ISO 27001 Lead Auditor · Domain 4
Conducting the Audit
About 22% of the exam
The shape of the audit day
- Opening meeting
- Collect evidence
- Daily team meeting
- Form findings
- Prepare conclusions
- Closing meeting
- Issue report
- Follow up
- Evidence sources
- interviews, observation, records, systems
- Daily briefing
- team aligns on emerging findings
- Interim update
- auditee hears major concerns early
- Closing
- findings presented and conclusions explained
No finding should be a surprise to the auditee at the closing meeting
Audit trails and tracing
- Pick one event and follow it through
- Forward tracing tests completeness
- Backward tracing tests validity
- Check the same fact in two systems
- Ticket, approval, log and record together
- Gaps in the trail are the finding
A trail proves the process ran; a document only proves that somebody once wrote it down
Interviewing well
- Open questions first, closed to confirm
- Ask staff at different levels
- Managers state intent, operators state reality
- Never lead the witness
- Let silence do some work
- Play the answer back to confirm
- Record who said what and when
Observation
- Watch the control being operated
- An unannounced walk reveals real practice
- Clear desk, screen lock, visitor handling
- Tailgating and propped doors seen live
- Observation beats a supplied screenshot
Testing technical controls
- Direct the navigation yourself
- Name the records you want shown
- Check coverage, not just existence
- Privileged accounts often sit outside monitoring
- Ask what the control does not cover
- Bring an expert when depth exceeds competence
Sampling errors in the room
- The population supplied was incomplete
- Sample drawn from one month only
- Auditee chose the records shown
- Sample too small for the population
- Result projected beyond the evidence
When evidence conflicts
- Seek a third independent source
- Prefer records over recollection
- Test the explanation, never dismiss it
- Withdraw a finding proven wrong
- Record the resolution either way
Communication during fieldwork
- Brief the auditee every day
- Raise immediate risks at once
- Route access requests through the guide
- Escalate blocked access to the client
- Keep the team aligned on grading
Recording evidence
- Note the document name and version
- Note the date, system and person
- Capture the requirement it relates to
- Enough detail to reexamine later
- Working papers stay confidential
Situations that catch auditors out
- Late document dump
- evaluate relevance, never accept blindly
- Auditee driven demo
- ask to choose the items
- Control just implemented
- design shown, operation cannot be
- Outsourced control
- test the reliance and the oversight
- Interpretation dispute
- team discusses, then scheme guidance
- Objectives at risk
- report to the audit client
- Pressure at closing
- record the diverging opinion
Closing meeting
- Attended by auditee management
- Present findings with their evidence
- Explain the grading applied
- State the sampling limitation plainly
- Give the recommendation, not the decision
- Record disagreements as unresolved opinions
- Agree timescales for corrective action
- Confirm what happens next
The lead auditor recommends; the certification body decides
The audit report
- Objectives, scope, criteria and dates
- Team members and sites visited
- Findings supported by objective evidence
- Statement of conformity against the criteria
- Unresolved diverging opinions recorded
- Sampling and its limitations stated
- Distribution controlled and confidential
- Issued within the agreed timescale
Evidence vocabulary
- Audit evidence
- records, statements, verifiable information
- Audit finding
- evidence evaluated against the criteria
- Audit conclusion
- outcome after weighing all findings
- Audit trail
- linked records proving a sequence
- Objective evidence
- data showing something exists
- Verification
- confirming a requirement was met
Phrases that signal trouble
- We always do it that way
- The system will not let us
- That report is generated automatically
- Only one person knows that process
- We fixed that just last week
Reference strip: collect, corroborate, sample, close, report
Collect
- Interview, observe, examine, reperform
- Different levels give different answers
- Auditor selects the evidence
Corroborate
- Two sources beat one
- Records outrank recollection
- Trace forward and backward
Sample
- Whole period, complete population
- Size matched to risk
- Conclusion limited to the evidence
Close
- No surprises at the meeting
- Grading explained with evidence
- Diverging opinions recorded
Report
- Scope, criteria, findings, conclusion
- Sampling limitation stated
- Recommendation, never the decision
Quick exam traps
- Trap: A screenshot supplied by the auditee is as strong as observation
- Trap: A control implemented last week can be judged operationally effective
- Trap: The lead auditor grants or withholds the certificate
- Trap: A convincing verbal explanation closes a finding on its own
- Trap: An auditee may refuse to let the auditor pick the sample
- Trap: Findings can be introduced for the first time at the closing meeting
- Trap: Disagreement at closing means the finding must be withdrawn
cybercertprep.com · original revision sheet written from the public body of knowledge