѵub;v]oĺ
վ 1;r|-uo-†l;m|-u;Ѵub;v]o1om;Ѵo0f;|o7;0†v1-u†m-orou|†mb7-7ĺ
վ Ѵblbm-uѴ-=†;m|;7;ub;v]oĺ
վ -l0b-uѴ-ruo0-0bѴb7-7ĺ
վ -l0b-uѴ-v1omv;1†;m1b-vĺ
վ olr-u|bu;Ѵub;v]o1omo|u-†o|u-vr-u|;vŐbm1Ѵ†‹;m7oѴov1om|u-|ov‹Ѵ-=bm-m1b-1bॕm7;Ѵub;v]oőĺ
վ -m|;m;u;Ѵub;v]o;m0-v;-†m-7;1bvbॕmbm=oul-7-ĺ

$ ƑĹ ov |u-|-lb;m|ov 7;Ѵ ub;v]o t†; 1om7†1;m - 1omv;1†;m1b-v m;]-ঞˆ-vķ ;m o1-vbom;v v;
1b|-m1oloľlbঞ]-1bॕm7;Ѵub;v]oĿķľ;Ѵblbm-1bॕm7;Ѵub;v]oĿķľru;ˆ;m1bॕm7;Ѵub;v]oĿ‹ľu;7†11bॕm7;Ѵ
ub;v]oĿĺ

$ƒĹ Ѵ|u-|-lb;m|o7;Ѵub;v]or†;7;oub]bm-um†;ˆovub;v]ovolo7bC1-uѴovub;v]ov;Šbv|;m|;vĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

3.80 Escala
omf†m|oou7;m-7o7;ˆ-Ѵou;vķ1omঞm†oo7bv1u;|oķo†m1omf†m|o7;1-|;]ouझ-v-Ѵ-vt†;v;-vb]m-
el atributoŐƒĺƓőĺ

Œ"ņ ƐƔƖƒƖĹƑƏƏƕœ
$Ĺ Ѵ ঞro 7; ;v1-Ѵ- 7;r;m7; 7; Ѵ- m-|†u-Ѵ;Œ- 7; Ѵ- u;Ѵ-1bॕm ;m|u; Ѵov ˆ-Ѵou;v 7; Ѵ- ;v1-Ѵ-ĺ
olিml;m|;v;b7;mঞC1-m1†-|uoঞrov7;;v1-Ѵ-Ĺ

1. olbm-ѴĹovˆ-Ѵou;v7;l;7b1bॕmvom1-|;]ouझ-vĺ
2. u7bm-ѴĹovˆ-Ѵou;v7;l;7b1bॕmvom1-|;]ouझ-vou7;m-7-vĺ
3. m|;uˆ-ѴoĹovˆ-Ѵou;v7;Ѵ-vl;7b1bom;vv;-f†v|-m-u-m]ov7;ˆ-Ѵou;v1†-m|b|-|bˆov7;Ѵ-|ub0†|oĺ
4. uorou1bॕmĹovˆ-Ѵou;v7;Ѵ-vl;7b1bom;vvomu;Ѵ-|bˆov‹ruorou1bom-Ѵ;v-Ѵˆ-Ѵou7;o|uo-|ub0†|oĸ
1ouu;vrom7b;m7o;Ѵˆ-Ѵou1;uo-Ѵˆ-Ѵou1;uo7;Ѵ-|ub0†|oĺ

v|ovvomvoѴo;f;lrѴov7;ঞrov7;;v1-Ѵ-ĺ

74
3.81 Norma de Implementación de la Seguridad
o1†l;m|ot†;;vr;1bC1-Ѵ-v=oul-v-†|oubŒ-7-vr-u-v-ঞv=-1;uѴ-vm;1;vb7-7;v7;v;]†ub7-7ĺ

3.82 Parte Interesada

;uvom- † ou]-mbŒ-1bॕm t†; r†;7; -=;1|-uķ ;v|-u -=;1|-7-ķ o r;u1b0bu t†; ;v|࢙ -=;1|-7- rou †m-
7;1bvbॕmo-1ঞˆb7-7ĺ

Œ"ņ ƕƒĹƑƏƏƖœ
3.83 Amenaza
-†v-ro|;m1b-Ѵ7;†mbm1b7;m|;mo7;v;-7oķ;Ѵ1†-Ѵr†;7;o1-vbom-u7-ोo-†mvbv|;l-o-†m-
ou]-mbŒ-1bॕmĺ
3.84 Alta Dirección
;uvom-o]u†ro7;r;uvom-vt†;7bub];m‹1om|uoѴ-m†m-ou]-mbŒ-1bॕmŐƒĺƔƕő-Ѵl࢙v-Ѵ|ombˆ;Ѵĺ

$ƐĹ--Ѵ|-7bu;11bॕmঞ;m;;Ѵro7;ur-u-7;Ѵ;]-u-†|oub7-7‹ruorou1bom-uu;1†uvov7;m|uo7;
Ѵ-ou]-mbŒ-1bॕmĺ

$ƑĹ"b;Ѵ-Ѵ1-m1;7;Ѵvbv|;l-7;];vঞॕmŐƒĺƓѵő1olru;m7;voѴo†m-r-u|;7;†m-ou]-mbŒ-1bॕmķ
;m|om1;vľ-Ѵ|-7bu;11bॕmĿv;u;C;u;-t†b;m;v7bub];m‹1om|uoѴ-m;v-r-u|;7;Ѵ-ou]-mbŒ-1bॕmĺ

ƒĺѶƔ mঞ7-77;omC-mŒ-r-u-Ѵ-ol†mb1-1bॕm7;Ѵ-m=oul-1bॕm
u]-mbŒ-1bॕmbm7;r;m7b;m|;t†;v†v|;m|-;Ѵbm|;u1-l0bo7;bm=oul-1bॕm7;m|uo7;†m1oѴ;1ঞˆot†;
1olr-u|;bm=oul-1bॕmĺ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

3.86 Unidad de Medida
-mঞ7-71om1u;|-ķ7;Cmb7-‹-7or|-7-rou1omˆ;mboķ1omѴ-1†-Ѵv;1olr-u-mo|u-v1-mঞ7-7;v7;
Ѵ-lbvl-m-|†u-Ѵ;Œ--Cm7;;Šru;v-uv†l-]mb|†7;mu;Ѵ-1bॕm-7b1_-1-mঞ7-7ĺ

Œ"ņ ƐƔƖƒƖĹƑƏƏƕœ

3.87 Validación
omCul-1bॕml;7b-m|;Ѵ--rou|-1bॕm7;;ˆb7;m1b-o0f;ঞˆ-7;t†;v;_-m1†lrѴb7oѴovu;t†bvb|ov
r-u-†m-†ঞѴbŒ-1bॕmo-rѴb1-1bॕm;vr;1झC1-ru;ˆbv|-ĺ

Œ"ņ ƖƏƏƏĹƑƏƏƔœ

75
 ƒĺѶѶ(;ubC1-1bॕm
omCul-1bॕml;7b-m|;Ѵ--rou|-1bॕm7;;ˆb7;m1b-o0f;ঞˆ-7;t†;v;_-m1†lrѴb7oѴovu;t†bvb|ov
;vr;1bC1-7ovĺ

Œ"ņ ƖƏƏƏĹƑƏƏƔœ

$Ĺ$-l0b࣐mro7uझ-ѴѴ-l-uv;ru†;0-7;1om=oulb7-7ĺ

3.89 Vulnerabilidad
;0bѴb7-77;†m-1ঞˆoo7;†mcontrolŐƒĺƐѵőt†;r†;7;v;u;ŠrѴo|-7-rou†m-ol࢙vamenazas
ŐƒĺѶƒőĺ

3.90 Información
†-Ѵt†b;u=oul-7;u;]bv|uo;Ѵ;1|uॕmb1oķ ॕrঞ1oķl-]m࣐ঞ1oo;mo|uovl;7bovķv†v1;rঞ0Ѵ;7;v;u
ruo1;v-7-ķ7bv|ub0†b7-‹-Ѵl-1;m-7-ĺ

ƒĺƖƐ1ঞˆo
Ѵ]o7;ˆ-Ѵour-u-Ѵ-ou]-mbŒ-1bॕmķ‹-v;-|-m]b0Ѵ;obm|-m]b0Ѵ;ķt†;;vm;1;v-uboruo|;];uķbm1Ѵ†‹;m7o
r;uvom-Ѵķ_-u7‰-u;ķvo[‰-u;ķv;uˆb1bovķbm=u-;v|u†1|†u-ķ7o1†l;m|ovķ7-|ov;m|u;o|uovĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

76
 Modulo de Auditoría ISO 19011

77
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)
 ISO 19011:2018

v|-moul-ruorou1bom-†m-]†झ-r-u-|o7ovѴov
|-l-ोov‹ ঞrov 7; ou]-mbŒ-1bom;v‹ -†7b|ouझ-v
7; 7b=;u;m|;v -Ѵ1-m1;v ‹ ;v1-Ѵ-vķ bm1Ѵ†b7-v -t†;ѴѴ-v
u;-ѴbŒ-7-v rou ]u-m7;v ;t†brov 7; -†7b|ouझ-ķ
];m;u-Ѵl;m|;7;ou]-mbŒ-1bom;vl࢙v]u-m7;vķ‹
-t†;ѴѴ-vu;-ѴbŒ-7-vrou-†7b|ou;vbm7bˆb7†-Ѵ;vķ‹-
v;-;mou]-mbŒ-1bom;v]u-m7;vor;t†;ो-vĺ v|-
oub;m|-1bॕm7;0;uझ--7-r|-uv;v;]িm1ouu;vrom7- al
-Ѵ1-m1;ķѴ-1olrѴ;fb7-7‹Ѵ-;v1-Ѵ-7;Ѵruo]u-l-
7;-†7b|ouझ-ĺ

Estructura de la ISO 19011:2018

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

u;=-1boĺ
m|uo7†11bॕmĺ
1. Ѵ1-m1;ĺ
2. !;=;u;m1b-vmoul-|bˆ-vĺ
3. $࣐ulbmov‹7;=bmb1bom;vĺ
4. ubm1brbov7;-†7b|ouझ-ĺ
5. 7lbmbv|u-u7;†mruo]u-l-7;-†7b|ouझ-ĺ
6. !;-ѴbŒ-1bॕm7;†m--†7b|ouझ-ĺ
7. olr;|;m1b-‹;ˆ-Ѵ†-1bॕm7;Ѵov-†7b|ou;vĺ
m;Šoĺ
b0Ѵbo]u-ࣱ-ĺ

78
Alcance ISO 19011:2018

v|; 7o1†l;m|o ruorou1bom- oub;m|-1bॕm vo0u; -†7b|ouझ- - vbv|;l-v 7; ];vঞॕmķ bm1Ѵ†b7ov Ѵov
rubm1brbov 7; -†7b|ouझ-ķ Ѵ- ];vঞॕm 7; †m ruo]u-l- 7; -†7b|ouझ-‹ Ѵ- u;-ѴbŒ-1bॕm 7; -†7b|ouझ-v 7;Ѵ
vbv|;l- 7; ];vঞॕmķ -vझ 1olo oub;m|-1bॕm vo0u; Ѵ- ;ˆ-Ѵ†-1bॕm 7; Ѵ- 1olr;|;m1b- 7; Ѵ-v r;uvom-v
bmˆoѴ†1u-7-v;m;Ѵruo1;vo7;-†7b|ouझ-ĺ

v|-v-1ঞˆb7-7;vbm1Ѵ†‹;mѴ-vr;uvom-vt†;-7lbmbv|u-m;Ѵruo]u-l-7;-†7b|ouझ-ķѴov-†7b|ou;v‹Ѵov
;t†brov7;-†7b|ouझ-ĺ

v-rѴb1-0Ѵ;-|o7-vѴ-vou]-mbŒ-1bom;vt†;m;1;vb|-mrѴ-mbC1-u‹ѴѴ;ˆ-u1-0o-†7b|ouझ-vbm|;um-vo
;Š|;um-v7;Ѵovvbv|;l-v7;];vঞॕmo-7lbmbv|u-u†mruo]u-l-7;-†7b|ouझ-ĺ

--rѴb1-1bॕm7;;v|;7o1†l;m|o-o|uovঞrov7;-†7b|ouझ-v;vrovb0Ѵ;ķvb;lru;t†;v;o|ou]†;†m-
1omvb7;u-1bॕm;vr;1b-Ѵ-Ѵ-1olr;|;m1b-;vr;1झC1-m;1;v-ub-ĺ

Auditoría
uo1;vo vbv|;l࢙ঞ1oķ bm7;r;m7b;m|;‹ 7o1†l;m|-7o r-u- o0|;m;u ;ˆb7;m1b- o0f;ঞˆ-‹ ;ˆ-Ѵ†-uѴ-
o0f;ঞˆ-l;m|;r-u-7;|;ulbm-u;mt†࣐l;7b7-v;1†lrѴ;mѴov1ub|;ubov7;-†7b|ouझ-ĺ

Nota 1:Ѵ-v-†7b|ouझ-vbm|;um-vķ-ˆ;1;vѴѴ-l-7-v-†7b|ouझ-v7;rubl;u-r-u|;ķvomu;-ѴbŒ-7-vrouķo;m
mol0u;7;ķѴ-ou]-mbŒ-1bॕmlbvl-ĺ

Nota 2:-v-†7b|ouझ-v;Š|;um-vbm1Ѵ†‹;m-t†;ѴѴ-v];m;u-Ѵl;m|;ѴѴ-l-7-v-†7b|ouझ-v7;v;]†m7-‹
|;u1;u-r-u|;ĺ-v-†7b|ouझ-v7;v;]†m7-r-u|;v;ѴѴ;ˆ-m-1-0orouѴ-vr-u|;vt†;ঞ;m;m†mbm|;u࣐v
;mѴ-ou]-mbŒ-1bॕmķ1oloѴov1Ѵb;m|;vķorouo|u-vr;uvom-v;mv†mol0u;ĺ-v-†7b|ouझ-v7;|;u1;u-

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

r-u|; vom ѴѴ;ˆ-7-v - 1-0o rou ou]-mbŒ-1bom;v 7; -†7b|ouझ- bm7;r;m7b;m|;vķ 1olo -t†;ѴѴ-v t†;
ruorou1bom-m1;uঞC1-1bॕmņu;]bv|uo7;1om=oulb7-7o-];m1b-v]†0;um-l;m|-Ѵ;vĺ

Tipos de Auditoría

79
 ĺ Auditorías internas :-ˆ;1;vѴѴ-l-7-v-†7b|ouझ-v7;rubl;u-r-u|;ķvomu;-ѴbŒ-7-vrouķo;mmol0u;
7;ķѴ-ou]-mbŒ-1bॕmlbvl-ĺ

ĺ Auditorías externasbm1Ѵ†‹;m-t†;ѴѴ-v];m;u-Ѵl;m|;ѴѴ-l-7-v-†7b|ouझ-v7;v;]†m7-‹|;u1;u-r-u|;ĺ

Ɛĺ Auditorías de segunda partev;ѴѴ;ˆ-m-1-0orouѴ-vr-u|;vt†;ঞ;m;m†mbm|;u࣐v;mѴ-ou]-mbŒ-1bॕmķ

1oloѴov1Ѵb;m|;vķorouo|u-vr;uvom-v;mv†mol0u;ĺ

ƑĺAuditorías de tercera partevomѴѴ;ˆ-7-v-1-0orouou]-mbŒ-1bom;v7;-†7b|ouझ-bm7;r;m7b;m|;vķ

1olo-t†;ѴѴ-vt†;ruorou1bom-m1;uঞC1-1bॕmņu;]bv|uo7;1om=oulb7-7o-];m1b-v]†0;um-l;m|-Ѵ;vĺ

Criterios de Auditoría
omf†m|o7;u;t†bvb|ov†ঞѴbŒ-7ov1olou;=;u;m1b-1omu;vr;1|o-Ѵov1†-Ѵ;vv;1olr-u-Ѵ-;ˆb7;m1b-
o0f;ঞˆ-ĺ

Nota 1: "bѴov1ub|;ubov7;-†7b|ouझ-vomѴ;]-Ѵ;vŐbm1Ѵ†b7ovѴovu;t†bvb|ovѴ;]-Ѵ;vou;]Ѵ-l;m|-ubovőķѴ-v
r-Ѵ-0u-vľ1†lrѴblb;m|oĿoľbm1†lrѴblb;m|oĿ-l;m†7ov;†ঞѴbŒ-m;m†m-1om1Ѵ†vbॕm7;-†7b|ouझ-

Nota 2Ĺovu;t†bvb|ovr†;7;mbm1Ѵ†buroѴझঞ1-vķruo1;7blb;m|ovķbmv|u†11bom;v7;|u-0-foķu;t†bvb|ov
Ѵ;]-Ѵ;vķo0Ѵb]-1bom;v1om|u-1|†-Ѵ;vķ;|1ĺĺ

Evidencia de la Auditoría
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

-;ˆb7;m1b-o0f;ঞˆ-vomѴov7-|ovt†; respaldan
Ѵ-;Šbv|;m1b-oѴ-ˆ;u7-77;-Ѵ]oĺ

Nota 1: -;ˆb7;m1b-o0f;ঞˆ-v;r†;7;o0|;m;u
-|u-ˆ࣐v7;o0v;uˆ-1bॕmķl;7b1bॕmķru†;0-orou
o|uovl;7bovĺ

Nota 2:-;ˆb7;m1b-o0f;ঞˆ-r-u-;Ѵruorॕvb|o
7;Ѵ--†7b|ouझ-];m;u-Ѵl;m|;1omvbv|;;mu;]bv|uovķ
7;1Ѵ-u-1bom;v7;_;1_ov†o|u-bm=oul-1bॕmt†;
vomu;Ѵ;ˆ-m|;vr-u-Ѵov1ub|;ubov7;-†7b|ouझ-‹
ˆ;ubC1-0Ѵ;vĺ

80
Resultados de la Auditoría

ovu;v†Ѵ|-7ov7;Ѵ-;ˆ-Ѵ†-1bॕm7;Ѵ-;ˆb7;m1b-7;-†7b|ouझ-u;1orbѴ-7-1om|u-Ѵov1ub|;ubov7;-†7b|ouझ-ĺ

Nota 1: ov_-ѴѴ-Œ]ov7;Ѵ--†7b|ouझ-bm7b1-m1om=oulb7-7omo1om=oulb7-7ĺ

Nota 2:ov_-ѴѴ-Œ]ov7;Ѵ--†7b|ouझ-r†;7;m1om7†1bu-Ѵ-b7;mঞC1-1bॕm7;ub;v]ovķorou|†mb7-7;v
7;l;fou-ou;]bv|uo7;0†;m-vru࢙1ঞ1-vĺ

Nota 3Ĺ ;m bm]Ѵ࣐vķvbѴov 1ub|;ubov7; -†7b|ouझ-v; v;Ѵ;11bom-m7; ;m|u;Ѵov u;t†bvb|ovѴ;]-Ѵ;voѴov

u;t†bvb|ovu;]Ѵ-l;m|-ubovķ;Ѵ_-ѴѴ-Œ]o7;Ѵ--†7b|ouझ-v;7;molbm-1†lrѴblb;m|oobm1†lrѴblb;m|oĺ

վ -ѴѴ-Œ]o7;1†lrѴblb;m|oĺ
վ !;t†bvb|ovŐmoul-ķѴ;]-Ѵķu;]Ѵ-l;m|-uboķ1om|u-1|†-Ѵőĺ
վ Ѵ;Ѵ;l;m|ov;-f†v|--Ѵ-;Šb];m1b-ĺ
վ -blrѴ-m|-1bॕm1ouu;vrom7;-Ѵ-bm|;m1bॕmĺ
վ -blrѴ-m|-1bॕm;v;=b1-Œĺ

;fou;vru࢙1ঞ1-vĹ

վ (;ub=b1-uѴov_;1_ovˆ;u0-Ѵ;vĺ
վ ;=bmbuѴ-m-|†u-Ѵ;Œ-7;Ѵ-mo1om=oulb7-71om;Ѵ-†7b|-7oķ7;|-ѴѴ-m7oѴ-;ˆb7;m1b-7;-†7b|ouझ-ĺ
վ $ol-umo|-v‹1omv†Ѵ|-uѴ-vrov|;uboul;m|;r-u-u;-ѴbŒ-u;Ѵu;rou|;ĺ
վ -1;u†m0ovt†;fo7;Ѵu;rou|;7;_-ѴѴ-Œ]ov7†u-m|;Ѵ-|ol-7;bm=oul-1bॕmĺ
վ Ѵ=bm-ѴbŒ-u1-7-foum-7-|;ulbm-u;mѴ-u;ˆbvbॕmrubˆ-7-ĺ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

Conclusiones de la Auditoría
!;v†Ѵ|-7o7;†m--†7b|ouझ-7;vr†࣐v7;considerar
Ѵovo0f;ঞˆov7;-†7b|ouझ-‹|o7ovѴovu;v†Ѵ|-7ov
Ő_-ѴѴ-Œ]ovő7;-†7b|ouझ-ĺ

81
 Cliente de la Auditoría

u]-mbŒ-1bॕmor;uvom-t†;voѴb1b|-†m--†7b|ouझ-ĺ

Nota 1:;m;Ѵ1-vo7;Ѵ--†7b|ouझ-bm|;um-ķ;Ѵ1Ѵb;m|;7;-†7b|ouझ-|-l0b࣐mr†;7;v;u;Ѵ-†7b|-7oo
Ѵ-r;uvom-Ővőt†;-7lbmbv|u-;Ѵruo]u-l-7;-†7b|ouझ-ĺ-vvoѴb1b|†7;v7;-†7b|ouझ-;Š|;um-r†;7;m
ruoˆ;mbu7;=†;m|;v|-Ѵ;v1olou;]†Ѵ-7ou;vķr-u|;v1om|u-|-m|;vo1Ѵb;m|;vro|;m1b-Ѵ;vo;Šbv|;m|;vĺ

Auditado

u]-mbŒ-1bॕm;mv†|o|-Ѵb7-7or-u|;v7;;ѴѴ-vb;m7o-†7b|-7-ĺ

Auditor
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

;uvom-t†;u;-ѴbŒ-†m--†7b|ouझ-ĺ

82
Equipo Auditor

&m-ol࢙vr;uvom-vt†;u;-ѴbŒ-m†m--†7b|ouझ-ķ-ro‹-7-vvb;vm;1;v-uborou;Šr;u|ov|࣐1mb1ov

o|-ƐĹ&m-†7b|ou7;Ѵ;t†bro7;-†7b|ouझ-;v7;vb]m-7o1olo;ѴѴझ7;u7;Ѵ;t†bro7;-†7b|ouझ-ĺ

o|-ƑĹ Ѵ;t†bro7;-†7b|ouझ-r†;7;bm1Ѵ†bu-†7b|ou;v;m1-r-1b|-1bॕmĺ

Experto Técnico

;uvom-t†;ruorou1bom-1omo1blb;m|ovo;Šr;ub;m1b-;vr;1झC1ov-Ѵ;t†bro7;-†7b|ouझ-ĺ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

o|-ƐĹ;Ѵ1omo1blb;m|o;vr;1झC1oo;Šr;ub;m1b-v;u;Ѵ-1bom-1omѴ-ou]-mbŒ-1bॕmķѴ--1ঞˆb7-7ķ;Ѵ
ruo1;voķ;Ѵruo7†1|oķ;Ѵv;uˆb1boķѴ-7bv1brѴbm-t†;v;-†7b|-u࢙ķ;Ѵb7bol-oѴ-1†Ѵ|†u-ĺ

o|-ƑĹ&m;Šr;u|o|࣐1mb1o7;Ѵ;t†bro7;-†7b|ouझ-mo-1|ি-1olo-†7b|ouĺ

Observador

m7bˆb7†ot†;-1olr-ो--Ѵ;t†bro7;-†7b|ouझ-r;uot†;mo-1|ি-1olo-†7b|ouĺ

83
 Guía Programa de Auditoría

;uvom-7;vb]m-7-rou;Ѵ-†7b|-7or-u--vbvঞu-Ѵ omf†m|o 7; †m- o l࢙v -†7b|ouझ-v rѴ-mbC1-7-v

;t†bro-†7b|ouĺ r-u-†mr;ubo7o7;ঞ;lro7;|;ulbm-7o‹7bub]b7-v
_-1b-†mruorॕvb|o;vr;1झC1oĺ

Alcance de la Auditoría
Ѵ1-m1;7;-†7b|ouझ-v;u;C;u;-Ѵ-Ѵ1-m1;‹Ѵझlb|;v7;†m--†7b|ouझ-ĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

Ѵ-Ѵ1-m1;7;Ѵ--†7b|ouझ-];m;u-Ѵl;m|;bm1Ѵ†‹;†m-7;v1ubr1bॕm7;Ѵ-v†0b1-1bom;vࣱvb1-v‹ˆbu|†-Ѵ;vķ
=†m1bom;vķ†mb7-7;vou]-mbŒ-ঞˆ-vķ-1ঞˆb7-7;v‹ruo1;vovķ-vझ1olo;Ѵr;uझo7o7;ঞ;lro1†0b;u|oĺ

&m-†0b1-1bॕmˆbu|†-Ѵ;v1†-m7o†m-ou]-mbŒ-1bॕmu;-ѴbŒ-†m|u-0-fooruorou1bom-†mv;uˆb1bo†v-m7o
†m;m|oumo;mѴझm;-t†;r;ulb|;-Ѵ-vr;uvom-vķbm7;r;m7b;m|;l;m|;7;Ѵ-v†0b1-1bom;vࣱvb1-vķ;f;1†|-u
ruo1;vovĺ

84
Plan de Auditoría

;v1ubr1bॕm7;Ѵ-v-1ঞˆb7-7;v‹Ѵov-uu;]Ѵovr-u-†m--†7b|ouझ-ĺ

Conformidad No Conformidad
†lrѴblb;m|o7;†mu;t†bvb|oĺ m1†lrѴblb;m|o7;†mu;t†bvb|oĺ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

Pruebas de Auditoría
!;]bv|uovķ 7;1Ѵ-u-1bom;v 7; _;1_ov † o|u- bm=oul-1bॕmķ t†; v;-m u;Ѵ;ˆ-m|;v r-u- Ѵov 1ub|;ubov 7;
-†7b|ouझ-‹ˆ;ubC1-0Ѵ;vĺ

85
 ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

86
Métodos de Auditoría
Cláusula 4: Principios de Auditoría

1.m|;]ub7-7ĹѴ-0-v;7;Ѵruo=;vbom-Ѵbvloĺ
2.u;v;m|-1bॕmf†v|-ĹѴ-o0Ѵb]-1bॕm7;bm=oul-uˆ;u-Œ‹;Š-1|-l;m|;ĺ
3. ;0b7o1†b7-7oruo=;vbom-ѴĹѴ--rѴb1-1bॕm7;Ѵ-7bѴb];m1b-‹;Ѵf†b1bo;mѴ--†7b|ouझ-ĺ
4.om=b7;m1b-Ѵb7-7Ĺv;]†ub7-77;Ѵ-bm=oul-1bॕmĺ
5.m7;r;m7;m1b-ĹѴ-0-v;r-u-Ѵ-blr-u1b-Ѵb7-77;Ѵ--†7b|ouझ-‹Ѵ-o0f;|bˆb7-77;Ѵ-v1om1Ѵ†vbom;v7;
Ѵ--†7b|ouझ-ĺ
6. m=ot†;0-v-7o;mѴ-;ˆb7;m1b-Ĺ;Ѵl࣐|o7ou-1bom-Ѵr-u-ѴѴ;]-u-1om1Ѵ†vbom;v7;-†7b|ouझ-=b-0Ѵ;v
‹u;ruo7†1b0Ѵ;v;m†mruo1;vo7;-†7b|ouझ-vbv|;l࢙|b1oĺ
7. m=ot†;0-v-7o;m;Ѵub;v]oņm;m=ot†;7;-†7b|ouझ-t†;1omvb7;u-ub;v]ov‹orou|†mb7-7;vĺ

Integridad: la base del profesionalismo.

ov-†7b|ou;v‹Ѵ-Ővőr;uvom-Ővőt†;-7lbmbv|u-m†mruo]u-l-7;-†7b|ouझ-7;0;uझ-mĹ

ĺ !;-ѴbŒ-uv†|u-0-fo7;=oul-࣐|b1-ķ1om_om;v|b7-7‹u;vromv-0bѴb7-7ĺ
ĺ "oѴou;-ѴbŒ-u-1|bˆb7-7;v7;-†7b|ouझ-vb;v1olr;|;m|;r-u-_-1;uѴoĺ
ĺ !;-ѴbŒ-uv†|u-0-fo7;l-m;u-blr-u1b-Ѵķ;v7;1buķv;]†buvb;m7of†v|o;blr-u1b-Ѵ;m|o7ovv†v|u-|ovĺ
ĺ ";u v;mvb0Ѵ; - 1†-Ѵt†b;u bm=Ѵ†;m1b- t†; r†;7- ;f;u1;u vo0u; v† f†b1bo lb;m|u-v ѴѴ;ˆ- - 1-0o †m-
-†7b|ouझ-ĺ

Presentación justa: la obligación de informar veraz y exactamente.

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

ov _-ѴѴ-Œ]ov 7; Ѵ- -†7b|ouझ-ķ Ѵ-v 1om1Ѵ†vbom;v 7; -†7b|ouझ- ‹ Ѵov bm=oul;v 7; -†7b|ouझ- 7;0;uझ-m
u;Y;f-u7;l-m;u-ˆ;u-Œ‹ru;1bv-Ѵ-v-1ঞˆb7-7;v7;-†7b|ouझ-ĺ";7;0;uझ-mbm=oul-uѴovo0v|࢙1†Ѵov
vb]mbC1-ঞˆov ;m1om|u-7ov 7†u-m|; Ѵ- -†7b|ouझ- ‹ Ѵ-v orbmbom;v 7bˆ;u];m|;v mo u;v†;Ѵ|-v ;m|u; ;Ѵ
;t†bro7;-†7b|ouझ-‹;Ѵ-†7b|-7oĺ-1ol†mb1-1bॕm7;0;uझ-v;uˆ;u-Œķru;1bv-ķo0f;ঞˆ-ķorou|†m-ķ
1Ѵ-u-‹1olrѴ;|-ĺ

Debido cuidado profesional: la aplicación de la diligencia y el juicio en la auditoría

ov-†7b|ou;v7;0;uझ-m|;m;u;Ѵ7;0b7o1†b7-7o7;-1†;u7o1omѴ-blrou|-m1b-7;Ѵ-|-u;-t†;u;-ѴbŒ-m
‹Ѵ-1omC-mŒ-7;rovb|-7-;m;ѴѴovrou;Ѵ1Ѵb;m|;7;-†7b|ouझ-‹o|u-vr-u|;vbm|;u;v-7-vĺ&m=-1|ou
blrou|-m|;r-u-ѴѴ;ˆ-u-1-0ov†|u-0-fo1omѴ-7;0b7--|;m1bॕmruo=;vbom-Ѵ;v|;m;uѴ-1-r-1b7-77;
;lbঞuf†b1bovu-Œom-7ov;m|o7-vѴ-vvb|†-1bom;v7;-†7b|ouझ-ĺ

87
 omC7;m1b-Ѵb7-7Ĺv;]†ub7-77;Ѵ-bm=oul-1bॕmĺ

ov-†7b|ou;v7;0;uझ-m;f;u1;u7bv1u;1bॕm;m;Ѵ†vo‹Ѵ-ruo|;11bॕm7;Ѵ-bm=oul-1bॕm-7t†bub7-
en ;Ѵ7;v;lr;ोo7;v†v=†m1bom;vĺ-bm=oul-1bॕm7;-†7b|ouझ-mo7;0;uझ-v;u†ঞѴbŒ-7-7; manera
bm-ruorb-7- r-u- 0;m;C1bo r;uvom-Ѵ rou ;Ѵ -†7b|ou o ;Ѵ 1Ѵb;m|; 7; -†7b|ouझ-ķ o 7; †m- l-m;u-
r;uf†7b1b-Ѵr-u-Ѵovbm|;u;v;vѴ;]झঞlov7;Ѵ-†7b|-7oĺ v|;1om1;r|obm1Ѵ†‹;;Ѵl-m;fo-7;1†-7o7;
bm=oul-1bॕmv;mvb0Ѵ;o1omC7;m1b-Ѵĺ

m7;r;m7;m1b-ĹѴ-0-v;r-u-Ѵ-blr-u1b-Ѵb7-77;Ѵ--†7b|ouझ-‹Ѵ-o0f;ঞˆb7-77;Ѵ-v1om1Ѵ†vbom;v7;Ѵ-
auditoría.

ov-†7b|ou;v7;0;uझ-mv;ubm7;r;m7b;m|;v7;Ѵ--1ঞˆb7-7-†7b|-7-vb;lru;t†;v;-rovb0Ѵ;‹ķ;m
|o7ovѴov1-vovķ7;0;uझ-m-1|†-u7;=oul-|-Ѵt†;mo;v|࣐mv†f;|ov-ru;f†b1bovmb-1omYb1|ov7;
bm|;u;v;vĺ-u-Ѵ-v-†7b|ouझ-vbm|;um-vķѴov-†7b|ou;v7;0;uझ-mv;ubm7;r;m7b;m|;v7;Ѵ-=†m1bॕmt†;
v; ;v|࢙ -†7b|-m7oķ vb ;v rovb0Ѵ;ĺ ov -†7b|ou;v 7;0;uझ-m l-m|;m;u Ѵ- o0f;ঞˆb7-7 7†u-m|; |o7o ;Ѵ
ruo1;vo7;-†7b|ouझ-r-u-]-u-mঞŒ-ut†;Ѵov_-ѴѴ-Œ]ov‹1om1Ѵ†vbom;v7;Ѵ--†7b|ouझ-v;0-v;mvoѴo
;mѴ-;ˆb7;m1b-7;-†7b|ouझ-ĺ

-u-Ѵ-vou]-mbŒ-1bom;vr;t†;ो-vķr†;7;t†;Ѵov-†7b|ou;vbm|;umovmov;-m|o|-Ѵl;m|; independientes
7;Ѵ--1ঞˆb7-7t†;v;-†7b|-ķr;uov;7;0;uझ-m_-1;u|o7ovѴov;v=†;uŒovr-u-;Ѵblbm-u;Ѵv;v]o‹
-Ѵ;m|-uѴ-o0f;ঞˆb7-7ĺ

m=ot†;0-v-7o;mѴ-;ˆb7;m1b-Ĺ;Ѵl࣐|o7ou-1bom-Ѵr-u-ѴѴ;]-u-1om1Ѵ†vbom;v7;-†7b|ouझ-C-0Ѵ;v‹
u;ruo7†1b0Ѵ;v;m†mruo1;vo7;-†7b|ouझ-vbv|;l࢙ঞ1oĺ

- ;ˆb7;m1b- 7; -†7b|ouझ- 7;0;uझ- v;uˆ;ubC1-0Ѵ;ĺ m ];m;u-Ѵķ 7;0;uझ- 0-v-uv; ;m l†;v|u-v 7; Ѵ-
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

bm=oul-1bॕm7bvromb0Ѵ;ķ‹-t†;†m--†7b|ouझ-v;ѴѴ;ˆ--1-0o7†u-m|;†mঞ;lroCmb|o‹1omu;1†uvov
Ѵblb|-7ovĺ";7;0;uझ--rѴb1-u†m†vo-ruorb-7o7;Ѵl†;v|u;oķ‹-t†;;v|࢙;v|u;1_-l;m|;u;Ѵ-1bom-7o
1omѴ-1omC-mŒ-t†;v;r†;7;7;rovb|-u;mѴ-v1om1Ѵ†vbom;v7;Ѵ--†7b|ouझ-ĺ

Enfoque basado en el riesgo: un enfoque de auditoría que considera riesgos y oportunidades

Ѵ;m=ot†;0-v-7o;m;Ѵub;v]o7;0;uझ-bmY†buv†v|-m1b-Ѵl;m|;;mѴ-rѴ-mbC1-1bॕmķ1om7†11bॕm‹
ru;v;m|-1bॕm7;bm=oul;v7;Ѵ-v-†7b|ouझ-vr-u-]-u-mঞŒ-ut†;Ѵ-v-†7b|ouझ-vv;1;m|u;m;m-v†m|ov
t†;vomblrou|-m|;vr-u-;Ѵ1Ѵb;m|;7;-†7b|ouझ-‹r-u-Ѵo]u-uѴovo0f;ঞˆov7;Ѵruo]u-l-7;-†7b|ouझ-ĺ

88
Cláusula 5: Programa de Auditoría

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

$ƐĹ v|-C]†u-bѴ†v|u-Ѵ--rѴb1-1bॕmѴ-m;-uŋ-1;uŋ(;ubC1-uŋ1|†-uķ;m;v|;7o1†l;m|oĺ

$ƑĹ-m†l;u-1bॕm7;1Ѵ࢙†v†Ѵ-vņv†01Ѵ࢙†v†Ѵ-vv;u;C;u;-Ѵ-v1Ѵ࢙†v†Ѵ-vņv†01Ѵ࢙†v†Ѵ-vu;Ѵ;ˆ-m|;v
7;;v|;7o1†l;m|oĺ

b]†u-ƐĹ Ѵ†fo7;ruo1;vor-u-Ѵ-];vঞॕm7;†mruo]u-l-7;-†7b|ouझ-ĺ

89
 Cláusula 7: Atributos Personales

Cláusula 6: Actividades de la Auditoría

v|-1Ѵ࢙†v†Ѵ-ruorou1bom-oub;m|-1bॕmvo0u;Ѵ-rѴ-mb=b1-1bॕm‹Ѵ-=oul-7;ѴѴ;ˆ-u-1-0oѴ-v-1|bˆb7-7;v
7;-†7b|ouझ-1olor-u|;7;†mruo]u-l-7;-†7b|ouझ-ĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

90
 Ѵ Ѵझ7;u 7;Ѵ ;t†bro -†7b|ou 7;0;uझ-Ĺ !;-ѴbŒ-u u;†mbom;v bm=oul-|bˆ-v 7;Ѵ ;t†bro -†7b|ouķ 1†-m7o v;-
-ruorb-7oķr-u-7bv|ub0†buѴ-v-vb]m-1bom;v7;|u-0-fo‹7;1b7buѴovrovb0Ѵ;v1-l0bovĺ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

Cláusula 7: Competencia y Evaluación de los Auditores
v|-1Ѵ࢙†v†Ѵ-|u-|-Ѵ-v1olr;|;m1b-v7;Ѵov-†7b|ou;v-Ѵu;-ѴbŒ-u†m--†7b|ouझ-ĺ
ov-†7b|ou;v7;0;mĹ

ov;;u1†-Ѵb7-7;vr;uvom-Ѵ;vķ|-Ѵ;v1olo7brѴol-1b-ķvbm1;ub7-7ķr;u1;r1bॕmķr;uvbv|;m1b-ķ;|1ĺr-u-
t†;Ѵ--†7b|ouझ-v;u;-Ѵb1;;m=oul-ruo=;vbom-Ѵ‹1ouu;1|--Ѵ-ˆ;Œĺ

ov;;u1omo1blb;m|ov];m࣐ub1ov‹_-0bѴb7-7;v|-Ѵ;v1oloĹ
վ rѴb1-urubm1brbovķruo1;7blb;m|ov‹|࣐1mb1-v7;-†7b|ouझ-ĺ
վ Ѵ-mb=b1-u‹ou]-mbŒ-u;Ѵ|u-0-fo;m=oul-;=b1-Œĺ
վ omo1;uѴov1ॕ7b]ovķѴ;‹;v‹moul-|bˆ-vѴo1-Ѵ;vķu;]bom-Ѵ;v‹m-1bom-Ѵ;vĺ

91
 ov;;u†m-7;1†-7ombˆ;Ѵ7;;7†1-1bॕmķ;Šr;ub;m1b-Ѵ-0ou-Ѵķ1-r-1b|-1bॕm1olo-†7b|ou‹;Šr;ub;m1b-
;m-†7b|ouझ-vĺ

-m|;m;u‹l;fou-u;m=oul-1omঞm†-v†v_-0bѴb7-7;v‹1olr;|;m1b-vĺ

Métodos para Evaluar a los Auditores

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

Cláusula 7: Atributos Personales

ĺ Éticoķ;v7;1buķf†v|oķˆ;u-Œķvbm1;uoķ_om;v|o‹7bv1u;|oĺ
ĺ De mente abierta,;v7;1buķ7bvr†;v|o-1omvb7;u-ub7;-vor†m|ov7;ˆbv|-
-Ѵ|;um-|bˆovĺ
ĺ Diplomáticoķ;v7;1buķ7bv1u;|o-Ѵ|u-|-u1ombm7bˆb7†ovĸ
ĺ Observador, ;v 7;1buķ o0v;uˆ-m7o -1|bˆ-l;m|; ;Ѵ ;m|oumo =झvb1o ‹ Ѵ-v
-1|bˆb7-7;vĺ
ĺ Perceptivoķ;v7;1buķ1omv1b;m|;7;‹1-r-Œ7;1olru;m7;uvb|†-1bom;vĺ
ĺ Versátilķ;v7;1buķ1-r-Œ7;-7-r|-uv;=࢙1bѴl;m|;-7b=;u;m|;vvb|†-1bom;vĺ

92
ĺ Tenazķ;v7;1bur;uvbv|;m|;‹;m=o1-7o;m-Ѵ1-mŒ-uo0f;|bˆovĺ
ĺ Decisivoķ;v7;1buķ1-r-Œ7;ѴѴ;]-u-1om1Ѵ†vbom;vorou|†m-v0-v-7-v;m;Ѵu-Œom-lb;m|oѴॕ]b1o‹;Ѵ
-m࢙Ѵbvbvĸ
ĺ Autosuficienteķ ;v 7;1buķ 1-r-Œ 7; -1|†-u ‹ =†m1bom-u bm7;r;m7b;m|;l;m|; lb;m|u-v bm|;u-1|ি-
;=;1|bˆ-l;m|;1omo|uovĸ
ĺ Capaz de actuar con fortaleza,;v7;1buķ1-r-Œ7;-1|†-u7;l-m;u-u;vromv-0Ѵ;‹࣐|b1-ķ-†mt†;
;v|-v -11bom;v mo vb;lru; v;-m ror†Ѵ-u;v ‹ ;m o1-vbom;v r†;7;m 7-u Ѵ†]-u - 7;v-1†;u7ov o
1om=uom|-1bom;vĸ
ĺ Abierto a la mejoraķ;v7;1buķ7bvr†;v|o--ru;m7;u7;Ѵ-vvb|†-1bom;vĸ
ĺ Culturalmente sensibleķ;v7;1buķ-|;m|o‹u;vr;|†ovo1omѴ-1†Ѵ|†u-7;Ѵ-†7b|-7oĸ
ĺ Colaboradorķ;v7;1buķbm|;u-11bॕm;=;1|bˆ-1omo|uovķbm1Ѵ†b7ovѴovlb;l0uov7;Ѵ;t†bro7;-†7b|ouझ-
‹;Ѵr;uvom-Ѵ7;Ѵ-†7b|-7oĺ

Cláusula 7: Conocimientos Genéricos y Habilidades

ĺ ubm1brbovķ ruo1;vov ‹ l࣐|o7ov 7; -†7b|ouझ-Ĺ ;Ѵ 1omo1blb;m|o ‹ Ѵ-v _-0bѴb7-7;v ;m ;v|- ࢙u;- Ѵ;
r;ulb|;m-Ѵ-†7b|ou-v;]†u-ut†;Ѵ-v-†7b|ouझ-vv;u;-Ѵb1;m7;l-m;u-1omvbv|;m|;‹vbv|;l࢙|b1-ĺ

&m-†7b|ou7;0;uझ-v;u1-r-Œ7;Ĺ
վ olru;m7;uѴov|brov7;ub;v]ov‹orou|†mb7-7;v-vo1b-7ov1omѴ--†7b|ouझ-‹Ѵovrubm1brbov7;Ѵ
;m=ot†;7;-†7b|ouझ-0-v-7o;m;Ѵub;v]oĺ
վ Ѵ-mb=b1-u‹ou]-mbŒ-u;Ѵ|u-0-fo7;l-m;u-;=;1|bˆ-ĺ
վ !;-ѴbŒ-uѴ--†7b|ouझ-7;m|uo7;Ѵ1uomo]u-l--1ou7-7oĺ
վ uboubŒ-u‹;m=o1-uv;;m-v†m|ovblrou|-m|;vĺ
վ ol†mb1-uv;7;l-m;u-;=;1|bˆ-ķou-Ѵl;m|;‹rou;v1ub|oՋ-v;-r;uvom-Ѵl;m|;ol;7b-m|;;Ѵ†vo
7;bm|࣐uru;|;vőĺ
վ !;1orbѴ-u bm=oul-1bॕm l;7b-m|; ;m|u;ˆbv|-v ;=;1|bˆ-vķ ;v1†1_-uķ o0v;uˆ-u ‹ u;ˆbv-u bm=oul-1bॕm

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

7o1†l;m|-7-ķbm1Ѵ†b7ovu;]bv|uov‹7-|ovĺ

ov-†7b|ou;v7;0;uझ-m|;m;u1omo1blb;m|o‹_-0bѴb7-7;v;mѴ-v࢙u;-vt†;v;7;|-ѴѴ-m-1omঞm†-1bॕmĺ

ĺ ubm1brbovķ ruo1;vov ‹ l࣐|o7ov 7; -†7b|ouझ-Ĺ ;Ѵ 1omo1blb;m|o ‹ Ѵ-v _-0bѴb7-7;v ;m ;v|- ࢙u;- Ѵ;
r;ulb|;m-Ѵ-†7b|ou-v;]†u-ut†;Ѵ-v-†7b|ouझ-vv;u;-Ѵb1;m7;l-m;u-1omvbv|;m|;‹vbv|;l࢙|b1-ĺ

&m-†7b|ou7;0;uझ-v;u1-r-Œ7;Ĺ
վ olru;m7;uѴov|brov7;ub;v]ov‹orou|†mb7-7;v-vo1b-7ov1omѴ--†7b|ouझ-‹Ѵovrubm1brbov7;Ѵ
;m=ot†;7;-†7b|ouझ-0-v-7o;m;Ѵub;v]oĺ
վ Ѵ-mb=b1-u‹ou]-mbŒ-u;Ѵ|u-0-fo7;l-m;u-;=;1|bˆ-ĺ
վ !;-ѴbŒ-uѴ--†7b|ouझ-7;m|uo7;Ѵ1uomo]u-l--1ou7-7oĺ
վ uboubŒ-u‹;m=o1-uv;;m-v†m|ovblrou|-m|;vĺ
վ ol†mb1-uv;7;l-m;u-;=;1|bˆ-ķou-Ѵl;m|;‹rou;v1ub|oՋ-v;-r;uvom-Ѵl;m|;ol;7b-m|;;Ѵ†vo
7;bm|࣐uru;|;vőĺ
վ !;1orbѴ-u bm=oul-1bॕm l;7b-m|; ;m|u;ˆbv|-v ;=;1|bˆ-vķ ;v1†1_-uķ o0v;uˆ-u ‹ u;ˆbv-u bm=oul-1bॕm
7o1†l;m|-7-ķbm1Ѵ†b7ovu;]bv|uov‹7-|ovĺ

93
 վ olru;m7;uѴ-b7om;b7-7‹Ѵ-v1omv;1†;m1b-v7;Ѵ†vo7;|࣐1mb1-v7;l†;v|u;or-u-Ѵ--†7b|ouझ-ĺ
վ m|;m7;u‹1omvb7;u-uѴ-vorbmbom;v7;Ѵov;Šr;u|ov|࣐1mb1ovĺ
վ †7b|-u†mruo1;vo7;rubm1brbo-=bmķbm1Ѵ†b7-vѴ-vbm|;uu;Ѵ-1bom;v1omo|uovruo1;vov‹7b=;u;m|;v
=†m1bom;vķv;]িm1ouu;vrom7-ĺ
վ (;ub=b1-uѴ-u;Ѵ;ˆ-m1b-‹;Š-1|b|†77;Ѵ-bm=oul-1bॕmu;1orbѴ-7-ĺ
վ om=bul-u Ѵ- v†=b1b;m1b- ; b7om;b7-7 7; Ѵ- ;ˆb7;m1b- 7; -†7b|ouझ- r-u- u;vr-Ѵ7-u Ѵov _-ѴѴ-Œ]ov ‹
1om1Ѵ†vbom;v7;Ѵ--†7b|ouझ-ĺ
վ ˆ-Ѵ†-u-t†;ѴѴov=-1|ou;vt†;r†;7;m-=;1|-uѴ-1om=b-0bѴb7-77;Ѵov_-ѴѴ-Œ]ov‹1om1Ѵ†vbom;v7;Ѵ-
-†7b|ouझ-ĺ
վ o1†l;m|-uѴ-v-1|bˆb7-7;v7;-†7b|ouझ-‹Ѵov_-ѴѴ-Œ]ov7;-†7b|ouझ-ķ‹ru;r-u-ubm=oul;vĺ
վ -m|;m;uѴ-1om=b7;m1b-Ѵb7-7‹v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ

ĺ oul-v7;Ѵvbv|;l-7;];v|bॕm‹o|u-vu;=;u;m1b-vĹ;Ѵ1omo1blb;m|o‹Ѵ-v_-0bѴb7-7;v;m;v|-࢙u;-Ѵ;
r;ulb|;m-Ѵ-†7b|ou1olru;m7;u;Ѵ-Ѵ1-m1;7;Ѵ--†7b|ouझ-‹-rѴb1-u1ub|;ubov7;-†7b|ouझ-ķ‹7;0;uझ-m
1†0ubuѴovb]†b;m|;Ĺ

վ oul-v7;Ѵvbv|;l-7;];v|bॕm†o|uov7o1†l;m|ovmoul-|bˆov†oub;m|-|bˆovņ7;-ro‹o†|bѴbŒ-7ov
r-u-;v|-0Ѵ;1;u1ub|;ubovol࣐|o7ov7;-†7b|ouझ-ĺ
վ --rѴb1-1bॕm7;Ѵov;v|࢙m7-u;v7;Ѵvbv|;l-7;];v|bॕmrou;Ѵ-†7b|-7o‹o|u-vou]-mbŒ-1bom;vĺ
վ !;Ѵ-1bom;v;bm|;u-11bom;v;m|u;Ѵovruo1;vov7;Ѵvbv|;l-7;];v|bॕmĺ
վ olru;m7;uѴ-blrou|-m1b-‹Ѵ-ruboub7-77;lিѴ|brѴ;v;v|࢙m7-u;vou;=;u;m1b-vĺ
վ rѴb1-1bॕm7;;v|࢙m7-u;vou;=;u;m1b-v-7b=;u;m|;vvb|†-1bom;v7;-†7b|ouझ-ĺ

ĺ -ou]-mbŒ-1bॕm‹v†1om|;Š|oĹ;Ѵ1omo1blb;m|o‹Ѵ-v_-0bѴb7-7;v;m;v|-࢙u;-Ѵ;r;ulb|;m-Ѵ-†7b|ou
1olru;m7;uѴ-;v|u†1|†u-ķ;Ѵruorॕvb|o‹Ѵ-vru࢙1|b1-v7;];v|bॕm7;Ѵ-†7b|-7o‹7;0;uझ-1†0ubuѴo
vb]†b;m|;Ĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

վ ;1;vb7-7;v‹ ;Šr;1|-|bˆ-v 7; Ѵ-v r-u|;v bm|;u;v-7-v u;Ѵ;ˆ-m|;v t†; blr-1|-m ;m ;Ѵ vbv|;l- 7;
];v|bॕmĺ
վ $bro7;ou]-mbŒ-1bॕmķ]o0b;umoķ|-l-ोoķ;v|u†1|†u-ķ=†m1bom;v‹u;Ѵ-1bom;vĺ
վ om1;r|ov ];m;u-Ѵ;v 7; m;]o1bov ‹ ];v|bॕmķ ruo1;vov ‹ |;ulbmoѴo]झ- u;Ѵ-1bom-7-ķ bm1Ѵ†b7- Ѵ-
rѴ-mb=b1-1bॕmķru;v†r†;v|-1bॕm‹];v|bॕm7;r;uvom-vĺ
վ vr;1|ov1†Ѵ|†u-Ѵ;v‹vo1b-Ѵ;v7;Ѵ-†7b|-7oĺ

ĺ !;t†bvb|ovu;]Ѵ-l;m|-ubov‹Ѵ;]-Ѵ;v-rѴb1-0Ѵ;v‹o|uovu;t†bvb|ovĹ;Ѵ1omo1blb;m|o‹Ѵ-v_-0bѴb7-7;v
;m;v|-࢙u;-Ѵ;r;ulb|;m-Ѵ-†7b|ou1omo1;u‹|u-0-f-u7;m|uo7;Ѵovu;t†bvb|ov7;Ѵ-ou]-mbŒ-1bॕmĺov
1omo1blb;m|ov‹_-0bѴb7-7;v;vr;1झ=b1ov7;Ѵ-f†ubv7b11bॕmo7;Ѵ-v-1|bˆb7-7;vķruo1;vovķruo7†1|ov
‹v;uˆb1bov7;Ѵ-†7b|-7o7;0;uझ-m1†0ubuѴovb]†b;m|;Ĺ

վ !;t†bvb|ovѴ;]-Ѵ;v‹u;]Ѵ-l;m|-ubovķ-vझ1olov†v-];m1b-v7;]o0b;umoĺ
վ $;ulbmoѴo]झ-f†uझ7b1-0࢙vb1-ĺ
վ om|u-|-1bॕm‹u;vromv-0bѴb7-7ĺ

94
NOTA: -1om1b;m1b-7;Ѵovu;t†bvb|ovѴ;]-Ѵ;v‹u;]Ѵ-l;m|-ubovmoblrѴb1-r;ub1b-Ѵ;]-Ѵ‹†m-
-†7b|ouझ-7;Ѵvbv|;l-7;];vঞॕmmo7;0;uझ-|u-|-uv;1olo†m--†7b|ouझ-7;1†lrѴblb;m|oѴ;]-Ѵĺ

-ƐƖƏƐƐѴo7;Cm;1olo-uu;]Ѵovr-u-†m1omf†m|o7;†m-ol࢙v-†7b|ouझ-vrѴ-mbC1-7-vr-u-†m
l-u1o7;ঞ;lro;vr;1झC1o‹7bub]b7-v_-1b-†mruorॕvb|o;vr;1झC1oĺ

վ &mruo]u-l-7;-†7b|ouझ-r†;7;bm1Ѵ†bu†m-ol࢙v-†7b|ouझ-vķ7;r;m7b;m7o7;Ѵ|-l-ोoķѴ-m-|†u-Ѵ;Œ-
‹Ѵ-1olrѴ;fb7-77;Ѵ-ou]-mbŒ-1bॕmt†;ˆ--v;u-†7b|-7-vĺ

վ Ѵ-Ѵ1-m1;7;†mruo]u-l-7;-†7b|ouझ-7;0;uझ-0-v-uv;;m;Ѵ|-l-ोo‹Ѵ-m-|†u-Ѵ;Œ-7;Ѵ-†7b|-7oķ
-vझ1olo;mѴ-m-|†u-Ѵ;Œ-ķ=†m1bom-Ѵb7-7ķ1olrѴ;fb7-7ķ;Ѵ|bro7;ub;v]ov‹orou|†mb7-7;vķ‹;Ѵmbˆ;Ѵ
7;l-7†u;Œ7;Ѵovvbv|;l-v7;];v|bॕm-v;u-†7b|-7ovĺ

վ -u-1olru;m7;u;Ѵ1om|;Š|o7;Ѵ-†7b|-7oķ;Ѵruo]u-l-7;-†7b|ouझ-7;0;uझ-|;m;u;m1†;m|-Ĺ
վ 0f;|bˆovou]-mbŒ-1bom-Ѵ;vĺ
վ †;v|bom;v;Š|;um-v;bm|;um-vu;Ѵ;ˆ-m|;vĺ
վ -vm;1;vb7-7;v‹;Šr;1|-|bˆ-v7;Ѵ-vr-u|;vbm|;u;v-7-vr;u|bm;m|;vĺ
վ !;t†bvb|ov7;1om=b7;m1b-Ѵb7-7‹v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ

v|-0Ѵ;1blb;m|o7;0f;ঞˆov del Programa de Auditoría

Ѵ 1Ѵb;m|; 7; -†7b|ouझ- 7;0;uझ- -v;]†u-uv; 7; t†; Ѵov o0f;ঞˆov 7;Ѵ ruo]u-l- 7; -†7b|ouझ- v;
;v|-0Ѵ;Œ1-mr-u-7bub]buѴ-rѴ-mbC1-1bॕm‹Ѵ-u;-ѴbŒ-1bॕm7;-†7b|ouझ-vķ‹7;0;uझ-]-u-mঞŒ-ut†;;Ѵ
ruo]u-l-7;-†7b|ouझ-v;blrѴ;l;m|;7;l-m;u-;=;1ঞˆ-ĺ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

ovo0f;ঞˆov7;Ѵruo]u-l-7;-†7b|ouझ-7;0;uझ-mv;u1o_;u;m|;v1omѴ-oub;m|-1bॕm;v|u-|࣐]b1-‹Ѵov
o0f;ঞˆov‹Ѵ-roѴझঞ1-7;Ѵvbv|;l-7;];vঞॕm7;vorou|;7;Ѵ1Ѵb;m|;7;-†7b|ouझ-ĺ

v|ovo0f;ঞˆovr†;7;m0-v-uv;;mѴ-1omvb7;u-1bॕm7;Ѵovb]†b;m|;Ĺ
ĺ -vm;1;vb7-7;v‹;Šr;1|-|bˆ-v7;Ѵ-vr-u|;vbm|;u;v-7-vr;u|bm;m|;vķ|-m|o;Š|;um-v1olobm|;um-vĺ
ĺ -u-1|;uझv|b1-v‹u;t†bvb|ov7;ruo1;vovķruo7†1|ovķv;uˆb1bov‹ruo‹;1|ovķ‹1†-Ѵt†b;u1-l0bo;m
;ѴѴovĺ
ĺ !;t†bvb|ov7;Ѵvbv|;l-7;];v|bॕmĺ
ĺ ;1;vb7-77;;ˆ-Ѵ†-1bॕm7;ruoˆ;;7ou;v;Š|;umovĺ
ĺ Ѵmbˆ;Ѵ7;u;m7blb;m|o‹;Ѵmbˆ;Ѵ7;l-7†u;Œ7;Ѵvbv|;l-ovbv|;l-v7;];v|bॕm7;Ѵ-†7b|-7oķ1olo
v;u;=Ѵ;f-;mѴovbm7b1-7ou;v7;u;m7blb;m|ou;Ѵ;ˆ-m|;vŐrou;f;lrѴoķĽvőķѴ-o1†uu;m1b-7;mo
1om=oulb7-7;vķbm1b7;m|;vot†;f-v7;Ѵ-vr-u|;vbm|;u;v-7-vĺ
ĺ 7;m|b=b1ॕub;v]ov‹orou|†mb7-7;vr-u-;Ѵ-†7b|-7oĺ
ĺ !;v†Ѵ|-7ov7;-†7b|ouझ-v-m|;ubou;vĺ

95
 Determinación y Evaluación de Riesgos y Oportunidades del Programa de Auditoría
Šbv|;mub;v]ov‹orou|†mb7-7;vu;Ѵ-1bom-7ov1om;Ѵ1om|;Š|o7;Ѵ-†7b|-7ot†;r†;7;m-vo1b-uv;
1om†mruo]u-l-7;-†7b|ouझ-‹r†;7;m-=;1|-u;ѴѴo]uo7;v†vo0f;ঞˆovĺ
- r;uvom- u;vromv-0Ѵ; 7;Ѵ ruo]u-l- 7; -†7b|ouझ- 7;0;uझ- 1omvb7;u-u Ѵov ub;v]ov 7†u-m|; ;Ѵ
7;v-uuoѴѴo7;Ѵruo]u-l-Ĺ
ĺ Planificación, rou ;f;lrѴoĸ mo ;v|-0Ѵ;1;u Ѵov o0f;|bˆov 7; -†7b|ouझ- u;Ѵ;ˆ-m|;v ‹ 7;|;ulbm-u ;Ѵ
-Ѵ1-m1;ķ;Ѵmিl;uoķѴ-7†u-1bॕmķѴ-v†0b1-1bom;v‹;Ѵ1uomo]u-l-7;Ѵ-v-†7b|ouझ-vĺ
ĺ Recursosķrou;f;lrѴoĸr;ulb|bu|b;lroķ;t†bro‹ņo1-r-1b|-1bॕmbmv†=b1b;m|;vr-u-7;v-uuoѴѴ-u;Ѵ
ruo]u-l-7;-†7b|ouझ-ou;-ѴbŒ-u†m--†7b|ouझ-ĺ
ĺ Selección del equipo de auditoríaķ rou ;f;lrѴoĸ 1olr;|;m1b- ]Ѵo0-Ѵ bmv†=b1b;m|; r-u- u;-ѴbŒ-u
-†7b|ouझ-v7;l-m;u-;=;1|bˆ-ĺ
ĺ Comunicaciónķrou;f;lrѴoĸruo1;vovņ1-m-Ѵ;v7;1ol†mb1-1bॕm;Š|;umovņbm|;umovbm;=b1-1;vĺ
ĺ Implementación, rou ;f;lrѴoĸ 1oou7bm-1bॕm bm;=b1-Œ 7; Ѵ-v -†7b|ouझ-v 7;m|uo 7;Ѵ ruo]u-l- 7;
-†7b|ouझ-ķomo1omvb7;u-uѴ-v;]†ub7-7‹1om=b7;m1b-Ѵb7-77;Ѵ-bm=oul-1bॕmĺ
ĺ Control de la información documentadaķrou;f;lrѴoĸѴ-7;|;ulbm-1bॕmbm;=b1-Œ7;Ѵ-bm=oul-1bॕm
7o1†l;m|-7-m;1;v-ub-u;t†;ub7-rouѴov-†7b|ou;v‹Ѵ-vr-u|;vbm|;u;v-7-vr;u|bm;m|;vĸѴ-=-Ѵ|-
7;ruo|;11bॕm-7;1†-7-7;Ѵovu;]bv|uov7;-†7b|ouझ-r-u-7;lov|u-uѴ-;=b1-1b-7;Ѵruo]u-l-7;
-†7b|ouझ-ĺ
ĺ Supervisar, revisar y mejorar el programa de auditoría,rou;f;lrѴoĸv;]†blb;m|obm;=b1-Œ7;Ѵov
u;v†Ѵ|-7ov7;Ѵruo]u-l-7;-†7b|ouझ-ĺ
ĺ Disponibilidad y cooperación del auditado‹7bvromb0bѴb7-77;;ˆb7;m1b-r-u-v;ul†;v|u;-7-ĺ

Las oportunidadesr-u-l;fou-u;Ѵruo]u-l-7;-†7b|ouझ-r†;7;mbm1Ѵ†buĹ

ĺ ;ulb|bulিѴ|brѴ;v-†7b|ouझ-v;m†m-voѴ-ˆbvb|-ĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

ĺ bmblbŒ-u;Ѵ|b;lro‹Ѵ-v7bv|-m1b-vt†;ˆb-f-m-Ѵvb|boĺ
ĺ -1;u 1obm1b7bu ;Ѵ mbˆ;Ѵ 7; 1olr;|;m1b- 7;Ѵ ;t†bro 7; -†7b|ouझ- 1om ;Ѵ mbˆ;Ѵ 7; 1olr;|;m1b-
m;1;v-ubor-u--Ѵ1-mŒ-uѴovo0f;|bˆov7;Ѵ--†7b|ouझ-ĺ
ĺ Ѵbm;-uѴ-v=;1_-v7;-†7b|ouझ-1omѴ-7bvromb0bѴb7-77;Ѵr;uvom-Ѵ1Ѵ-ˆ;7;Ѵ-†7b|-7oĺ

Establecimiento del Programa de Auditoría

!oѴ;v‹u;vromv-0bѴb7-7;v7;Ѵ-vr;uvom-vt†;];vঞom-m;Ѵruo]u-l-7;-†7b|ouझ-

ĺ v|-0Ѵ;1;u Ѵ- ;Š|;mvbॕm 7;Ѵ ruo]u-l- 7; -†7b|ouझ- 7; -1†;u7o 1om Ѵov o0f;|bˆov u;Ѵ;ˆ-m|;v  ‹
1†-Ѵt†b;uu;v|ub11bॕm1omo1b7-ĺ
ĺ ;|;ulbm-uѴovruo0Ѵ;l-v;Š|;umov;bm|;umovķ‹Ѵovub;v]ov‹orou|†mb7-7;vt†;r†;7;m-=;1|-u
;Ѵruo]u-l-7;-†7b|ouझ-ķ;blrѴ;l;m|-u-11bom;vr-u--0ou7-uѴovķbm|;]u-m7o;v|-v-11bom;v;m
|o7-vѴ-v-1|bˆb7-7;v7;-†7b|ouझ-u;Ѵ;ˆ-m|;vķv;]িm1ouu;vrom7-ĺ
ĺ -u-m|bŒ-uѴ-v;Ѵ;11bॕm7;Ѵov;t†brov7;-†7b|ouझ-‹Ѵ-1olr;|;m1b-];m;u-Ѵr-u-Ѵ-v-1|bˆb7-7;v
7;-†7b|ouझ-l;7b-m|;Ѵ--vb]m-1bॕm7;=†m1bom;vķu;vromv-0bѴb7-7;v‹-†|oub7-7;vķ‹;Ѵ-ro‹o-Ѵ
Ѵb7;u-Œ]oķv;]িm1ouu;vrom7-ĺ

96
!oѴ;v‹u;vromv-0bѴb7-7;v7;Ѵ-vr;uvom-vt†;];vঞom-m;Ѵruo]u-l-7;-†7b|ouझ-ĺ

ĺ v|-0Ѵ;1;u|o7ovѴovruo1;vovu;Ѵ;ˆ-m|;vķbm1Ѵ†b7ovѴovruo1;vovr-u-Ĺ
վ -1oou7bm-1bॕm‹ruo]u-l-1bॕm7;|o7-vѴ-v-†7b|ouझ-v7;m|uo7;Ѵruo]u-l-7;-†7b|ouझ-ĺ
վ Ѵ;v|-0Ѵ;1blb;m|o7;o0f;|bˆov7;-†7b|ouझ-ķ-Ѵ1-m1;Ővő‹1ub|;ubov7;Ѵ-v-†7b|ouझ-vķ7;|;ulbm-1bॕm
7;Ѵovl࣐|o7ov7;-†7b|ouझ-‹v;Ѵ;11bॕm7;Ѵ;t†bro7;-†7b|ouझ-ĺ
վ ˆ-Ѵ†-1bॕm7;-†7b|ou;vĺ
վ Ѵ;v|-0Ѵ;1blb;m|o7;ruo1;vov7;1ol†mb1-1bॕm;Š|;um-;bm|;um-ķv;]িm1ouu;vrom7-ĺ
վ -u;voѴ†1bॕm7;7bvr†|-v‹;Ѵl-m;fo7;t†;f-vĺ
վ ";]†blb;m|o7;-†7b|ouझ-vb1ouu;vrom7;ĺ
վ m=oul-u-Ѵ1Ѵb;m|;7;-†7b|ouझ-‹-Ѵ-vr-u|;vbm|;u;v-7-vr;u|bm;m|;vķv;]িm1ouu;vrom7-ĺ

!oѴ;v‹u;vromv-0bѴb7-7;v7;Ѵ-vr;uvom-vt†;];vঞom-m;Ѵruo]u-l-7;-†7b|ouझ-ĺ

ĺ ;|;ulbm-u‹]-u-m|bŒ-uѴ-ruoˆbvbॕm7;|o7ovѴovu;1†uvovm;1;v-ubovĺ
ĺ -u-m|bŒ-ut†;v;ru;r-u;‹l-m|;m]-Ѵ-bm=oul-1bॕm7o1†l;m|-7--ruorb-7-ķbm1Ѵ†b7ovѴovu;]bv|uov
7;Ѵruo]u-l-7;-†7b|ouझ-ĺ
ĺ omb|ou;-uķu;ˆbv-u‹l;fou-u;Ѵruo]u-l-7;-†7b|ouझ-ĺ
ĺ ol†mb1-u ;Ѵ ruo]u-l- 7; -†7b|ouझ- -Ѵ 1Ѵb;m|; 7; -†7b|ouझ- ‹ķ v;]িm 1ouu;vrom7-ķ - Ѵ-v r-u|;v
bm|;u;v-7-vr;u|bm;m|;vĺ

-vr;uvom-vt†;];vঞom-m;Ѵruo]u-l-7;-†7b|ouझ-7;0;uझ-mvoѴb1b|-uv†-ruo0-1bॕm-Ѵ1Ѵb;m|;7;
-†7b|ouझ-ĺ

olr;|;m1b-7;ŐѴovőm7bˆb7†oŐvőt†;;vঞom-Őmő;Ѵuo]u-l-7;†7b|ouझ-

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

-Ővőr;uvom-Ővőt†;];vঞom-Őmő;Ѵruo]u-l-7;-†7b|ouझ-7;0;uझ-m|;m;uѴ-1olr;|;m1b-m;1;v-ub-r-u-
];vঞom-u;Ѵruo]u-l-ķv†vub;v]ov‹orou|†mb7-7;v-vo1b-7ov‹Ѵovruo0Ѵ;l-v;Š|;umov;internos de
l-m;u-;=;1ঞˆ-‹;C1b;m|;ķbm1Ѵ†b7o;Ѵ1omo1blb;m|o7;Ĺ

ĺ ubm1brbov7;-†7b|ouझ-ķl࣐|o7ov‹ruo1;vovĺ
ĺ oul-v7;Ѵvbv|;l-7;];v|bॕmķo|u-vmoul-vr;u|bm;m|;v‹7o1†l;m|ov7;u;=;u;m1b-ņoub;m|-1bॕmĺ
ĺ m=oul-1bॕm vo0u; ;Ѵ -†7b|-7o ‹ v† 1om|;Š|o Őrou ;f;lrѴoķ -v†m|ov ;Š|;umovņbm|;umovķ r-u|;v
bm|;u;v-7-v u;Ѵ;ˆ-m|;v ‹ v†v m;1;vb7-7;v ‹ ;Šr;1|-|bˆ-vķ -1|bˆb7-7;v 1ol;u1b-Ѵ;vķ ruo7†1|ovķ
v;uˆb1bov‹ruo1;vov7;Ѵ-†7b|-7oĺ
ĺ !;t†bvb|ov Ѵ;]-Ѵ;v ‹ u;]Ѵ-l;m|-ubov -rѴb1-0Ѵ;v ‹ o|uov u;t†bvb|ov u;Ѵ;ˆ-m|;v r-u- Ѵ-v -1|bˆb7-7;v
1ol;u1b-Ѵ;v7;Ѵ-†7b|-7oĺ

Establecer el Alcance del Programa de Auditoría

-vr;uvom-vt†;];vঞom-m;Ѵruo]u-l-7;-†7b|ouझ-7;0;uझ-m7;|;ulbm-u;Ѵ-Ѵ1-m1;7;Ѵruo]u-l-
7;-†7b|ouझ-ĺ v|or†;7;ˆ-ub-uv;]িmѴ-bm=oul-1bॕmruorou1bom-7-rou;Ѵ-†7b|-7o1omu;vr;1|o-
v†1om|;Š|oĺ

97
 |uov=-1|ou;vt†;blr-1|-m;m;Ѵ-Ѵ1-m1;7;Ѵruo]u-l-7;-†7b|ouझ-Ĺ

ĺ Ѵo0f;|bˆoķ;Ѵ-Ѵ1-m1;‹Ѵ-7†u-1bॕm7;1-7--†7b|ouझ-‹Ѵ-1-m|b7-77;-†7b|ouझ-vt†;v;ѴѴ;ˆ-u࢙m-
1-0oķ;Ѵl࣐|o7o7;mo|b=b1-1bॕm‹ķvb1ouu;vrom7;ķ;Ѵv;]†blb;m|o7;Ѵ--†7b|ouझ-ĺ
ĺ -vmoul-v7;Ѵvbv|;l-7;];v|bॕm†o|uov1ub|;ubov-rѴb1-0Ѵ;vĺ
ĺ Ѵmিl;uoķѴ-blrou|-m1b-ķѴ-1olrѴ;fb7-7ķѴ-vblbѴb|†7‹Ѵ-†0b1-1bॕm7;Ѵ-v-1|bˆb7-7;v--†7b|-uĺ
ĺ t†;ѴѴov=-1|ou;vt†;bm=Ѵ†‹;m;mѴ-;=;1|bˆb7-77;Ѵvbv|;l-7;];v|bॕmĺ
ĺ ov1ub|;ubov7;-†7b|ouझ--rѴb1-0Ѵ;vķ|-Ѵ;v1oloѴov-uu;]ѴovrѴ-mb=b1-7ovr-u-Ѵ-vmoul-v7;Ѵvbv|;l-
7; ];v|bॕm r;u|bm;m|;vķ Ѵov u;t†bvb|ov Ѵ;]-Ѵ;v ‹ u;]Ѵ-l;m|-ubov ‹ o|uov u;t†bvb|ov 1om Ѵov t†; Ѵ-
ou]-mbŒ-1bॕm;v|࢙1olruol;|b7-ĺ
ĺ !;v†Ѵ|-7ov7;-†7b|ouझ-vbm|;um-vo;Š|;um-vru;ˆb-v‹u;ˆbvbom;v7;Ѵ-7bu;11bॕmķvb1ouu;vrom7;ĺ
ĺ !;v†Ѵ|-7ov7;†m-u;ˆbvbॕmru;ˆb-7;Ѵruo]u-l-7;-†7b|ouझ-ĺ
ĺ uo0Ѵ;l-vѴbm]ুझv|b1ovķ1†Ѵ|†u-Ѵ;v‹vo1b-Ѵ;vĺ
ĺ -vru;o1†r-1bom;v7;Ѵ-vr-u|;vbm|;u;v-7-vķ|-Ѵ;v1oloѴ-vt†;f-v7;Ѵov1Ѵb;m|;vķ;Ѵbm1†lrѴblb;m|o
7; Ѵov u;t†bvb|ov Ѵ;]-Ѵ;v ‹ u;]Ѵ-l;m|-ubov ‹ o|uov u;t†bvb|ov 1om Ѵov t†; Ѵ- ou]-mbŒ-1bॕm v;
1olruol;|;ķoѴovruo0Ѵ;l-v7;Ѵ-1-7;m-7;v†lbmbv|uoĺ
ĺ -l0bovvb]mb=b1-|bˆov;m;Ѵ1om|;Š|o7;Ѵ-†7b|-7oov†vor;u-1bom;v‹ub;v]ov‹orou|†mb7-7;v
u;Ѵ-1bom-7ovĺ
ĺ bvromb0bѴb7-7 7; |;1moѴo]झ-v 7; bm=oul-1bॕm ‹ 1ol†mb1-1bॕm r-u- u;vr-Ѵ7-u Ѵ-v -1|bˆb7-7;v 7;
-†7b|ouझ-ķ;mr-u|b1†Ѵ-u;Ѵ†vo7;l࣐|o7ov7;-†7b|ouझ-u;lo|-ĺ
ĺ - o1†uu;m1b- 7; ;ˆ;m|ov bm|;umov ‹ ;Š|;umovķ |-Ѵ;v 1olo mo 1om=oulb7-7;v 7; ruo7†1|ov o
v;uˆb1bovķ=†]-v7;v;]†ub7-77;Ѵ-bm=oul-1bॕmķbm1b7;m|;v7;v-Ѵ†7‹v;]†ub7-7ķ-1|ov7;Ѵb1|bˆovo
bm1b7;m|;v-l0b;m|-Ѵ;vĺ
ĺ !b;v]ov‹orou|†mb7-7;v1ol;u1b-Ѵ;vķbm1Ѵ†b7-vѴ-v-11bom;vr-u--0ou7-uѴovĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

Determinar los Recursos del Programa de Auditoría

Ѵ7;|;ulbm-uѴovu;1†uvovr-u-;Ѵruo]u-l-7;-†7b|ouझ-ķѴ-vr;uvom-vt†;];vঞom-m;Ѵruo]u-l-7;
-†7b|ouझ-7;0;uझ-m1omvb7;u-uĹ

ĺ ovu;1†uvov=bm-m1b;uov‹7;|b;lrom;1;v-ubovr-u-7;v-uuoѴѴ-uķblrѴ;l;m|-uķ-7lbmbv|u-u‹l;fou-u
Ѵ-v-1|bˆb7-7;v7;-†7b|ouझ-ĺ
ĺ ࣐|o7ov7;-†7b|ouझ-ĺ
ĺ -7bvromb0bѴb7-7bm7bˆb7†-Ѵ‹];m;u-Ѵ7;-†7b|ou;v‹;Šr;u|ov|࣐1mb1ovt†;rov;-mѴ-v1olr;|;m1b-v
-ruorb-7-vr-u-Ѵovo0f;|bˆovr-u|b1†Ѵ-u;v7;Ѵruo]u-l-7;-†7b|ouझ-ĺ
ĺ -;Š|;mvbॕm7;Ѵruo]u-l-7;-†7b|ouझ-‹Ѵovub;v]ov‹orou|†mb7-7;v7;Ѵruo]u-l-7;-†7b|ouझ-ĺ
ĺ $b;lro7;ˆb-f;‹1ov|oķ-Ѵof-lb;m|o‹o|u-vm;1;vb7-7;v7;-†7b|ouझ-ĺ
ĺ Ѵblr-1|o7;Ѵ-v7b=;u;m|;vŒom-v_ou-ub-vĺ
ĺ -7bvromb0bѴb7-77;|;1moѴo]झ-v7;bm=oul-1bॕm‹1ol†mb1-1bॕmŐrou;f;lrѴoķѴovu;1†uvov|࣐1mb1ov
m;1;v-ubovr-u-;v|-0Ѵ;1;u†m--†7b|ouझ-u;lo|-†|bѴbŒ-m7o|;1moѴo]झ-vt†;-7lb|;mѴ-1oѴ-0ou-1bॕm
u;lo|-őĺ

98
ĺ -7bvromb0bѴb7-77;1†-Ѵt†b;u_;uu-lb;m|-ķ|;1moѴo]झ-‹;t†brou;t†;ub7oĺ
ĺ - 7bvromb0bѴb7-7 7; Ѵ- bm=oul-1bॕm 7o1†l;m|-7- m;1;v-ub-ķ v;]িm v; 7;|;ulbm; 7†u-m|; ;Ѵ
;v|-0Ѵ;1blb;m|o7;Ѵruo]u-l-7;-†7b|ouझ-ĺ
ĺ ovu;t†bvb|ovu;Ѵ-1bom-7ov1omѴ-bmv|-Ѵ-1bॕmķbm1Ѵ†b7ovѴov;vr-1bov7;v;]†ub7-7‹;Ѵ;t†broŐrou
;f;lrѴoķ;t†bro7;ruo|;11bॕmr;uvom-Ѵ;m|u;o|u-vőĺ

Implementación del Programa de Auditoría

ĺ ol†mb1-uѴ-vr-u|;vr;u|bm;m|;v7;Ѵruo]u-l-7;-†7b|ouझ-ķbm1Ѵ†b7ovѴovub;v]ov‹orou|†mb7-7;vķ
-Ѵ-vr-u|;vbm|;u;v-7-vr;u|bm;m|;v;bm=oul-uѴ;vr;ubॕ7b1-l;m|;7;v†ruo]u;voķ†|bѴbŒ-m7oѴov
1-m-Ѵ;v7;1ol†mb1-1bॕm;Š|;umov;bm|;umov;v|-0Ѵ;1b7ovĺ
ĺ ;=bmbuo0f;|bˆovķ-Ѵ1-m1;‹1ub|;ubovr-u-1-7--†7b|ouझ-bm7bˆb7†-Ѵĺ
ĺ ";Ѵ;11bom-ul࣐|o7ov7;-†7b|ouझ-ĺ
ĺ oou7bm-u‹ruo]u-l-u-†7b|ouझ-v‹o|u-v-1|bˆb7-7;vu;Ѵ;ˆ-m|;vr-u-;Ѵruo]u-l-7;-†7b|ouझ-ĺ
ĺ -u-m|bŒ-ut†;Ѵov;t†brov7;-†7b|ouझ-|;m]-mѴ-1olr;|;m1b-m;1;v-ub-ĺ
ĺ uorou1bom-uѴovu;1†uvovbm7bˆb7†-Ѵ;v‹]Ѵo0-Ѵ;vm;1;v-ubov-Ѵov;t†brov7;-†7b|ouझ-ĺ
ĺ -u-m|bŒ-uѴ-u;-ѴbŒ-1bॕm7;-†7b|ouझ-v7;-1†;u7o1om;Ѵruo]u-l-7;-†7b|ouझ-ķ];v|bom-m7o|o7ov
Ѵovub;v]ovķorou|†mb7-7;v‹ruo0Ѵ;l-vor;u-|bˆovŐ;v7;1buķ;ˆ;m|ovbm;vr;u-7ovőķ|-Ѵ1olov†u];m
7†u-m|;;Ѵ7;vrѴb;]†;7;Ѵruo]u-l-ĺ
ĺ -u-m|bŒ-ut†;Ѵ-bm=oul-1bॕm7o1†l;m|-7-u;Ѵ;ˆ-m|;1omu;vr;1|o-Ѵ-v-1|bˆb7-7;v7;-†7b|ouझ-
v;];v|bom-‹l-m|b;m;7;=oul--7;1†-7-ĺ
ĺ ;=bmbu ; blrѴ;l;m|-u Ѵov 1om|uoѴ;v or;u-|bˆov m;1;v-ubov r-u- Ѵ- v†r;uˆbvbॕm 7;Ѵ ruo]u-l- 7;
-†7b|ouझ-ĺ
ĺ !;ˆbv-u;Ѵruo]u-l-7;-†7b|ouझ-r-u-b7;m|b=b1-uorou|†mb7-7;vr-u-v†l;fou-ĺ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

;Cmb1bॕm7;0f;ঞˆovķѴ1-m1;‹ub|;ubovr-u-†m-†7b|ouझ-m7bˆb7†-Ѵ
-7- -†7b|ouझ- bm7bˆb7†-Ѵ 7;0;uझ- 0-v-uv; ;m o0f;ঞˆov 7; -†7b|ouझ- 7;Cmb7ovķ -Ѵ1-m1;‹ 1ub|;ubovĺ
v|ov7;0;uझ-mv;u1omvbv|;m|;v1omѴovo0f;ঞˆov];m;u-Ѵ;v7;Ѵruo]u-l-7;-†7b|ouझ-ĺ

ovo0f;ঞˆov7;Ѵ--†7b|ouझ-7;Cm;mt†;v;ˆ--Ѵo]u-u1omѴ--†7b|ouझ-bm7bˆb7†-Ѵ‹r†;7;mbm1Ѵ†buѴo
vb]†b;m|;Ĺ

ĺ ;|;ulbm-1bॕm7;Ѵ]u-7o7;1om=oulb7-77;Ѵvbv|;l-7;];v|bॕm-v;u-†7b|-7oķor-u|;v7;࣐Ѵķ1om
Ѵov1ub|;ubov7;-†7b|ouझ-ĺ
ĺ ˆ-Ѵ†-1bॕm 7; Ѵ- 1-r-1b7-7 7;Ѵ vbv|;l- 7; ];v|bॕm r-u- -‹†7-u - Ѵ- ou]-mbŒ-1bॕm - 1†lrѴbu Ѵov
u;t†bvb|ovѴ;]-Ѵ;v‹u;]Ѵ-l;m|-ubovr;u|bm;m|;v‹o|uovu;t†bvb|ov1omѴovt†;Ѵ-ou]-mbŒ-1bॕm;v|࢙
1olruol;|b7-ĺ
ĺ ˆ-Ѵ†-1bॕm7;Ѵ-;=;1|bˆb7-77;Ѵvbv|;l-7;];v|bॕmr-u--Ѵ1-mŒ-uѴovu;v†Ѵ|-7ov;vr;u-7ovĺ

99
 ĺ 7;m|b=b1-1bॕm7;orou|†mb7-7;vr-u-Ѵ-l;fou-ro|;m1b-Ѵ7;Ѵvbv|;l-7;];v|bॕmĺ
ĺ ˆ-Ѵ†-1bॕm 7; Ѵ- b7om;b7-7 ‹ -7;1†-1bॕm 7;Ѵ vbv|;l- 7; ];v|bॕm 1om u;vr;1|o -Ѵ 1om|;Š|o ‹ Ѵ-
7bu;11bॕm;v|u-|࣐]b1-7;Ѵ-†7b|-7oĺ
ĺ ˆ-Ѵ†-1bॕm7;Ѵ-1-r-1b7-77;Ѵvbv|;l-7;];v|bॕmr-u-;v|-0Ѵ;1;u‹-Ѵ1-mŒ-uo0f;|bˆov‹-0ou7-u7;
l-m;u-;=;1|bˆ-Ѵovub;v]ov‹orou|†mb7-7;vķ;m†m1om|;Š|o1-l0b-m|;ķbm1Ѵ†b7-Ѵ-blrѴ;l;m|-1bॕm
7;Ѵ-v-11bom;vu;Ѵ-1bom-7-vĺ

Ѵ-Ѵ1-m1;7;Ѵ--†7b|ouझ-7;0;uझ-v;u1o_;u;m|;1om;Ѵruo]u-l-7;-†7b|ouझ-‹Ѵovo0f;ঞˆov7;
-†7b|ouझ-ĺ

Selección y Determinación de Métodos de Auditoría

ѴŐѴovőbm7bˆb7†oŐvőt†;];vঞom-Őmő;Ѵruo]u-l-7;-†7b|ouझ-7;0;uझ-Őmőv;Ѵ;11bom-u‹7;|;ulbm-uѴov
l࣐|o7ovr-u-ѴѴ;ˆ-u-1-0o;C1-Œl;m|;‹7;l-m;u-;C1b;m|;†m--†7b|ouझ-ķ7;r;m7b;m7o7;Ѵov
o0f;ঞˆov7;-†7b|ouझ-7;Cmb7ovķ;Ѵ-Ѵ1-m1;‹1ub|;ubovĺ

-v-†7b|ouझ-vr†;7;mu;-ѴbŒ-uv;;m;Ѵvbঞoķ7;=oul-u;lo|-o1olo†m-1ol0bm-1bॕmĺ Ѵ†vo7; estos

l࣐|o7ov7;0;uझ-;v|-u-7;1†-7-l;m|;;t†bѴb0u-7oķ;m=†m1bॕm7;ķ;m|u;o|uovķѴ-1omvb7;u-1bॕm7;
Ѵovub;v]ov‹orou|†mb7-7;v-vo1b-7ovĺ

"b†m-†7b|-7oor;u-7ovol࢙vvbv|;l-v7;];vঞॕm7;7b=;u;m|;v7bv1brѴbm-vķv;r†;7;mbm1Ѵ†bu
-†7b|ouझ-v1ol0bm-7-v;m;Ѵruo]u-l-7;-†7b|ouझ-ĺ

Selección de los Miembros del Equipo de Auditoría

ѴŐѴovő bm7bˆb7†oŐvő t†; ];v|bom-Őmő ;Ѵ ruo]u-l- 7; -†7b|ouझ- 7;0;uझ-Őmő mol0u-u - Ѵov lb;l0uov 7;Ѵ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

;t†bro7;-†7b|ouझ-ķbm1Ѵ†‹;m7o;ѴѴझ7;u7;Ѵ;t†bro‹1†-Ѵt†b;u;Šr;u|ov|࣐1mb1ovm;1;v-ubovr-u-Ѵ-
-†7b|ouझ-;vr;1झ=b1-ĺ

"; 7;0;uझ- v;Ѵ;11bom-u †m ;t†bro 7; -†7b|ouझ-ķ |;mb;m7o ;m 1†;m|- Ѵ- 1olr;|;m1b- m;1;v-ub- r-u-
-Ѵ1-mŒ-uѴovo0f;|bˆov7;Ѵ--†7b|ouझ-bm7bˆb7†-Ѵ7;m|uo7;Ѵ-Ѵ1-m1;7;=bmb7oĺ"bvoѴo_-‹†m-†7b|ouķ;Ѵ
-†7b|ou7;0;uझ-u;-ѴbŒ-u|o7-vѴ-v|-u;-v-rѴb1-0Ѵ;v7;†mѴझ7;u7;Ѵ;t†bro7;-†7b|ouझ-ĺ

Asignación de Responsabilidades al Líder del Equipo Auditor para una Auditoría

Individual

-vr;uvom-vt†;];v|bom-m;Ѵruo]u-l-7;-†7b|ouझ-7;0;uझ-m-vb]m-uѴ-u;vromv-0bѴb7-77;ѴѴ;ˆ-u-
1-0oѴ--†7b|ouझ-bm7bˆb7†-Ѵ-†mѴझ7;u7;Ѵ;t†bro7;-†7b|ouझ-ĺ

--vb]m-1bॕm7;0;uझ-_-1;uv;1omv†=b1b;m|;|b;lro-m|;v7;Ѵ-=;1_-ruo]u-l-7-7;Ѵ--†7b|ouझ-ķ-=bm
7;]-u-m|bŒ-uѴ-rѴ-mb=b1-1bॕm;=;1|bˆ-7;Ѵ--†7b|ouझ-ĺ

100
-u-t†;Ѵ--†7b|ouझ-v;ѴѴ;ˆ;-1-0o;=b1-Œl;m|;ķv;7;0;u࢙ruorou1bom-u-Ѵ-†7b|ouѴझ7;ubm=oul-1bॕm
vo0u;Ĺ

ĺ 0f;|bˆov7;-†7b|ouझ-ĺ
ĺ ub|;ubov7;-†7b|ouझ-‹1†-Ѵt†b;ubm=oul-1bॕm7o1†l;m|-7-u;Ѵ;ˆ-m|;ĺ
ĺ Ѵ1-m1;7;Ѵ--†7b|ouझ-ķbm1Ѵ†b7-Ѵ-b7;m|b=b1-1bॕm7;Ѵ-ou]-mbŒ-1bॕm‹v†v=†m1bom;v‹ruo1;vov-
-†7b|-uĺ
ĺ uo1;vov7;-†7b|ouझ-‹l࣐|o7ov-vo1b-7ovĺ
ĺ olrovb1bॕm7;Ѵ;t†bro7;-†7b|ouझ-ĺ
ĺ ov 7-|ov 7; 1om|-1|o 7;Ѵ -†7b|-7oķ Ѵ-v †0b1-1bom;vķ ;Ѵ l-u1o |;lrou-Ѵ ‹ Ѵ- 7†u-1bॕm 7; Ѵ-v
-1|bˆb7-7;v7;-†7b|ouझ-t†;v;ѴѴ;ˆ-u࢙m-1-0oĺ
ĺ ovu;1†uvovm;1;v-ubovr-u-ѴѴ;ˆ-u-1-0oѴ--†7b|ouझ-ĺ
ĺ m=oul-1bॕmm;1;v-ub-r-u-;ˆ-Ѵ†-u‹-0ou7-uѴovub;v]ov‹orou|†mb7-7;vb7;m|b=b1-7ovr-u-;ѴѴo]uo
7;Ѵovo0f;|bˆov7;Ѵ--†7b|ouझ-ĺ
ĺ m=oul-1bॕm t†; u;vr-Ѵ7- -Ѵ ŐѴovő Ѵझ7;u Ő;vő 7;Ѵ ;t†bro 7; -†7b|ouझ- ;m v†v bm|;u-11bom;v 1om ;Ѵ
-†7b|-7or-u-Ѵ-;=;1|bˆb7-77;Ѵruo]u-l-7;-†7b|ouझ-ĺ

Gestión de los Resultados del Programa de Auditoría

-vr;uvom-vt†;];v|bom-m;Ѵruo]u-l-7;-†7b|ouझ-7;0;uझ-m]-u-m|bŒ-ut†;v;u;-Ѵb1;mѴ-vvb]†b;m|;v
-1|bˆb7-7;vĹ

ĺ ˆ-Ѵ†-1bॕm7;ѴѴo]uo7;Ѵovo0f;|bˆovr-u-1-7--†7b|ouझ-7;m|uo7;Ѵruo]u-l-7;-†7b|ouझ-ĺ
ĺ !;ˆbvbॕm‹-ruo0-1bॕm7;bm=oul;v7;-†7b|ouझ-vo0u;;Ѵ1†lrѴblb;m|o7;Ѵ-Ѵ1-m1;‹Ѵovo0f;|bˆov

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

7;Ѵ--†7b|ouझ-ĺ
ĺ !;ˆbvbॕm7;Ѵ-;=;1|bˆb7-77;Ѵ-v-11bom;v|ol-7-vr-u--0ou7-uѴov_-ѴѴ-Œ]ov7;-†7b|ouझ-ĺ
ĺ bv|ub0†1bॕm7;bm=oul;v7;-†7b|ouझ--Ѵ-vr-u|;vbm|;u;v-7-vr;u|bm;m|;vĺ
ĺ ;|;ulbm-1bॕm7;Ѵ-m;1;vb7-77;1†-Ѵt†b;u-†7b|ouझ-7;v;]†blb;m|oĺ

-r;uvom-t†;-7lbmbv|u-;Ѵruo]u-l-7;-†7b|ouझ-7;0;uझ-1omvb7;u-uķ1†-m7o1ouu;vrom7-Ĺ
վ ol†mb1-uѴovu;v†Ѵ|-7ov7;-†7b|ouझ-‹Ѵ-vl;fou;vru࢙1|b1-v-o|u-v࢙u;-v7;Ѵ-ou]-mbŒ-1bॕmĺ
վ -vblrѴb1-1bom;vr-u-o|uovruo1;vovĺ

Administrar y Mantener los Registros del Programa de Auditoría

-v r;uvom-v t†; -7lbmbv|u-m ;Ѵ ruo]u-l- 7; -†7b|ouझ- 7;0;uझ-m ]-u-m|bŒ-u t†; Ѵov u;]bv|uov 7;
-†7b|ouझ-v;];m;u;mķ-7lbmbv|u;m‹l-m|;m]-mr-u-7;lov|u-uѴ-blrѴ;l;m|-1bॕm7;Ѵruo]u-l-7;
-†7b|ouझ-ĺ

101
 ovu;]bv|uovr†;7;mbm1Ѵ†buѴovb]†b;m|;Ĺ

ĺ !;]bv|uovu;Ѵ-1bom-7ov1om;Ѵruo]u-l-7;-†7b|ouझ-ķ|-Ѵ;v1oloĹ
վ -Ѵ;m7-ubo7;-†7b|ouझ-vĺ
վ 0f;|bˆov‹-Ѵ1-m1;7;Ѵruo]u-l-7;-†7b|ouझ-ĺ
վ t†;ѴѴov t†; -0ou7-m Ѵov ub;v]ov ‹ orou|†mb7-7;v 7;Ѵ ruo]u-l- 7; -†7b|ouझ-ķ ‹ Ѵov ruo0Ѵ;l-v
;Š|;umov;bm|;umovu;Ѵ;ˆ-m|;vĺ
վ !;ˆbvbom;v7;Ѵ-;=;1|bˆb7-77;Ѵruo]u-l-7;-†7b|ouझ-ĺ

ĺ !;]bv|uovu;Ѵ-1bom-7ov1om1-7--†7b|ouझ-ķ|-Ѵ;v1oloĹ
վ Ѵ-m;v7;-†7b|ouझ-;bm=oul;v7;-†7b|ouझ-ĺ
վ ˆb7;m1b-7;-†7b|ouझ-o0f;|bˆ-‹_-ѴѴ-Œ]ovĺ
վ m=oul;v7;mo1om=oulb7-7ĺ
վ ouu;11bom;v;bm=oul;v7;-11bom;v1ouu;1|bˆ-vĺ
վ m=oul;v7;v;]†blb;m|o7;-†7b|ouझ-ĺ

ĺ !;]bv|uovu;Ѵ-1bom-7ov1om;Ѵ;t†bro7;-†7b|ouझ-t†;1†0u;m|;l-v|-Ѵ;v1oloĹ
վ ˆ-Ѵ†-1bॕm7;1olr;|;m1b-‹7;v;lr;ोo7;Ѵovlb;l0uov7;Ѵ;t†bro7;-†7b|ouझ-ĺ
վ ub|;ubovr-u-Ѵ-v;Ѵ;11bॕm7;;t†brov7;-†7b|ouझ-‹lb;l0uov7;Ѵ;t†bro‹=oul-1bॕm7;;t†brov
7;-†7b|ouझ-ĺ
վ -m|;mblb;m|o‹l;fou-7;Ѵ-1olr;|;m1b-ĺ

-vr;uvom-vt†;];v|bom-m;Ѵruo]u-l-7;-†7b|ouझ-7;0;uझ-m]-u-m|bŒ-uѴ-;ˆ-Ѵ†-1bॕm7;Ĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

ĺ "झ v; ;v|࢙m 1†lrѴb;m7o Ѵov 1uomo]u-l-v ‹ vb v; ;v|࢙m Ѵo]u-m7o Ѵov o0f;|bˆov 7;Ѵ ruo]u-l- 7;
-†7b|ouझ-ĺ
ĺ Ѵ7;v;lr;ोo7;Ѵovlb;l0uov7;Ѵ;t†bro7;-†7b|ouझ-ķbm1Ѵ†b7o;ѴѴझ7;u7;Ѵ;t†bro7;-†7b|ouझ-‹
Ѵov;Šr;u|ov|࣐1mb1ovĺ
ĺ -1-r-1b7-77;Ѵov;t†brov7;-†7b|ouझ-r-u-blrѴ;l;m|-u;ѴrѴ-m7;-†7b|ouझ-ĺ
ĺ !;|uo-Ѵbl;m|-1bॕm7;1Ѵb;m|;v7;-†7b|ouझ-ķ-†7b|-7ovķ-†7b|ou;vķ;Šr;u|ov|࣐1mb1ov‹o|u-vr-u|;v
u;Ѵ;ˆ-m|;vĺ
ĺ "†=b1b;m1b-‹-7;1†-1bॕm7;Ѵ-bm=oul-1bॕm7o1†l;m|-7-;m|o7o;Ѵruo1;vo7;-†7b|ouझ-ĺ

Revisión y Mejora del Programa de Auditoría

-v r;uvom-v t†; ];v|bom-m ;Ѵ ruo]u-l- 7; -†7b|ouझ- ‹ ;Ѵ 1Ѵb;m|; 7; -†7b|ouझ- 7;0;uझ-m u;ˆbv-u ;Ѵ
ruo]u-l-7;-†7b|ouझ-r-u-;ˆ-Ѵ†-uvbv;_-m-Ѵ1-mŒ-7ov†vo0f;|bˆovĺ

102
-u;ˆbvbॕm7;Ѵruo]u-l-7;-†7b|ouझ-7;0;uझ-1omvb7;u-uѴovb]†b;m|;Ĺ

ĺ !;v†Ѵ|-7ov‹|;m7;m1b-v7;Ѵv;]†blb;m|o7;Ѵruo]u-l-7;-†7b|ouझ-ĺ
ĺ om=oulb7-71omѴovruo1;vov7;Ѵruo]u-l-7;-†7b|ouझ-;bm=oul-1bॕm7o1†l;m|-7-u;Ѵ;ˆ-m|;ĺ
ĺ -;ˆoѴ†1bॕm7;Ѵ-vm;1;vb7-7;v‹;Šr;1|-|bˆ-v7;Ѵ-vr-u|;vbm|;u;v-7-vr;u|bm;m|;vĺ
ĺ
!;]bv|uov7;Ѵruo]u-l-7;-†7b|ouझ-ĺ
ĺ ࣐|o7ov7;-†7b|ouझ--Ѵ|;um-|bˆovom†;ˆovĺ
ĺ ࣐|o7ov-Ѵ|;um-|bˆovom†;ˆovr-u-;ˆ-Ѵ†-u-Ѵov-†7b|ou;vĺ
ĺ =;1|bˆb7-7 7; Ѵ-v -11bom;v r-u- -0ou7-u Ѵov ub;v]ov ‹ orou|†mb7-7;vķ ‹ ruo0Ѵ;l-v bm|;umov ‹
;Š|;umov-vo1b-7ov1om;Ѵruo]u-l-7;-†7b|ouझ-ĺ
ĺ †;v|bom;v 7; 1om=b7;m1b-Ѵb7-7‹ v;]†ub7-7 7; Ѵ- bm=oul-1bॕm u;Ѵ-1bom-7-v 1om ;Ѵ ruo]u-l- 7;
-†7b|ouझ-ĺ

Establecer Contacto con el Auditado

vu;vromv-0bѴb7-77;Ѵ-†7b|ouѴझ7;uĺ

Propósito

ĺ om=bul-uѴov1-m-Ѵ;v7;1ol†mb1-1bॕm1omѴovu;ru;v;m|-m|;v7;Ѵ-†7b|-7oĺ
ĺ om=bul-uѴ--†|oub7-7r-u-u;-ѴbŒ-uѴ--†7b|ouझ-ĺ
ĺ uorou1bom-ubm=oul-1bॕmu;Ѵ;ˆ-m|;vo0u;Ѵovo0f;|bˆovķ;Ѵ-Ѵ1-m1;ķѴov1ub|;ubovķѴovl࣐|o7ov‹Ѵ-
1olrovb1bॕm7;Ѵ;t†bro7;-†7b|ouझ-ķbm1Ѵ†b7ovѴov;Šr;u|ov|࣐1mb1ovĺ
ĺ "oѴb1b|-u-11;vo-bm=oul-1bॕmu;Ѵ;ˆ-m|;r-u-=bm;v7;rѴ-mb=b1-1bॕmķbm1Ѵ†b7-bm=oul-1bॕmvo0u;Ѵov

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

ub;v]ov‹orou|†mb7-7;vt†;Ѵ-ou]-mbŒ-1bॕm_-b7;m|b=b1-7o‹1ॕlov;-0ou7-mĺ
ĺ ;|;ulbm-uѴovu;t†bvb|ovѴ;]-Ѵ;v‹u;]Ѵ-l;m|-ubov-rѴb1-0Ѵ;v‹o|uovu;t†bvb|ovu;Ѵ;ˆ-m|;vr-u-Ѵ-v
-1|bˆb7-7;vķruo1;vovķruo7†1|ov‹v;uˆb1bov7;Ѵ-†7b|-7oĺ
ĺ om=bul-u ;Ѵ -1†;u7o 1om ;Ѵ -†7b|-7o vo0u; ;Ѵ -Ѵ1-m1; 7; Ѵ- 7bˆ†Ѵ]-1bॕm ‹ ;Ѵ |u-|-lb;m|o 7; Ѵ-
bm=oul-1bॕm1om=b7;m1b-Ѵĺ
ĺ -1;u-uu;]Ѵovr-u-Ѵ--†7b|ouझ-bm1Ѵ†‹;m7o;Ѵ1uomo]u-l-ĺ
ĺ ;|;ulbm-u Ѵov -uu;]Ѵov ;vr;1झ=b1ov 7; †0b1-1bॕm r-u- ;Ѵ -11;voķ Ѵ- v-Ѵ†7 ‹ Ѵ- v;]†ub7-7ķ Ѵ-
1om=b7;m1b-Ѵb7-7†o|uovĺ
ĺ 1ou7-uѴ--vbv|;m1b-7;Ѵovo0v;uˆ-7ou;v‹Ѵ-m;1;vb7-77;]†झ-vobm|࣐uru;|;vr-u-;Ѵ;t†bro7;
-†7b|ouझ-ĺ
ĺ ;|;ulbm-u1†-Ѵt†b;u࢙u;-7;bm|;u࣐vķru;o1†r-1bॕmoub;v]or-u-;Ѵ-†7b|-7o;mu;Ѵ-1bॕm1omѴ-
-†7b|ouझ-;vr;1झ=b1-ĺ
ĺ !;voѴˆ;uruo0Ѵ;l-vu;Ѵ-1bom-7ov1omѴ-1olrovb1bॕm7;Ѵ;t†bro7;-†7b|ouझ-1om;Ѵ-†7b|-7oo;Ѵ
1Ѵb;m|;7;-†7b|ouझ-ĺ

103
 Determinación de la Viabilidad de la Auditoría

- 7;|;ulbm-1bॕm 7; Ѵ- ˆb-0bѴb7-7 7;0;uझ- |;m;u ;m 1†;m|- =-1|ou;v 1olo Ѵ- 7bvromb0bѴb7-7 7; Ѵo
vb]†b;m|;Ĺ

ĺ m=oul-1bॕmv†=b1b;m|;‹-ruorb-7-r-u-rѴ-mb=b1-u‹ѴѴ;ˆ-u-1-0oѴ--†7b|ouझ-ĺ
ĺ oor;u-1bॕm-7;1†-7-7;Ѵ-†7b|-7oĺ
ĺ $b;lro‹u;1†uvov-7;1†-7ovr-u-u;-ѴbŒ-uѴ--†7b|ouझ-ĺ

Realizar Revisión de Información Documentada

;0;uझ-u;ˆbv-uv;Ѵ-7o1†l;m|-1bॕmr-u-Ĺ

վ !;1orbѴ-ubm=oul-1bॕmr-u-1olru;m7;uѴ-vor;u-1bom;v7;Ѵ-†7b|-7o‹ru;r-u-uѴ-v-1|bˆb7-7;v7;
-†7b|ouझ-‹Ѵov7o1†l;m|ov7;|u-0-fo7;-†7b|ouझ--rѴb1-0Ѵ;vՈ;uѵĺƒĺƓőķrou;f;lrѴoĸ;mruo1;vov
‹=†m1bom;vĺ

վ v|-0Ѵ;1;u †m- ˆbvbॕm ];m;u-Ѵ 7;Ѵ -Ѵ1-m1; 7; Ѵ- bm=oul-1bॕm 7o1†l;m|-7- r-u- 7;|;ulbm-u Ѵ-
rovb0Ѵ;1om=oulb7-71omѴov1ub|;ubov7;-†7b|ouझ-‹7;|;1|-urovb0Ѵ;v࢙u;-v7;ru;o1†r-1bॕmķ1olo
7;=b1b;m1b-vķolbvbom;vo1om=Ѵb1|ovĺ

-bm=oul-1bॕm7o1†l;m|-7-7;0;uझ-bm1Ѵ†buķr;uomoѴblb|-uv;-Ĺ
վ o1†l;m|ov‹u;]bv|uov7;Ѵvbv|;l-7;];v|bॕmĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

վ m=oul;v7;-†7b|ouझ--m|;ubou;vĺ

-u;ˆbvbॕm7;0;uझ-|;m;u;m1†;m|-;Ѵ1om|;Š|o7;Ѵ-ou]-mbŒ-1bॕm7;Ѵ-†7b|-7oķbm1Ѵ†b7ovv†|-l-ोoķ
m-|†u-Ѵ;Œ-‹1olrѴ;fb7-7ķ‹v†vub;v]ov‹orou|†mb7-7;vu;Ѵ-1bom-7ovĺ$-l0b࣐m7;0;uझ-|;m;u;m1†;m|-
;Ѵ-Ѵ1-m1;ķѴov1ub|;ubov‹Ѵovo0f;|bˆov7;Ѵ--†7b|ouझ-ĺ

Planificación de Auditoría

m=ot†;0-v-7o;m;Ѵub;v]or-u-Ѵ-rѴ-mb=b1-1bॕmĺ

Ѵ Ѵझ7;u 7;Ѵ ;t†bro 7; -†7b|ouझ- 7;0;uझ- -7or|-u †m ;m=ot†; 0-v-7o ;m ;Ѵ ub;v]o r-u- rѴ-mb=b1-u Ѵ-
-†7b|ouझ- 1om 0-v; ;m Ѵ- bm=oul-1bॕm 7;Ѵ ruo]u-l- 7; -†7b|ouझ- ‹ Ѵ- bm=oul-1bॕm 7o1†l;m|-7-
ruorou1bom-7-rou;Ѵ-†7b|-7oĺ

104
ѴrѴ-mb=b1-uѴ--†7b|ouझ-ķ;ѴѴझ7;u7;Ѵ;t†bro-†7b|ou7;0;uझ-1omvb7;u-uѴovb]†b;m|;Ĺ

ĺ -1olrovb1bॕm7;Ѵ;t†bro7;-†7b|ouझ-‹v†1olr;|;m1b-];m;u-Ѵĺ
ĺ -v|࣐1mb1-v7;l†;v|u;o-ruorb-7-vĺ
ĺ rou|†mb7-7;vr-u-l;fou-uѴ-;=;1|bˆb7-7‹;=b1b;m1b-7;Ѵ-v-1|bˆb7-7;v7;-†7b|ouझ-ĺ
ĺ ovub;v]ovr-u-Ѵo]u-uѴovo0f;|bˆov7;-†7b|ouझ-1u;-7ovrou†m-rѴ-mb=b1-1bॕm7;-†7b|ouझ-bm;=b1-Œĺ
ĺ ovub;v]ovr-u-;Ѵ-†7b|-7o1u;-7ov-Ѵu;-ѴbŒ-uѴ--†7b|ouझ-ĺ

Detalles de planificación de auditoría

-rѴ-mb=b1-1bॕm7;Ѵ--†7b|ouझ-7;0;uझ--0ou7-uo_-1;uu;=;u;m1b--Ѵovb]†b;m|;Ĺ

ĺ ovo0f;|bˆov7;Ѵ--†7b|ouझ-ĺ
ĺ Ѵ-Ѵ1-m1;7;Ѵ--†7b|ouझ-ķbm1Ѵ†b7-Ѵ-b7;m|b=b1-1bॕm7;Ѵ-ou]-mbŒ-1bॕm‹v†v=†m1bom;vķ-vझ1oloѴov
ruo1;vov--†7b|-uĺ
ĺ ov1ub|;ubov7;-†7b|ouझ-‹1†-Ѵt†b;ubm=oul-1bॕm7o1†l;m|-7-7;u;=;u;m1b-ĺ
ĺ -v†0b1-1bom;vŐ=झvb1-v‹ˆbu|†-Ѵ;vőķѴ-v=;1_-vķ;Ѵ|b;lroru;ˆbv|o‹Ѵ-7†u-1bॕm7;Ѵ-v-1|bˆb7-7;v7;
-†7b|ouझ-t†;v;ѴѴ;ˆ-u࢙m-1-0oķbm1Ѵ†b7-vѴ-vu;†mbom;v1omѴ--7lbmbv|u-1bॕm7;Ѵ-†7b|-7oĺ
ĺ -m;1;vb7-77;t†;;Ѵ;t†bro7;-†7b|ouझ-v;=-lbѴb-ub1;1omѴ-vbmv|-Ѵ-1bom;v‹Ѵovruo1;vov7;Ѵ
-†7b|-7o Őrou ;f;lrѴoķ u;-ѴbŒ-m7o †m u;1ouub7o rou Ѵ- Ővő †0b1-1bॕm Ő;vő =झvb1- Ővőķ o u;ˆbv-m7o Ѵ-
|;1moѴo]झ-7;bm=oul-1bॕm‹1ol†mb1-1bॕmőĺ
ĺ ovl࣐|o7ov7;-†7b|ouझ-t†;v;†|bѴbŒ-u࢙mķbm1Ѵ†b7o;Ѵ]u-7o;mt†;;Ѵl†;v|u;o7;-†7b|ouझ-;v
m;1;v-ubor-u-o0|;m;uv†=b1b;m|;;ˆb7;m1b-7;-†7b|ouझ-ĺ
ĺ -v =†m1bom;v ‹ u;vromv-0bѴb7-7;v 7; Ѵov lb;l0uov 7;Ѵ ;t†bro 7; -†7b|ouझ-ķ -vझ 1olo ]†झ-v ‹

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

o0v;uˆ-7ou;vobm|࣐uru;|;vĺ
ĺ --vb]m-1bॕm7;u;1†uvov-ruorb-7ov;m0-v;-Ѵ-1omvb7;u-1bॕm7;Ѵovub;v]ov‹orou|†mb7-7;v
u;Ѵ-1bom-7ov1omѴ-v-1|bˆb7-7;vt†;v;-†7b|-u࢙mĺ

-rѴ-mb=b1-1bॕm7;Ѵ--†7b|ouझ-7;0;uझ-|;m;u;m1†;m|-ķv;]িm1ouu;vrom7-Ĺ

վ 7;m|b=b1-1bॕm7;ѴŐѴovőu;ru;v;m|-m|;Ővő7;Ѵ-†7b|-7or-u-Ѵ--†7b|ouझ-ĺ
վ ѴѴ;m]†-f;7;|u-0-fo‹7;bm=oul;v7;Ѵ--†7b|ouझ-1†-m7o;v|o;v7b=;u;m|;7;ѴѴ;m]†-f;7;Ѵ-†7b|ou
o;Ѵ-†7b|-7oo-l0ovĺ
վ ov|;l-v7;Ѵbm=oul;7;-†7b|ouझ-ĺ
վ uu;]Ѵov7;Ѵo]झv|b1-‹1ol†mb1-1bom;vķbm1Ѵ†b7ov-uu;]Ѵov;vr;1झ=b1ovr-u-Ѵ-v†0b1-1bom;vt†;v;
-†7b|-u࢙mĺ
վ †-Ѵt†b;u-11bॕm;vr;1झ=b1-t†;v;|ol;r-u--0ou7-uѴovub;v]ovr-u--Ѵ1-mŒ-uѴovo0f;|bˆov7;
-†7b|ouझ-‹Ѵ-vorou|†mb7-7;vt†;v†uf-mĺ
վ †;v|bom;vu;Ѵ-1bom-7-v1omѴ-1om=b7;m1b-Ѵb7-7‹Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ

105
 վ †-Ѵt†b;u-11bॕm7;v;]†blb;m|o7;†m--†7b|ouझ--m|;ubou†o|u-Ővő=†;m|;Ő;vőķrou;f;lrѴoĹ
վ ;11bom;v-ru;m7b7-vķu;ˆbvbom;v7;ruo‹;1|ovĺ
վ †-Ѵt†b;u-1|bˆb7-77;v;]†blb;m|o7;Ѵ--†7b|ouझ-rѴ-mb=b1-7-ĺ
վ oou7bm-1bॕm1omo|u-v-1|bˆb7-7;v7;-†7b|ouझ-ķ;m1-vo7;†m--†7b|ouझ-1omf†m|-ĺ

ѴrѴ-m7;-†7b|ouझ-7;0;uझ-bm1Ѵ†buĹ

Ɛĺ ovo0f;|bˆov7;Ѵ--†7b|ouझ-ĺ
Ƒĺ Ѵ-Ѵ1-m1;7;Ѵ--†7b|ouझ-ĺ
ƒĺ ov1ub|;ubov7;Ѵ--†7b|ouझ-ĺ
Ɠĺ &0b1-1bॕmķ Ѵ-v =;1_-vķ ;Ѵ _ou-ubo ‹ Ѵ- 7†u-1bॕm bm1Ѵ†‹;m7o Ѵ-v u;†mbom;v 1om Ѵ- 7bu;11bॕm 7;Ѵ
-†7b|-7oĺ
Ɣĺ -v =†m1bom;v‹ u;vromv-0bѴb7-7;v 7; Ѵov lb;l0uov 7;Ѵ ;t†bro -†7b|ouķ -vझ 1olo Ѵov ]†झ-v‹
o0v;uˆ-7ou;vĺ
ѵĺ --vb]m-1bॕm7;Ѵovu;1†uvovm;1;v-ubovĺ
ƕĺ -b7;m|b=b1-1bॕm7;Ѵu;ru;v;m|-m|;7;Ѵ-†7b|-7oĺ
Ѷĺ Ѵb7bol-ĺ

ѴrѴ-m7;-†7b|ouझ-r†;7;v;uu;ˆbv-7o‹-1;r|-7orou;Ѵ1Ѵb;m|;7;Ѵ--†7b|ouझ-‹7;0;uझ-ru;v;m|-uv;
-Ѵ-†7b|-7oĺ

Taller 1
վ Elaborar Plan de Auditoría.
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

Taller 2

վ Matriz de Plan de Auditoría.

106
Asignación de Tareas al Equipo Auditor
Ѵ Ѵझ7;u 7;Ѵ ;t†bro -†7b|ouķ 1omv†Ѵ|-m7o 1om ;Ѵ ;t†bro -†7b|ouķ -vb]m- - 1-7- lb;l0uo 7;Ѵ ;t†bro
u;vromv-0bѴb7-7r-u-Ĺ
վ †7b|-uruo1;vovĺ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

վ 1|bˆb7-7;vĺ
վ †m1bom;vĺ
վ †]-u;v;vr;1झ=b1ovĺ

-v-vb]m-1bom;v7;0;uझ-m1omvb7;u-uѴ-m;1;vb7-77;Ĺ
վ m7;r;m7;m1b-‹1olr;|;m1b-7;Ѵov-†7b|ou;vĺ
վ Ѵ†vo;=b1-Œ7;Ѵovu;1†uvovĺ
վ b=;u;m|;v =†m1bom;v ‹ u;vromv-0bѴb7-7;v 7; Ѵov -†7b|ou;vķ -†7b|ou;v ;m =oul-1bॕm ‹ ;Šr;u|ov
|࣐1mb1ovĺ

107
 Funciones y Responsabilidades de Guías y Observadores

ov]†झ-v‹o0v;uˆ-7ou;vr†;7;m-1olr-ो-u-Ѵ;t†bro7;-†7b|ouझ-1omѴ-v-ruo0-1bom;v7;ѴѴझ7;u7;Ѵ
;t†bro7;-†7b|ouझ-ķ;Ѵ1Ѵb;m|;7;-†7b|ouझ-‹ņo;Ѵ-†7b|-7oķ7;v;um;1;v-uboĺ

o7;0;uझ-mbm=Ѵ†bumbbm|;u=;ubu;mѴ-u;-ѴbŒ-1bॕm7;Ѵ--†7b|ouझ-ĺ"b;v|omor†;7;]-u-m|bŒ-uv;ķ;ѴѴझ7;u
7;Ѵ;t†bro-†7b|ou7;0;uझ-|;m;u;Ѵ7;u;1_o7;m;]-uѴ-ru;v;m1b-7;o0v;uˆ-7ou;v7†u-m|;1b;u|-v
-1|bˆb7-7;v7;-†7b|ouझ-ĺ

-u-Ѵov†झ-vv†vu;vromv-0bѴb7-7;v7;0;uझ-mbm1Ѵ†buѴovb]†b;m|;Ĺ

ĺ ‹†7-u-Ѵov-†7b|ou;v-b7;m|b=b1-u-Ѵovbm7bˆb7†ovr-u-t†;r-u|b1br;m;mѴ-v;m|u;ˆbv|-v‹1om=bul;m
Ѵov_ou-ubov‹Ѵ-v†0b1-1bom;vĺ
ĺ u]-mbŒ-u;Ѵ-11;vo-†0b1-1bom;v;vr;1झ=b1-v7;Ѵ-†7b|-7oĺ
ĺ -u-m|bŒ-ut†;Ѵovlb;l0uov7;Ѵ;t†bro7;-†7b|ouझ-‹Ѵovo0v;uˆ-7ou;v1omoŒ1-m‹u;vr;|;mѴ-v
moul-vu;Ѵ-|bˆ-v-Ѵov-1†;u7ov;vr;1झ=b1ov7;Ѵo1-ѴbŒ-1bॕmr-u-;Ѵ-11;voķѴ-v-Ѵ†7‹Ѵ-v;]†ub7-7ķ
;Ѵl;7bo-l0b;m|;ķѴ-v;]†ub7-7ķѴ-1om=b7;m1b-Ѵb7-7‹o|uov-v†m|ovķ‹t†;v;-0ou7;mѴovub;v]ovĺ
ĺ ";u|;v|b]o7;Ѵ--†7b|ouझ-;mmol0u;7;Ѵ-†7b|-7oķ1†-m7o1ouu;vrom7-ĺ
ĺ uorou1bom-u-1Ѵ-u-1bom;vo-‹†7-u-u;1orbѴ-ubm=oul-1bॕmķ1†-m7ov;-m;1;v-uboĺ

Preparación de los Documentos de Trabajos

ov lb;l0uov 7;Ѵ ;t†bro -†7b|ou 7;0;m u;1orbѴ-u ‹ u;ˆbv-u Ѵ- bm=oul-1bॕm r;u|bm;m|; - Ѵ-v |-u;-v
-vb]m-7-v‹ru;r-u-uѴov7o1†l;m|ov7;|u-0-foķv;]িmv;-m;1;v-uboķr-u-u;=;u;m1b-‹u;]bv|uo7;
;ˆb7;m1b-v7;Ѵ--†7b|ouझ-ĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

108
 Posibles Ventajas de las Listas de Verificación

ĺ v;]†u-mt†;m-7-blrou|-m|;v;r-v;rou-Ѵ|oĺ
ĺ ‹†7-m-0ubm7-u1om|bm†b7-7-Ѵ--†7b|ouझ-ĺ
ĺ ‹†7-m-rѴ-mb=b1-u†m--†7b|ouझ-;=b1-Œĺ
ĺ ‹†7-m-b7;m|b=b1-uѴov-vr;1|ovl࢙v1uझ|b1ov7;Ѵvbv|;l-ĺ
ĺ ‹†7-m-1om|uoѴ-uѴ-ruo=†m7b7-7ķ1om|bm†b7-7‹ub|lo7;Ѵ--†7b|ouझ-ĺ
ĺ !;]bv|u-mѴov_-ѴѴ-Œ]ovrovb|bˆov‹m;]-|bˆovĺ
ĺ †;7;mruorou1bom-u†mu;]bv|uo7;orou|†mb7-7;v7;l;fou-ĺ
ĺ -vѴbv|-v7;ˆ;ub=b1-1bॕmru;ˆb-l;m|;1om=;11bom-7-vr†;7;mbm_b0bu-Ѵov-†7b|ou;vĺ
ĺ ov-†7b|ou;vr†;7;mr-v-urou-Ѵ|o1†;v|bom;vblrou|-m|;vroumo;v|-ubm1Ѵ†b7-v;mѴ-vѴbv|-v7;
ˆ;ub=b1-1bॕmĺ

Uso de las Listas de Verificación

ĺ omvb7;u-uѴ-vѴbv|-v7;ˆ;ub=b1-1bॕm1olo†m-‹†7-l;loub-ĺ
ĺ ˆb|-uv;m|buv;bm_b0b7ovrou;ѴѴ-vĺ
ĺ v1ub0buruoѴbf-l;m|;ĹѴ-Ѵbv|-7;ˆ;ub=b1-1bॕm;vr-u|;7;Ѵbm=oul;7;-†7b|ouझ-ĺ
ĺ !;]bv|u-u1om1Ѵ†vbom;v=bm-Ѵ;vĺ
ĺ !;]bv|u-uorou|†mb7-7;v7;l;fou-ĺ
ĺ !;]bv|u-ub7;m|b7-7;v;vr;1झ=b1-v7;Ѵ-vl†;v|u-v;Š-lbm-7-vĺ

Taller 3

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

վ Elaborar una lista de verificación para auditar las clausulas señaladas por el instructor.

109
 Reunión de Apertura

PROPÓSITO:

ĺ om=bul-u;Ѵ-1†;u7o7;|o7ovѴovr-u|b1br-m|;vŐrou;f;lrѴoķ-†7b|-7oķ;t†bro7;-†7b|ouझ-ő1om;Ѵ
rѴ-m7;-†7b|ouझ-ĺ
ĺ u;v;m|-u-Ѵ;t†bro7;-†7b|ouझ-‹v†vuoѴ;vĺ
ĺ -u-m|bŒ-ut†;v;r†;7-mu;-ѴbŒ-u|o7-vѴ-v-1|bˆb7-7;v7;-†7b|ouझ-rѴ-mb=b1-7-vĺ

PUNTOS A CONSIDERAR:

վ ovo0f;|bˆovķ;Ѵ-Ѵ1-m1;‹Ѵov1ub|;ubov7;Ѵ--†7b|ouझ-ĺ
վ ѴrѴ-m7;-†7b|ouझ-‹o|uov-uu;]Ѵovu;Ѵ;ˆ-m|;v1om;Ѵ-†7b|-7oķ1oloѴ-=;1_-‹_ou-7;Ѵ-u;†mbॕm
7;1b;uu;ķ1†-Ѵt†b;uu;†mbॕmbm|;ubm-;m|u;;Ѵ;t†bro7;-†7b|ouझ-‹Ѵ--7lbmbv|u-1bॕm7;Ѵ-†7b|-7oķ
‹1†-Ѵt†b;u1-l0bom;1;v-uboĺ
վ -m-Ѵ;v7;1ol†mb1-1bॕm=oul-Ѵ;v;m|u;;Ѵ;t†bro7;-†7b|ouझ-‹;Ѵ-†7b|-7oĺ
վ Ѵb7bol-t†;v;†|bѴbŒ-u࢙7†u-m|;Ѵ--†7b|ouझ-ĺ
վ Ѵ-†7b|-7o7;0;uझ-l-m|;m;uv;bm=oul-7o7;Ѵruo]u;vo7;Ѵ--†7b|ouझ-7†u-m|;Ѵ--†7b|ouझ-ĺ
վ -7bvromb0bѴb7-77;Ѵovu;1†uvov‹Ѵ-vbmv|-Ѵ-1bom;vt†;m;1;vb|-;Ѵ;t†bro7;-†7b|ouझ-ĺ
վ †;v|bom;vu;Ѵ-1bom-7-v1omѴ-1om=b7;m1b-Ѵb7-7‹Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ
վ 11;vo u;Ѵ;ˆ-m|;ķ v-Ѵ†7 ‹ v;]†ub7-7ķ v;]†ub7-7ķ ;l;u];m1b- ‹ o|uov -uu;]Ѵov r-u- ;Ѵ ;t†bro 7;
-†7b|ouझ-ĺ
վ 1|bˆb7-7;v;m;Ѵvb|bot†;r†;7;m-=;1|-uѴ-u;-ѴbŒ-1bॕm7;Ѵ--†7b|ouझ-ĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

- ru;v;m|-1bॕm 7; bm=oul-1bॕm vo0u; Ѵov vb]†b;m|;v ;Ѵ;l;m|ov v; 7;0;uझ- 1omvb7;u-uķ v;]িm
1ouu;vrom7-Ĺ
վ Ѵl࣐|o7o7;bm=oul-uѴov_-ѴѴ-Œ]ov7;Ѵ--†7b|ouझ-ķbm1Ѵ†b7ovѴov1ub|;ubovr-u-Ѵ-1-Ѵb=b1-1bॕmķvb
1ouu;vrom7;ĺ
վ om7b1bom;v0-foѴ-v1†-Ѵ;vr†;7;7-uv;rou|;ulbm-7-Ѵ--†7b|ouझ-ĺ
վ ॕlo|u-|-u1omrovb0Ѵ;v_-ѴѴ-Œ]ov7†u-m|;Ѵ--†7b|ouझ-ĺ
վ †-Ѵt†b;u vbv|;l- 7; u;|uo-Ѵbl;m|-1bॕm 7;Ѵ -†7b|-7o vo0u; Ѵov _-ѴѴ-Œ]ov o 1om1Ѵ†vbom;v 7; Ѵ-
-†7b|ouझ-ķbm1Ѵ†b7-vѴ-vt†;f-vo-r;Ѵ-1bom;vĺ

110
Revisión de la Documentación en la Auditoría

-bm=oul-1bॕm7o1†l;m|-7-u;Ѵ;ˆ-m|;7;Ѵ-†7b|-7o7;0;uझ-v;uu;ˆbv-7-r-u-Ĺ
վ ;|;ulbm-uѴ-1om=oulb7-77;Ѵvbv|;l-ķ;mѴ-l;7b7-7o1†l;m|-7-ķ1omѴov1ub|;ubov7;-†7b|ouझ-ĺ
վ !;1orbѴ-ubm=oul-1bॕmr-u--ro‹-uѴ-v-1|bˆb7-7;v7;-†7b|ouझ-ĺ

-u;ˆbvbॕmv;r†;7;1ol0bm-u1omѴ-vo|u-v-1|bˆb7-7;v7;-†7b|ouझ-‹r†;7;1om|bm†-u-ѴoѴ-u]o7;Ѵ-
-†7b|ouझ-ķvb;lru;t†;;v|omov;-r;uf†7b1b-Ѵr-u-Ѵ-;=;1|bˆb7-77;Ѵ-u;-ѴbŒ-1bॕm7;Ѵ--†7b|ouझ-ĺ

"bmov;r†;7;ruorou1bom-uѴ-bm=oul-1bॕm7o1†l;m|-7--7;1†-7-7;m|uo7;Ѵl-u1o7;|b;lro7-7o
;m;ѴrѴ-m7;-†7b|ouझ-ķ;ѴѴझ7;u7;Ѵ;t†bro7;-†7b|ouझ-7;0;uझ-bm=oul-u|-m|o-Ѵ-Ővőr;uvom-Ővőt†;
];v|bom-m;Ѵruo]u-l-7;-†7b|ouझ-1olo-Ѵ-†7b|-7oĺ ;r;m7b;m7o7;Ѵovo0f;|bˆov‹;Ѵ-Ѵ1-m1;7;Ѵ-
-†7b|ouझ-ķv;7;0;uझ-|ol-u†m-7;1bvbॕmvo0u;vbѴ--†7b|ouझ-7;0;uझ-1om|bm†-uov†vr;m7;uv;_-v|-
t†;v;u;v†;Ѵˆ-mѴovruo0Ѵ;l-v7;bm=oul-1bॕm7o1†l;m|-7-ĺ

Comunicación Durante la Auditoría

†u-m|;Ѵ--†7b|ouझ-ķr†;7;v;um;1;v-ubo_-1;u-uu;]Ѵov=oul-Ѵ;vr-u-Ѵ-1ol†mb1-1bॕm7;m|uo7;Ѵ
;t†bro 7; -†7b|ouझ-ķ -vझ 1olo 1om ;Ѵ -†7b|-7oķ ;Ѵ 1Ѵb;m|; 7; -†7b|ouझ-‹ ro|;m1b-Ѵl;m|; 1om r-u|;v
bm|;u;v-7-v ;Š|;um-v Őrou ;f;lrѴoķ u;]†Ѵ-7ou;vőķ ;vr;1b-Ѵl;m|; 1†-m7o Ѵov u;t†bvb|ov Ѵ;]-Ѵ;v ‹
u;]Ѵ-l;m|-ubovu;t†b;u;mѴ-mo|b=b1-1bॕmo0Ѵb]-|oub-7;bm1†lrѴblb;m|oĺ

վ Ѵ;t†bro7;-†7b|ouझ-7;0;uझ-1omv†Ѵ|-ur;ubॕ7b1-l;m|;r-u-bm|;u1-l0b-ubm=oul-1bॕmķ;ˆ-Ѵ†-u;Ѵ
ruo]u;vo7;Ѵ--†7b|ouझ-‹u;-vb]m-u;Ѵ|u-0-fo;m|u;Ѵovlb;l0uov7;Ѵ;t†bro7;-†7b|ouझ-ķv;]িm

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

v;-m;1;v-uboĺ
վ †u-m|;Ѵ--†7b|ouझ-ķ;ѴѴझ7;u7;Ѵ;t†bro7;-†7b|ouझ-7;0;1ol†mb1-ur;ubॕ7b1-l;m|;;Ѵ-ˆ-m1;7;
Ѵ--†7b|ouझ-‹1†-Ѵt†b;ubmt†b;|†7-Ѵ-†7b|-7oĺ
վ †-m7oѴovo0f;|bˆov7;Ѵ--†7b|ouझ-mov;-m-Ѵ1-mŒ-0Ѵ;v;ѴѴझ7;u7;Ѵ;t†bro-†7b|ou7;0;uझ-bm=oul-u
7;Ѵ-vu-Œom;v-Ѵ-vr-u|;vbm|;u;v-7-vr-u-|ol-u-11bom;v-ruorb-7-vĺ
վ -v-11bom;vr†;7;mbm1Ѵ†buѴ-u;1om=bul-1bॕmoѴ-lo7b=b1-1bॕm7;ѴrѴ-mķ1-l0bov;mѴovo0f;|bˆovķ
-Ѵ1-m1;oѴ-bm|;uu†r1bॕm7;Ѵ--†7b|ouझ-ĺ
վ ov1-l0bov7;0;uझ-mu;ˆbv-uv;‹-ruo0-uv;|-m|orou;Ѵ];v|ou7;Ѵruo]u-l-7;-†7b|ouझ-1olorou
;Ѵ-†7b|-7oĺ

111
 Métodos para Recopilar Información

վ m|u;ˆbv|-vĺ
վ 0v;uˆ-1bॕm7;-1|bˆb7-7;voѴ†]-u;v7;|u-0-foĺ
վ !;ˆbvbॕm7;7o1†l;m|ovķbm1Ѵ†‹;m7ou;]bv|uovĺ
վ !;]bv|uovķ|-Ѵ;v1olou;rou|;v7;o1†uu;m1b-v7;;ˆ;m|ov7;v;]†ub7-7ķ7;l;7b1bom;v7;Ѵ-;=b1-1b-
7;Ѵov1om|uoѴ;vķ-1|-v7;u;†mbॕmķbm=oul;v7;-†7b|ouझ-ĺ
վ !;vিl;m;v7;7-|ovķ-m࢙Ѵbvbv;bm7b1-7ou;v7;7;v;lr;ोo7;bm1b7;m|;v7;v;]†ub7-7ĺ
վ m=oul;v7;o|u-v=†;m|;vķrou;f;lrѴoķ7-|ov7;;m|b7-7;vu;]†Ѵ-7ou-vĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

(bvbॕm];m;u-Ѵ7;†mruo1;vo|झrb1oķ7;v7;Ѵ-u;1orbѴ-1bॕm7;bm=oul-1bॕm_-v|-ѴѴ;]-u-1om1Ѵ†vbom;v
7;-†7b|ouझ-ĺ

112
La Entrevista

ĺ -v ;m|u;ˆbv|-v 7;0;m u;-ѴbŒ-uv; 1om r;uvom-v 7; mbˆ;Ѵ;v -ruorb-7ov ‹ =†m1bom;v t†; u;-ѴbŒ-m
-1|bˆb7-7;vo|-u;-v7;m|uo7;Ѵ-Ѵ1-m1;7;Ѵ--†7b|ouझ-ĺ
ĺ -v;m|u;ˆbv|-v7;0;mu;-ѴbŒ-uv;7†u-m|;;Ѵ_ou-uboѴ-0ou-Ѵmoul-Ѵ‹ķ7om7;v;-ru࢙1|b1oķ;mѴ†]-u7;
|u-0-fomoul-Ѵ7;Ѵ-r;uvom-t†;v;;v|࢙;m|u;ˆbv|-7oĺ
ĺ ";7;0;|u-|-ut†;Ѵ-r;uvom-t†;v;;m|u;ˆbv|-;v|࣐1ॕlo7--m|;v‹7†u-m|;Ѵ-;m|u;ˆbv|-ĺ
ĺ ";7;0;;ŠrѴb1-uѴ-u-Œॕmr-u-Ѵ-;m|u;ˆbv|-‹1†-Ѵt†b;umo|-t†;v;|ol;ĺ
ĺ ";7;0;mu;v†lbu‹u;ˆbv-uѴovu;v†Ѵ|-7ov7;Ѵ-;m|u;ˆbv|-1omѴ-r;uvom-;m|u;ˆbv|-7-ĺ
ĺ ";7;0;-]u-7;1;u-Ѵ-vr;uvom-v;m|u;ˆbv|-7-vrouv†r-u|b1br-1bॕm‹1oor;u-1bॕmĺ

Preguntas Claves del Auditor

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

113
 Tipo de Preguntas

վ ѿ!;-ѴbŒ-uom-†7b|ouझ-vbm|;um-vĵ վ ѿ m7ॕm7;u;]bv|u-Ѵ-bm=oul-1bॕmĵ
վ ѿ Šbv|;†m-roѴझ|b1-7;Ѵ"bv|;l-7;;v|bॕmĵ վ ѿ†࢙Ѵruo1;7blb;m|oĵ
վ ѿ Ѵ"bv|;l-7;;v|bॕm_-vb7o1ol†mb1-7oĵ վ ѿomo1;Ѵ-roѴझ|b1-ĵ
վ ѿ v†v|;7r-u|;7;Ѵ]u†ro-†7b|oubm|;umoĵ վ ѿ†lrѴ;Ѵ-Ѵ;]bvѴ-1bॕmĵ
վ ѿ Ѵ ruo1;vo v; ;f;1†|- 1olo ;v|࢙
7o1†l;m|-7oĵ

Ejecutando la Auditoría
վ -]-†ml†;v|u;o7;-1|bˆb7-7;vķmov;1;m|u;;m†m-ĺ
վ †vt†;;ˆb7;m1b-o0v;uˆ-m7oѴot†;o1†uu;‹u;ˆbv-m7ou;]bv|uovĺ
վ -]--mo|-1bom;v1olrѴ;|-vĺ
վ v1†1_;Ѵ-v;ŠrѴb1-1bom;v7;Ѵ-†7b|-7oĺ
վ  mo|; ‹ 1om=bul; Ѵov _-ѴѴ-Œ]ov † o0v;uˆ-1bom;vĺ "b |b;m; 7†7-v vo0u; ;Ѵ 1†lrѴblb;m|o 7; †m
u;t†bvb|oro7uझ-_-1;u-Ѵ]†m-vru;]†m|-v-0b;u|-v-7b1bom-Ѵ;vĺ
վ "b;lru; ;v1ub0- Ѵov 7;|-ѴѴ;v 7; Ѵo o0v;uˆ-7o o ;ˆb7;m1b-7oķ rou ;f;lrѴoķ 7;0;uझ- -mo|-u ;Ѵ
ruo1;7blb;m|o-†7b|-7oķѴovb7;m|b=b1-7ou;v7;Ѵovu;]bv|uovķm†l;uo7;ॕu7;m;vķb7;m|b=b1-1bॕm7;
Ѵo|;vķ1ॕ7b]ov7;7o1†l;m|ov;|1ĺ
վ †7b|ouझ--0b;u|-‹-lb]-0Ѵ;u;v†Ѵ|-u࢙;m†m-1†;u7o7;t†;;Ѵruo0Ѵ;l-;Šbv|;ĺ
վ (;ub=bt†;vbѴ-oom=oulb7-7;vomor†m|†-Ѵĺ

Realización de Entrevistas
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

վ ";--lb]-0Ѵ;ĺ
վ -]-v;m|bu1ॕlo7o-Ѵ-†7b|-7oĺ
վ ŠrѴb1-uѴ-vu-Œom;v7;Ѵ-;m|u;ˆbv|-‹7;Ѵ-vmo|-v|ol-7-vĺ
վ mb1b-u1om†m-7;v1ubr1bॕm7;Ѵ-v-1|bˆb7-7;vĺ
վ ou;-ѴbŒ-uru;]†m|-vbm7†1|bˆ-vŐ ˆb|-ru;]†m|-v1†‹-u;vr†;v|-v;-"oőĺ
վ ]u-7;1;u-Ѵov-†7b|-7ovĺ

¿Cómo entorpecer la Auditoría (Auditado)?

վ ;u7b7-7;|b;lroĺ
վ -m;f-u-Ѵ-†7b|ouĺ
վ "b|†-1bom;vbm;vr;u-7-vĺ
վ uo0-u;Ѵ1-u࢙1|;u7;Ѵ-†7b|ouĺ
վ !;vr†;v|-vѴblb|-7-vĺ
վ m]-ो-u-Ѵ-†7b|ouĺ

114
Administración del Tiempo

վ !;-ѴbŒ-urubl;uoѴ-v-1|bˆb7-7;vl࢙v1olrѴ;f-vo7b=झ1bѴ;vĺ
վ vb]m-u|u-0-fo-Ѵovo|uov-†7b|ou;vĺ
վ 7t†bubu;Ѵ_࢙0b|o7;_-1;uѴo7;bml;7b-|oĺ
վ omo1;u1†uˆ-7;1-mv-m1bo7;Ѵ-†7b|-7o‹-†7b|ouĺ
վ v|-0Ѵ;1;uѴblb|;7;|b;lro‹1†lrѴbuѴoĺ
վ ";u1u;-|bˆoĺ

Manejo de Situaciones Difíciles

վ Ѵ-u;†mbॕm7;-r;u|†u-mov;ru;v;m|-;Ѵu;vromv-0Ѵ;7;Ѵruo1;voo-1|bˆb7-7-†7b|-7-ĺ
վ m Ѵ- -†7b|ouझ- v; |;mझ- ru;ˆbv|o ˆbvb|-u 7ov bmv|-Ѵ-1bom;v ‹ mo _-‹ 7bvromb0Ѵ;v ˆ;_झ1†Ѵovķ mb
-1olr-ो-m|;vĺ
վ Ѵ-†7b|-7o7;vˆझ-Ѵ-ru;]†m|-7;Ѵ-†7b|ouĺ f;lrѴoĹru;]†m|-rouѴ-=oul-1olov;1om|uoѴ-mѴov
7o1†l;m|ov‹;Ѵ-†7b|-7o;ŠrѴb1-Ѵ-=oul-1olov;1om|uoѴ-mѴovu;]bv|uovķ7-7ot†;Ѵov7o1†l;m|ov
vom†m|bro7;u;]bv|uoĺ
վ Ѵ-†7b|-7ov†lbmbv|u-ro1-bm=oul-1bॕmĺ f;lrѴoĹv;voѴb1b|-bm=oul-1bॕmvo0u;Ѵovu;v†Ѵ|-7ov7;
;m;uo-l-‹o‹voѴoru;v;m|-Ѵovu;v†Ѵ|-7ov7;ѴিѴ|blol;vĺ
վ Ѵ-†7b|-7ou;=oul†Ѵ-Ѵ-vru;]†m|-v7;Ѵ-†7b|ouĺ
վ Ѵ-†7b|-7o1†;v|bom-Ѵ-vru;]†m|-v7;Ѵ-†7b|ouĺ f;lrѴoĹѴot†;†v|;7ru;]†m|-mo|b;m;v;m|b7oĺ
վ mѴ-u;†mbॕm7;-r;u|†u-mo_-‹-1†;u7o1om;Ѵo0f;|o‹-Ѵ1-m1;7;Ѵ--†7b|ouझ-ĺ

Resultados de la Auditoría

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

Hallazgo

վ !;v†Ѵ|-7ov 7; Ѵ- ;ˆ-Ѵ†-1bॕm 7; Ѵ- ;ˆb7;m1b- o0f;|bˆ- u;1orbѴ-7- =u;m|; -Ѵ 1omf†m|o 7; roѴझ|b1-vķ
ruo1;7blb;m|ovou;t†bvb|ov†|bѴbŒ-7ov1olou;=;u;m1b-ĺ
վ v u;]bv|u-7o ;m Ѵ- Ѵbv|- 7; ˆ;ub=b1-1bॕm 1olo u;vr†;v|- - Ѵov 1†;v|bom-lb;m|ov t†; _-m vb7o
ru;r-u-7ovĺ

Tipos de Hallazgos
վ No conformidad
m1†lrѴblb;m|o7;†mu;t†bvb|o;vr;1b=b1-7oĺ
վ Observación
"b|†-1bॕmt†;ro|;m1b-Ѵl;m|;r†;7;-=;1|-u;Ѵvbv|;l-7;];v|bॕm7;1-Ѵb7-7ĺ

115
 Incumplimientos Más Comunes

վ o1†l;m|-1bॕmmo;m1om|u-7-ĺ
վ olr;|;m1b-v7;u;1†uvo_†l-momo;ˆ-Ѵ†-7-ĺ
վ om|uoѴ;vblrѴ;l;m|-7ovbm-7;1†-7ovĺ
վ o1om=oulb7-7;vrou-†7b|ouझ-vbm|;um-vvbm1b;uu;;=b1-Œĺ
վ 11bom;v1ouu;1|bˆ-vvbmu;ˆbvbॕm7;Ѵ-7bu;11bॕmĺ
վ ;=b1b;m1b-;ml;|o7oѴo]झ-7;-m࢙Ѵbvbv7;ub;v]oĺ
վ m1†lrѴblb;m|o7;ruo1;7blb;m|ovĺ

Redacción de las No Conformidades

վ La Evidencia
bv|-7;_-ѴѴ-Œ]ovķu;vr-Ѵ7-7ov1om;ˆb7;m1b-vo0f;|bˆ-vo-|;v|b]†-7-vrou;Ѵ-†7b|-7oĺ
վ La Referencia
Ѵu;t†bvb|o7;Ѵ-moul-‹ņol-m†-Ѵ7;1-Ѵb7-7oruo1;7blb;m|oĺμt†bvb|o-Ѵ-ˆ;Œķ;Ѵt†;l࢙v
-rѴb1-ĺ
վ La Conclusión
;m࣐ub1-ķ0u;ˆ;ķru;1bv-‹-1;r|-7-rou;Ѵ-†7b|-7oĺ

No Conformidad: m1†lrѴblb;m|o-†mu;t†bvb|o7;Ѵ-oul--†7b|-7-ĺ

ObservaciónĹ-ѴѴ-Œ]o7;|;1|-7o;m†7b|ouझ-t†;ro7uझ-];m;u-u†m-mo1om=oulb7-7vbmo;v|u-|-7oĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

Oportunidad de Mejora: "om vb|†-1bom;v t†; mo u;ru;v;m|-m bm1†lrѴblb;m|oķ r;uo r†;7;m v;u
u;ˆbv-7-vrouѴ-ou]-mbŒ-1bॕmķ1†-m7oѴo;v|bl;1omˆ;mb;m|;r-u-l;fou-uѴ-;=b1-1b-7;Ѵruo1;voĺ

Fórmula de Redacción de No Conformidades

Reporte debe contener como mínimo:

վ &m-ˆbvbॕm];m;u-Ѵ7;Ѵ_-ѴѴ-Œ]oĺ
վ ;v1ubr1bॕm1olrѴ;|-‹ru;1bv-7;Ѵoo0v;uˆ-7oĺ
վ f;lrѴov7;Ѵ-;ˆb7;m1b-7;-†7b|ouझ-ĺ
վ !;=;u;m1b--Ѵ-1Ѵ࢙†v†Ѵ-7;Ѵ;v|࢙m7-uņ7o1†l;m|o7;Ѵ-ou]-mbŒ-1bॕmĺ
վ ŠrѴb1-1bॕm7;Ѵovu;t†bvb|ov7;Ѵ-1Ѵ࢙†v†Ѵ-ņ7o1†l;m|oĺ
վ -v7bv1u;r-m1b-v7;0;m-|ub0†buv;voѴ-l;m|;-†m-1Ѵ࢙†v†Ѵ-7;Ѵ-moul-ķѴ-l࢙v-rѴb1-0Ѵ;ĺ
վ mo1-vbom;vķѴ-িmb1-u;=;u;m1b-;vѴ-7o1†l;m|-1bॕm7;Ѵ-ou]-mbŒ-1bॕmĺ

116
Conclusiones de Auditoría

Ѵ;t†bro-†7b|ou7;0;u;†mbuv;-m|;v7;Ѵ-ľu;†mbॕm7;1b;uu;Ŀr-u-Ĺ
վ !;ˆbv-uѴov_-ѴѴ-Œ]ov7;Ѵ--†7b|ouझ-‹1†-Ѵt†b;uo|u-bm=oul-1bॕm-ruorb-7-u;1orbѴ-7-7†u-m|;Ѵ-
-†7b|ouझ-=u;m|;-Ѵovo0f;|bˆov7;Ѵ-lbvl-ĺ
վ 1ou7-u1om1Ѵ†vbom;v7;-†7b|ouझ-ĺ
վ u;r-u-uu;1ol;m7-1bom;vķvb-vझѴo;vr;1b=b1-;ѴrѴ-m7;-†7b|ouझ-ĺ

-v1om1Ѵ†vbom;v7;-†7b|ouझ-r†;7;m|u-|-u-vr;1|ov1oloĹ
վ ˆ-Ѵ†-1bॕm7;Ѵ]u-7o7;1†lrѴblb;m|o1om;Ѵ1ub|;ubo7;-†7b|ouझ-ĺ
վ =b1-1b-7;Ѵ-blrѴ;l;m|-1bॕmķl-m|;mblb;m|o‹l;fou-v7;Ѵvbv|;l-7;];v|bॕmĺ
վ -r-1b7-77;Ѵruo1;vo7;u;ˆbvbॕmrouѴ-7bu;11bॕmr-u--v;]†u-uѴ--7;1†-1bॕmķ;=b1-1b-‹l;fou-
vov|;mb7-7;Ѵ""ĺ

Informe de Auditoría
;0;uझ-1om|;m;uĹ

վ 0f;|bˆov7;Ѵ--†7b|ouझ-ĺ
վ Ѵ1-m1;7;Ѵ--†7b|ouझ-ķr-u|b1†Ѵ-ul;m|;Ѵ-7;=bmb1bॕm7;Ѵ-v†mb7-7;v7;Ѵ-ou]-mbŒ-1bॕmo7;Ѵov
ruo1;vov-†7b|-7ov‹;Ѵr;uझo7o7;Ѵ--†7b|ouझ-ĺ
վ o1†l;m|-1bॕm7;Ѵ-r;uvom-7;1om|-1|oĺ
վ o1†l;m|-1bॕm7;Ѵ-†7b|ouѴझ7;u‹o|uov-†7b|ou;vĺ
վ ;1_-v‹†0b1-1bom;v7om7;v;7;v-uuoѴѴ-uomѴ-v-1|bˆb7-7;v7;Ѵ--†7b|ouझ-ĺ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

վ ub|;ubo7;-†7b|ouझ-ĺ
վ ;1Ѵ-u-1bom;v7;-†7b|ouझ-ĺ
վ om1Ѵ†vbom;v7;Ѵ--†7b|ouझ-ĺ

Reunión de Cierre
v=-1bѴb|-7-rou;Ѵ-†7b|ouѴझ7;uĺ

";]িm1ouu;vrom7-ķѴovb]†b;m|;7;0;uझ-;ŠrѴb1-uv;-Ѵ-†7b|-7o;mѴ-u;†mbॕm7;1Ѵ-†v†u-Ĺ

ĺ m=oul-ut†;Ѵ-;ˆb7;m1b-7;-†7b|ouझ-u;1orbѴ-7-v;0-vॕ;m†m-l†;v|u-7;Ѵ-bm=oul-1bॕm7bvromb0Ѵ;
‹mo;vm;1;v-ub-l;m|;u;ru;v;m|-|bˆ-7;Ѵ-;=b1-1b-];m;u-Ѵ7;Ѵovruo1;vov7;Ѵ-†7b|-7oĺ
ĺ Ѵl࣐|o7o7;bm=oul-uĺ
ĺ ॕlo7;0;uझ--0ou7-uv;Ѵ-1om1Ѵ†vbॕm7;Ѵ--†7b|ouझ-;m=†m1bॕm7;Ѵruo1;vo-1ou7-7oĺ
ĺ ovb0Ѵ;v1omv;1†;m1b-v7;mo-0ou7-u-7;1†-7-l;m|;Ѵov_-ѴѴ-Œ]ov7;Ѵ--†7b|ouझ-ĺ
ĺ u;v;m|-1bॕm7;Ѵov_-ѴѴ-Œ]ov‹1om1Ѵ†vbom;v7;-†7b|ouझ-7;|-Ѵl-m;u-t†;Ѵ-];u;m1b-7;Ѵ-†7b|-7o

117
 Ѵov1olru;m7-‹Ѵovu;1omoŒ1-ĺ
ĺ †-Ѵt†b;u-1|bˆb7-7rov|;ubou-Ѵ--†7b|ouझ-u;Ѵ-1bom-7-Őrou;f;lrѴoķblrѴ;l;m|-1bॕm‹u;ˆbvbॕm7;
-11bom;v1ouu;1|bˆ-vķ|u-|-lb;m|o7;t†;f-v7;-†7b|ouझ-ķruo1;vo7;-r;Ѵ-1bॕmőĺ

Preparación y Distribución del Informe de Auditoría

ѴѴझ7;u7;Ѵ;t†bro-†7b|ou7;0;uझ-bm=oul-uѴ-v1om1Ѵ†vbom;v7;Ѵ--†7b|ouझ-7;-1†;u7o1om;Ѵruo]u-l-
7;-†7b|ouझ-ĺ

Ѵ bm=oul; 7; -†7b|ouझ- 7;0;uझ- ruorou1bom-u †m u;]bv|uo 1olrѴ;|oķ ru;1bvoķ 1om1bvo ‹ 1Ѵ-uo 7; Ѵ-
-†7b|ouझ-ķ;bm1Ѵ†buo_-1;uu;=;u;m1b--Ѵovb]†b;m|;Ĺ

ĺ 0f;|bˆov7;-†7b|ouझ-ĺ
ĺ Ѵ1-m1;7;Ѵ--†7b|ouझ-ķr-u|b1†Ѵ-ul;m|;b7;m|b=b1-1bॕm7;Ѵ-ou]-mbŒ-1bॕmŐ;Ѵ-†7b|-7oő‹Ѵ-v=†m1bom;v
oruo1;vov-†7b|-7ovĺ
ĺ 7;m|b=b1-1bॕm7;Ѵ1Ѵb;m|;7;-†7b|ouझ-ĺ
ĺ 7;m|b=b1-1bॕm7;Ѵ;t†bro7;-†7b|ouझ-‹Ѵovr-u|b1br-m|;v7;Ѵ-†7b|-7o;mѴ--†7b|ouझ-ĺ

Ѵ bm=oul; 7; -†7b|ouझ- 7;0;uझ- ruorou1bom-u †m u;]bv|uo 1olrѴ;|oķ ru;1bvoķ 1om1bvo ‹ 1Ѵ-uo 7; Ѵ-
-†7b|ouझ-ķ;bm1Ѵ†buo_-1;uu;=;u;m1b--Ѵovb]†b;m|;Ĺ

ĺ ;1_-v‹Ѵ†]-u;v7om7;v;ѴѴ;ˆ-uom-1-0oѴ-v-1|bˆb7-7;v7;-†7b|ouझ-ĺ
ĺ ub|;ubov7;-†7b|ouझ-ĺ
ĺ -ѴѴ-Œ]ov7;-†7b|ouझ-‹;ˆb7;m1b-u;Ѵ-1bom-7-ĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

ĺ om1Ѵ†vbom;v7;-†7b|ouझ-ĺ
ĺ &m-7;1Ѵ-u-1bॕmvo0u;;Ѵ]u-7o;mt†;v;_-m1†lrѴb7oѴov1ub|;ubov7;-†7b|ouझ-ĺ
ĺ †-Ѵt†b;uorbmbॕm7bˆ;u];m|;mou;v†;Ѵ|-;m|u;;Ѵ;t†bro7;-†7b|ouझ-‹;Ѵ-†7b|-7oĺ
ĺ -v-†7b|ouझ-vroum-|†u-Ѵ;Œ-vom†m;f;u1b1bo7;l†;v|u;oĸ1olo|-Ѵķ;Šbv|;;Ѵub;v]o7;t†;Ѵ-
;ˆb7;m1b-7;-†7b|ouझ-;Š-lbm-7-mov;-u;ru;v;m|-|bˆ-ĺ

Ѵbm=oul;7;-†7b|ouझ-7;0;uझ-;lb|buv;7;m|uo7;Ѵ|b;lro-1ou7-7oĺ"bv;u;|u-v-ķѴovlo|bˆov7;0;uझ-m
1ol†mb1-uv;-Ѵ-†7b|-7o‹-Ѵ-Ővőr;uvom-Ővőt†;];v|bom-m;Ѵruo]u-l-7;-†7b|ouझ-ĺ

Ѵbm=oul;7;-†7b|ouझ-7;0;uझ-;v|-u=;1_-7oķu;ˆbv-7o‹-1;r|-7oķv;]িm1ouu;vrom7-ķ7;1om=oulb7-7
1om;Ѵruo]u-l-7;-†7b|ouझ-ĺ

Ѵbm=oul;7;-†7b|ouझ-7;0;uझ-7bv|ub0†buv;-Ѵ-vr-u|;vbm|;u;v-7-vr;u|bm;m|;v7;=bmb7-v;m;Ѵruo]u-l-
7;-†7b|ouझ-o;ѴrѴ-m7;-†7b|ouझ-ĺ

Ѵ 7bv|ub0†bu ;Ѵ bm=oul; 7; -†7b|ouझ-ķ v; 7;0;uझ-m 1omvb7;u-u l;7b7-v -ruorb-7-v r-u- ]-u-m|bŒ-u Ѵ-

118
1om=b7;m1b-Ѵb7-7ĺ

--†7b|ouझ-v;1olrѴ;|-1†-m7ov;_-mѴѴ;ˆ-7o-1-0o|o7-vѴ-v-1|bˆb7-7;v7;-†7b|ouझ-rѴ-mb=b1-7-vķ
ov;]িmv;-1†;u7;1om;Ѵ1Ѵb;m|;7;-†7b|ouझ-Őrou;f;lrѴoķr†;7;_-0;u†m-vb|†-1bॕmbm;vr;u-7-t†;
blrb7-1olrѴ;|-uѴ--†7b|ouझ-7;-1†;u7o1om;ѴrѴ-m7;-†7b|ouझ-őĺ

-bm=oul-1bॕm7o1†l;m|-7-u;Ѵ-|bˆ--Ѵ--†7b|ouझ-7;0;uझ-1omv;uˆ-uv;o;Ѵblbm-uv;rou-1†;u7o;m|u;
Ѵ-vr;uvom-vr-u|b1br-m|;v‹7;-1†;u7o1om;Ѵruo]u-l-7;-†7b|ouझ-‹Ѵovu;t†bvb|ov-rѴb1-0Ѵ;vĺ

l;movt†;Ѵo;Šbf-Ѵ-Ѵ;‹ķ;Ѵ;t†bro7;-†7b|ouझ-‹Ѵ-vr;uvom-vt†;];v|bom-m;Ѵruo]u-l-7;-†7b|ouझ-
mo 7;0;uझ-m 7bˆ†Ѵ]-u mbm]†m- bm=oul-1bॕm o0|;mb7- 7†u-m|; Ѵ- -†7b|ouझ-ķ o ;Ѵ bm=oul; 7; -†7b|ouझ-ķ
- mbm]†m- o|u- r-u|; vbm Ѵ- -ruo0-1bॕm ;ŠrѴझ1b|- 7;Ѵ 1Ѵb;m|; 7; -†7b|ouझ- ‹ķ 1†-m7o 1ouu;vrom7-ķ Ѵ-
-ruo0-1bॕm7;Ѵ-†7b|-7oĺ

-vѴ;11bom;v-ru;m7b7-v7;Ѵ--†7b|ouझ-r†;7;mb7;m|b=b1-uub;v]ov‹orou|†mb7-7;vr-u-;Ѵruo]u-l-
7;-†7b|ouझ-‹;Ѵ-†7b|-7oĺ

Realización de Seguimiento de Auditoría

վ Ѵu;v†Ѵ|-7o7;Ѵ--†7b|ouझ-r†;7;ķ7;r;m7b;m7o7;Ѵovo0f;|bˆov7;Ѵ--†7b|ouझ-ķbm7b1-uѴ-m;1;vb7-7
7;1ouu;11bom;vo7;-11bom;v1ouu;1|bˆ-v†orou|†mb7-7;v7;l;fou-ĺ$-Ѵ;v-11bom;v];m;u-Ѵl;m|;
vom7;1b7b7-v‹ѴѴ;ˆ-7-v-1-0orou;Ѵ-†7b|-7o7;m|uo7;†mrѴ-Œo-1ou7-7oĺ";]িm1ouu;vrom7-ķ;Ѵ
-†7b|-7o7;0;uझ-l-m|;m;ubm=oul-7-v-Ѵ-vr;uvom-vt†;];v|bom-m;Ѵruo]u-l-7;-†7b|ouझ-‹ņo
-Ѵ;t†bro7;-†7b|ouझ-vo0u;;Ѵ;v|-7o7;;v|-v-11bom;vĺ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

վ -=bm-ѴbŒ-1bॕm‹;=;1|bˆb7-77;;v|-v-11bom;v7;0;uझ-v;uˆ;ub=b1-7-ĺ v|-ˆ;ub=b1-1bॕmr†;7;v;u
r-u|;7;†m--†7b|ouझ-rov|;ubouĺovu;v†Ѵ|-7ovv;7;0;uझ-mbm=oul-u-Ѵ-r;uvom-t†;];v|bom-;Ѵ
ruo]u-l-7;-†7b|ouझ-‹v;bm=oul--Ѵ1Ѵb;m|;7;-†7b|ouझ-r-u-v†u;ˆbvbॕmrouѴ-7bu;11bॕmĺ

Las Auditorías de Seguimiento

!;vromv-0bѴb7-7;v7;Ѵ-†7b|ouĹ

վ 1ou7-uѴ-=;1_-7;Ѵ--†7b|ouझ-7;v;]†blb;m|oĺ
վ ;v-uuoѴѴ-uѴ--†7b|ouझ-7;v;]†blb;m|o7;-1†;u7o1omѴ-v-11bom;v1ouu;1|bˆ-v‹ru;ˆ;m|bˆ-vĺ
վ u;v;m|-u;bm=oul-uѴovu;v†Ѵ|-7ov7;Ѵ--†7b|ouझ-7;v;]†blb;m|oĺ
վ ˆ-Ѵ†-uѴ-;=b1-1b-7;Ѵ-v-11bom;v1ouu;1|bˆ-v‹ru;ˆ;m|bˆ-vblrѴ-m|-7-vĺ

119
 Taller 4

վ Según el formato, realizar el informe de

auditoría.
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

120
 om1Ѵ†vbom;v

121
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)
 Conclusiones

-oul-Ѵ"ƑƕƏƏƐr†;7;v;ublrѴ;l;m|-7-;m1†-Ѵt†b;u|bro7;ou]-mbŒ-1bॕmr†;vruorou1bom-
†m- l;|o7oѴo]झ- r-u- blrѴ;l;m|-u †m "bv|;l- r-u- Ѵ- ;v|bॕm 7; Ѵ- ";]†ub7-7 7; Ѵ- m=oul-1bॕmķ
r;ulb|b;m7o|-l0b࣐mt†;†m-;lru;v-v;-1;u|b=b1-7-v;]িm;Ѵ1†lrѴblb;m|o7;;v|-moul-ķ7om7;
v† ;f; 1;m|u-Ѵ ;v ruo|;];u Ѵ- 1om=b7;m1b-Ѵb7-7ķ bm|;]ub7-7‹ 7bvromb0bѴb7-7 7; Ѵ- bm=oul-1bॕm ;m †m-
;lru;v-ĺ v|o Ѵo _-1; bmˆ;v|b]-m7o 1†࢙Ѵ;v vom Ѵov ro|;m1b-Ѵ;v ruo0Ѵ;l-v t†; ro7uझ-m -=;1|-u Ѵ-
bm=oul-1bॕmŐ;ˆ-Ѵ†-1bॕm7;ub;v]ovő‹Ѵ†;]o7;=bmb;m7oѴot†;;vm;1;v-ubo_-1;ur-u-;ˆb|-ut†;;v|ov
ruo0Ѵ;l-vv;ruo7†Œ1-mŐ|u-|-lb;m|o7;Ѵub;v]oőĺ

ouѴo|-m|oķѴ-=bѴovo=झ-rubm1br-Ѵ7;Ѵ-moul-"ƑƕƏƏƐv;0-v-;mѴ-];v|bॕm7;ub;v]ovĹbmˆ;v|b]-u
7ॕm7;v;;m1†;m|u-mķr-u--vझ|u-|-uѴovvbv|;l࢙|b1-l;m|;ĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

122
 Certiprof_llc

123
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)