Hello everyone, thank you for joining me. This is section 12, preparing for a stage two audit. We're going to talk about setting the audit objectives, planning the audit, assigning work to the audit team, preparing audit test plans, and preparing documente information for the audit. So in this section, we're to discuss the preparations for the stage two audit, including the steps for planning the on-site audit, assigning work to internal people or internal audit people. And preparing the audit test plans and documented information. It's also an assumption that if you don't know what stage one is, then you should re-review that section before you continue down into stage two But I will uh elaborate a little bit more in relation to stage one during this process. So here's our uh uh preparations for stage two. We're gonna plan the stage two audit We're going to assign work to the audit team. We're going to prepare audit test plans, and then we're going to prepare the documented information for the stage two audit itself. So the stage two audit objectives is to evaluate the information security management system. And what when we evaluate, we want to make sure that uh we meet some requirements or the auditee does That we want to make sure they conform to the requirements at 27,001. And when it's conforming, that means truly conforming. So there's no non-conformities And if there is something that they're not going to conform to, then they have to explain exactly why. It's not applicable. We also want to make sure it's effectively implemented. And then we also want to make sure that uh this we're enabling the organization to reach its in information security objectives. So the purpose of the stage two audit is to evaluate the implementation, including effectiveness of the client's or auditee's management system. The stage two audits shall take place at the site of the of the client. And now you should understand with the pandemic, a lot of audits were done remotely, all of them. Uh and that's that's totally acceptable, uh it seems nowadays that uh if there's no on-site activities. However, if it is on-site, it shall include Auditing of at least the following information and evidence about conformity of all requirements to the applicable management system standards or other normative documents like policy standards procedures And again, you're going to do this whether it's on site or not. There'll be performance monitoring, understanding Like how many people took uh computer security awareness training, how many people passed the phishing exercises, all that good stuff. Also the ability for the client to manage the ISMS Can they manage it or can they or did they just have the ability to implement it but with no actual management? So it's important to understand that once uh the ISMS is implemented, They ha they have to manage it, they also have to prove that they can manage it. So that would be the operational control of uh processes and so on. So 3. 1 plan the stage two audit. This is out of 17021-1, clause 9. 2. 3. 1. The certification body shall ensure that an audit plan is established prior to each audit identified in the audit program in order to provide the basis for agreement regarding the conduct and scheduling of the audit activities. So the audit plan will facilitate the flow and coordination of on-site activities during the stage two audit itself. The audit team leader then will prepare an audit plan that serves as a basis for the agreement between the certification body, the audit team, the auditee, with respect on the the stage two portion of the audit. And again, Stage two generally involves uh interviews. Sometimes it's on site, but uh there's gonna be a lot of interviews, but it all it could a lot of it could be remote. The audit plan should be reviewed and confirmed by the certification body and auditee before starting the stage two audit. It's actually very important to understand that for a variety of different reasons. Almost any framework that you are going to be an auditor in, that statement is going to be a requirement across all of them. Whether it's 27,001 or 42,001. Any objections by the auditee should be resolved between the auditee and the auditeur or audit team leader In order to revise the audit plan to where it's uh easier for the auditee to accept. There any revised audit plan should be agreed upon all the parties and communicated to the certification body before starting uh the stage two portion. It's important that proper scheduling, proper awareness proper communication uh to make sure that stage two audit uh goes pretty smoothly. The audit plan itself, 1901, clause 3. 6 That is the description of the activities and arrangements for an audit. So the audit plan must be adapted based on the audit risks that were identified And the particular conditions of the audit. So, for example, if it's a multi-site audit, it's an integrated audit or a combined audit, duration of audit, audit scope. Who's going to be involved, get interviewed, all sorts of different risks that could come into play. The audit team leader should ensure that the audit plan is sufficiently flexible to allow for modifications. In fact, if you're going to be an audit team leader, you should plan on incorporating flexibility because I can promise you your plan is going to change. That will be something that comes into play. So preparing for the audit plan, the audit plan shall be appropriate to the objectives and scope of the audit. The audit plan shall at least include or refer to the following objectives, criteria, scope, including identification of the organizational and functional units or processes that are getting audited. the dates and sites uh for on-site activity uh and so on but now if it's not on-site there should be certainly dates and times for uh uh virtual meetings, virtual interviews like over Zoom or or something. Expected duration of the on-site audit activities Roles and responsibilities of the audit team members and accompanying persons such as observers or interpreters So it's super important to understand and as the auditee, you definitely want to make sure that you have a good plan on when people are going to show up on site. A lot of different reasons aside from the standpoint of efficiency of the audit itself, but also from safety of human life. You want to know how many visitors you have on site if there's an issue of some sort So the audit planning steps confirm if the certification body on behalf of which the audit is being conducted has a designated template for this purpose. In most cases, certification bodies have all the templates you need. You just have to be provided them. And no certification body is the same as any other certification body Plan the audit activities by focusing on the processes and controls of the organization, not the clauses of 27001. So uh you don't have to follow in relation to auditing, you don't have to follow the clauses uh chronologically in order. What you should do is figure out what does the company, the auditee, do figure out how you can uh inspect those uh that activity and align them with the clauses. Involve or consult the auditee where possible Incorporate the outputs of the stage one audit as well as part of the audit planning. And again, the stage one audit, that's the first 50% of the overall audit In the stage one audit, uh you'll be asked, or as auditor, you will ask for administrative controls like policy standards, procedures, statement of applicability, uh things that can be emailed as evidence like computer security awareness training records um and so on all right 3. 2 assigned work to audit team this is out of 17021-1 clause 9. 2. 2. 1. 5. The audit team leader in consultation with the audit team shall assign to each team member responsibility for auditing specific processes. Functions, sites, areas, or activities. Such assignments shall take into account the need for competence and the effective and efficient use of the audit team, as well as different roles and responsibilities of auditors. or auditors and training or technical experts. So again, as it said in other some other sections, don't uh assign work to an uh somebody on the audit team that is not competent enough to perform that work. And it's absolutely acceptable to have uh technical experts. If you're going to have auditors in training, then you should realistically ensure that they have some sort of oversight by an actual certified auditor. Changes to work assignments may be made as the audit pro uh as the audit progresses to ensure the achievement of audit objectives. I have seen cases where say it's a three-person audit team Uh two people are faster than the third one, and then the work assignment from the third one starts to get offloaded to the other two people. in order to uh uh just uh be more efficient and and save uh you know time. So in order to make sure that work assignments Are allocated properly, the audit team leader should obviously we talked about need for competence. Make sure that people are fully competent to perform whatever work assignment is assigned to them. We also want to make sure that the team leaders uh fully brief the team members on what uh needs to happen. So don't say, for example, if you're a team leader, hey Bob, I need you to go do this, but not explain exactly what this is. It may also be a good idea to say, hey Bob, I need you to go check the antivirus on uh you know these five computers um and then make sure that bob back briefs bob the auditor back briefs the uh team leader on on what he has to do. Yes, I understand. I'm gonna go check the antivirus on these five computers. So we want to clarify and validate responsibility for uh work assignments, things like that. Now in relation to uh managing the actual team itself, um if they're certified people uh and they're on the audit team, then they should know what to do. It should be very little micromanaging involved. So you you really realistically want to avoid micromanaging your audit team. Give them they're certified in auditing, so give them the flexibility of doing their job. Having said that, at the end of the day, you're most likely or you should have a meeting with everybody on the audit team just to make sure everybody's on the same page There's no surprises or no obstacles or anything. But definitely avoid micromanaging. Using technical experts 17021 clause 9. 2. 2. 2. 2. Technical expert steering and audit is uh is absolutely acceptable. It just needs to be agreed upon by the certification body and the actual client uh prior to them showing up. So a technical expert does not act as an auditor on the in the audit team. They help to come up with uh evidence or provide an opinion, but they're not actual auditors. Technical experts can provide advice to the audit team for the preparation or planning of an audit, but they're still not auditors. So the audit team leader should evaluate the professional competencies of everybody on the team, as well as the professional competencies of the technical expert themselves. So this could be in evaluating professional certifications, memberships in some sort of professional body uh experience based on you know past experiences that uh the the expert may have objectivity uh ensuring that they are not in a compromise position because they are uh Auditing or supporting an audit team that is working with an auditee that possibly the technical expert has helped before, and so on. So we want to make sure that it's very objective. If the auditor is skeptical about the competencies or objectivity of the expert, then they really need to discuss their concerns with the certification body. And find another solution or find an um a possible solution. Audit findings or comments made by the technical expert should be communicated to the auditee only through the audit team uh leader or other members of the audit team. Uh we don't want the technical experts to make comments directly to the uh oddity because that could skew some of the answers or skew the perception or skew the professionalism and ethics of the overall uh environment.