So in section 11 we will be uh discussing the objectives and the steps of a stage one audit. We will go over the steps in detail. In addition, this section includes also information on how to prepare and to conduct the on-site activities and among other things how you should review documented information and their types. So let's dive into it. Let's have a look what the objectives of a stage one audit are. As you all know, an ISO 27001 audit by a certified body is separated into two stages. Stage one and a stage two. So during the stage one audit, the auditor does not yet verify the effectiveness of the management system in place but it's design. So basically the auditor will only check the effectiveness of the management system during the stage two on-site audit to validate whether the documented processes exist and are effective and also comply with the standard requirements. So what is the stage one audit then about? So first of all, the auditor will have uh a look and will review the audities management system documented information. That's why it's also um often referred to as a documentation audit. So it really the auditor really looks at what has the organization documented. The auditor will also check for any site-specific conditions that the audit D has put in place. During that stage one audit, the auditor will also review the re or the uh the oddity's understanding of the standard requirements. He or she will gather information regarding the scope of the management system and also have already a look at the preparation for the stage two audit. So um it's really to get an understanding on how many sites need to be visited. What are the resources that need to be in place for the stage two audit in order to really get insight on a good planning for that stage two audit? And finally, the auditor will also check if an internal audit and a management review have been executed, have they been performed and planned in the way as is necessary for the standard Stage one audit steps. The stage one ideally takes time in between two or four weeks before the stage two audit. It depends a little bit on what the organization requires as well. Sometimes even a stage one and a stage two can be performed separately, but usually there is two to four weeks in between the stage one and the stage two audit. A stage one audit should not be too far from the stage two audit either. So usually it doesn't go over the 12 weeks mark and that's really the the the biggest time lap that can between can be between a stage one and a stage two audit um and that's done because uh you don't want any uh changes uh man happening in your management system Of course, that the design that you've reviewed is not necessarily reflected in a stage two anymore. So it should also be conducted far enough apart so that you have time to prepare, of course the on-site audit plan, but also to give the organization some time to work on areas of concern that has been identified during the stage one Usually 30% of the total audit time is spent on stage one audits. Um, and um usually I I prefer to do the stage one audit on site because you get a good feeling on what um yeah the audite's organization look like but um a part of the um stage one can also be performed remotely but it it is um a common practice that you do it on site To get that feeling of the organization. However, the review of the documented information of course can be done either at the audit site or remotely. So both are an option there. So, when looking at the approach at the audit program management, we're at phase two in the stage one audit. As you can see, there are three activities that need to be performed there. So we need to prepare for the on-site activities. We need to conduct the on-site activities and of course we need to document the output of the stage one audit. Looking at the preparation of the on-site activities. So The reason uh for having that um preparation there is of course to ensure that the objectives of stage one can be met and the client will be informed about um any on-site activities that will be happening during uh stage one. So first of all, the the audit team should carry out a general review of the documented information that the organization has in place. So what will they be looking at? They will be looking at the information security policy, obviously, any operational procedures, an asset inventory. Awareness or training sessions, previous audit reports. There is also a general review should be conducted to evaluate whether the documented information is current Signed and dated and of course consistent. So all the documentations should be updated, should have an owner, and so forth And this helps, of course, to give uh the auditor a systematic and structured approach when uh he goes through the audit. So as I stated previously, in determining the interval between phase one and phase two, you need to take into account that you need to give some time to the organization to resolve any areas of concern And yeah, it might also be that you decide to postpone the stage two audit based on the areas of concerns that you have identified in your stage one. So if that happens, of course, it might be that you need to redo parts of your stage one audit, but when that happens, the client will obviously be informed. Usually the interval is also determined not only on the areas of concern that you might have found in the audit, but it's also associated with the availability of auditors, of course, to take on the audit. So you've conducted, you have set down a planning, you did the review of the documentation. What are you going to do when you're on site? So you're going to do in general four steps or four things. First of all, you will um have a look at the location and site-specific conditions of the audit. Um so the auditor uh should make himself familiar with the location in order to assess better at the risks that are related to the specific conditions of the oddity. Also you should also get as an auditor information on security rules regarding hygiene, health and safety in the workplace. understanding that if there is any use of personal protective equipment when necessary. You also want to understand that if you wanna uh if you are conducting a stage two, you also want to understand if that's necessary as well for you when you're conducting this Stage two. Secondly, you want to make contact with the personnel of the Odity. So it's the first um instance. Well, basically, it's the second time that you have contact, and the first time you uh Send the auditee uh an email or a confirmation letter that you will be coming along. But this time you're on site, you're having contact with a lot of different people within the organization So that moment in time is really necessary to understand that people know about, that they are involved of the scope and the objectives of the audit. In addition to the presentation of the audit team, it will give you also a great opportunity to see if everybody has been well prepared, if they have the right motivation. And you can also already get a little bit of a feeling on how the organization is structured, what is the culture within the organization. So it will give you a good feel about the organization. You will also be observing the technologies that your audity is using. So during the internal the first stage audit, you will not go into the very uh detail of the technologies that are used. But you will be able to observe already based on the documented information, based on the interviews that we're having, you get a little bit more used, you get a little bit more familiar about the technologies that the Odity is using And in general, you will also observe the operation of the ISMS. And that will help you as an auditor to better evaluate the risks. To the specific context of the audity. It will be helpful to prepare any audit plan and any test plan for your stage two audit, obviously. So during that stage one audit, um there are a couple of things that you uh need to validate. So uh you need to validate um Mainly the scope of the management system and the audit. You want to understand what are the legal constraints, what are regulatory and contractual requirements. You also want to uh talk to top management to ensure that they understand what their responsibility is. You want to have a touch point with key interested parties and you want to do the stage two uh audit planning So during that stage one audit, you will obviously not talk to as many people as you will do in a stage two. So you will have some interviews with key interested parties. So the goal of the objective of those interviews is not really to collect evidence like you would do in a stage two audit, but it's more to validate the compliance of the management system with the standard requirements and to understand basically to get insight in the context of the organization and how that management system responds to them So usually uh what happens, and usually you talk to two to three people and you talk to the person who's responsible to the ISMS because they can give you an explanation how the management system has been set up You always talk to somebody from top management to understand their reasoning behind wanting to obtain a certificate. You want to understand if they um really get uh a grasp of their responsibility and usually um you also talk to the internal auditor to to to check if uh internal audits have been uh performed Of course, if you have an uh a stage one audit that goes over a couple of days, that sometimes happens when you have a huge organization, then you will of course have interviews with other people like HR, like an information security manager, or perhaps somebody who's responsible for the physical security, uh, also to get a better understanding of how things are being arranged within the organization. A very important part of that stage one audit is the review of the documented information. So, documented information, if we look at ISO 1911, class 6. 3. 1 gives a little bit more information. So it states the relevant management system, documented information of the audity should be reviewed in order to get gather information. to understand the audite's operations and to prepare audit activities and applicable audit work documents, for example, on processes And functions, and it will also establish an overview of the extent of the documented information to determine possible conformity to the audit criteria and detect possible areas as concerned, such as deficiencies, omissions, and conflicts. So three things that you basically add the documented uh read the review of the documented information will review in three main things. First of all, you get a general understanding of the function of the management system. You understand how each process is integrated with each other, how you best audit it. It's good to have an overview of that general process overview. You will be able to do an evaluation of the management system design as well as the related processes and controls Um so to check if they are compliant with the standard and of course you will um be able to check if the internal audit and the management re review have been conducted. So uh those are really important um points that need to uh be checked and of course while while reviewing that documentation The auditor checks if the documentation is complete, if it's up to date, if it has been approved, uh, if it's consistent across all the documentation. to see if there are references to other uh policy documents or other processes that it is in line with whatever has been discussed. So, what are now the criteria for evaluating that documented information? So, first of all, three criteria that needs to be followed. So, it's the content of the documented information. the format and the procedure of the of managing the documented information. So let's have a little bit of a detailed look. So content of the documented information, of course an auditor needs to check that the document contains the information that is required by the respective clause of the standard. Obviously that's the purpose of the document. However, the documents may contain only the minimum information required, not everything that the standard specifies. The criteria for the auditor are not the best industry practices, but the minimum requirements specified in the standard. So the standard is leading, so whatever is Written in the standard that the organization shall document should be in the document. However, the organization is free to add any additional information where it deems applicable. Secondly, we look at the format of the documented information. So the auditor must ensure that each piece of the documented information is conform and standardized in terms of format. So there needs to be an identification of the author, uh the production data, there should be a version number, perhaps the approval. Sometimes I also see data classification, the process that it links to. Very important there is when determining in 7. 5 in the clause that the organization determines what the process is for the documented information and that is of course what you want to follow but at a minimum you want to see of course the title a version number the author and the approval Thirdly, you wanna check the um to check if there is a procedure for managing the documented information. And you wanna check if that is in line with the requirements of the standard, and you wanna see that there is a process in place. that documents get reviewed and updated