Hello there. Thank you for joining me. This is section 13, stage two audit for the ISO 27001 Lead Auditor course. In this section, we're going to talk about conducting the opening meeting, collecting information, conducting audit tests. Determining audit findings and nonconformity reports, and then performing a quality review So this section is going to elaborate on the elements of the stage two audit, including the opening meeting, the collection of information, the audit test, and quality review. Stage 2 audit, this is out of 27006-1 clause 9. 3. 2. 2. So, based on the findings documented in the stage one audit report, the certification body shall develop an audit plan for the conduct of stage two. In addition to evaluating the effective implementation of the ISMS, The objective of stage two is to confirm that the client adheres to its own policies, objectives, and procedures. To do this, the audit uh shall focus on uh various aspects of the client's uh environment that we'll talk about in a minute. So again, if you don't remember stage one, that's basically where the auditor asks the client or the auditee for various pieces of information like policies. standards, procedures, objectives, statement of applicability, training records for computer security awareness training, and so on And they evaluate all of that information, all that material, all that evidence to make sure it's sufficient in compliance with 27,001. And if it is in compliance then stage two is possible. However, if material is delivered or provided to the auditor uh for stage one and it's not in compliance or they just simply don't have it, then the odds of a stage two even happening are are pretty small. There has to be, in order to do a stage two, there has to be the material to justify the stage two And uh if there is no material, then it's it's not really in the best interest of anybody to do a stage two that's going to guarantee a fail. So to do this, the audit shall focus on the client's assessment of information security related risks. The audit shall also ensure that the assessments produce consistent, valid, and comparable results if repeated. So again, from the standpoint of risks, we can qualify risks, we can quantify risks. I like quantifying risks because I can put a number to it. And if you quantify it, then you can do math. You can figure out equations, percentages, and so on. Qualifying risks That has to do with like a high, medium, and low, and that's really the perspective of whoever's reading. Determination of controls based on the information security risk assessment and risk treatment processes Information security performance and the effectiveness of the ISMS, evaluating these against the information security objectives Correspondence between the determined controls, the statement of applicability, the results of the information security risk assessments, and the risk treatment process and information security policy and objectives. They are also going to care about top management leadership and commitment to the information security objectives. So this could be done in a variety of different ways, but top management support is absolutely critical. For an ISMS to function as well as passing. Implementation of controls taking into account the external and internal controls and its related risks and the organization's monitoring. Measurement and analysis of information security processes and controls to determine whether controls declared as being implemented are actually implemented and effective as a whole So again, just because the uh the auditee says that a control is being implemented, that doesn't mean it's actually being implemented. That's really up to the auditor to also agree. Programs, processes, and procedures, records, internal audits, and reviews of the ISMS effectiveness to ensure that these are traceable to top management decisions And information security policy and objectives. So again, once they have a policy, they have uh of various types, uh, they they have to be able to show that those policies are being um are being followed and that there's evidence to show that the the whatever activities that the company is doing can be directly connected to a policy as well as ensuring that top management is aware of those uh policies and the ISMS in general, and that they have some sort of decision-making uh evidence of some sort of decision-making Process that supports the ISMS in general. So audit program management. So in the stage two audit, we'll conduct the opening meeting, we'll collect information, conduct audit tests. Determine audit findings, draft nonconformity reports, and conduct a quality review. So conducting the opening meeting. So out of 17021-1, clause 9. 4. 2 A formal opening meeting shall be held with the client's management and where appropriate those responsible for the functions or processes to be audited. So who is going to be in this meeting? The audit team, uh, key persons involved in the ISMS and the clients management. What Introduction of the audit team and the audit activities to be taken. Where in a suitable environment. It could be in a conference room. It could be over Zoom A lot of places are doing all this stuff by hybrid. When first day on the audit site before the collection of information So the other standpoint in relation to who is important, who is actually going to conduct the opening meeting, who's responsible for that? Well, if you're thinking team leader, you're correct. The audit team leader is the person who conducts the opening and closing meetings in the audit. So the purpose of the opening meeting, usually conducted by the audit team leader, is to provide a short explanation of how the audit activities will be undertaken. In relation to the what introduction of the audit team, it's very popular to have each person stand up or just briefly introduce yourself or themselves, but it's also possible that the team leader will just do all of that. So during certification audits, the meetings are expected to be formal, attendance is mandatory, and and has to be retained as evidence. So there will be a uh an attendance log of who is in the meeting. Um depending on Depending on the environment, you may get permission to record the meeting if it's over like a Zoom type environment, but there may also not, depending on the client The opening meeting is considered as a unique and effective way of establishing good relationships between the audit team and the audit tee. And should be arranged in a way that allows interaction. So the Oddity answers all potential questions without hesitation One other person that I think should be brought into any any type of meeting is definitely going to be the guide. Um you while you may have the the audite and the client's management uh involved in the opening meeting It's certainly important that the audit team, if there is going to be a guide involved, that the audit team know who that guide is. And it's always best to do that right from the very beginning. Alright, conducting the opening meeting, this is the actual meeting itself. And this is a um just a suggested agenda. That doesn't mean you actually have to do it this way The following is usually included in the opening meeting agenda. Introduction of the audit team members. So obviously we're going to start with a team leader, then each person on the audit team um briefly discuss the team members, what they do, how long have they worked for the company, uh, you know, it could be a variety of different things. Number two, confirmation of the audit objectives, scope, and criteria. Three, confirmation of the audit plan and logistics. And again, probably around there, you're going to want to make sure that there's a guide that has been identified. From the auditee. Number four, introduction of audit methods and procedures to be followed. Determination of communication channels between the audit team and the auditee. Number six, information on the availability of resources. Seven, confidentiality of information and health and safety matters. Again, uh having a guide there that can make sure that the auditors or audit team is uh not going to be in danger is is going to be uh important. Information on how to deal with potential audit findings. Information on audit findings, feedback, including complaints or appeals, and then information on the closing meeting So this is basically this meeting is going to go through the entire life cycle of the stage two audit and try to alleviate any potential pain points before they become a pain point.