So we're going to collect information as well. So we're going to have sources of information of a variety of different locations or uh where s where information could be sourced from. So observations, we talked about that. That's when the auditor absolutely abs personally observes. uh something. We can have records, whether they be written on paper or digital, system configurations, like reviewing firewall configuration logs or something like that. Other documents could be um could be anything. Maybe it's contracts with a with a uh a vendor, uh indicators of some sort using uh possibly um Uh the only thing I can think of right now would be like a security information event monitoring, which could give an indicator of uh of a log or possibly some sort of other analytical uh aspect Interviews with people. And again, understand that verbal uh evidence is the least reliable in relation to evidence. And then databases and websites, if we're going to uh look at databases or maybe internal or external websites. And again, in a previous section, we talked as it relates to databases. We talked about structured and unstructured databases. So structured databases would be SQL, for example. Unstructured would be like MongoDB. And then for large, very large data sets, we talked about artificial intelligence and machine learning in another uh section. All right, specific elements of the ISMS audit. This is out of 27006-1, clause 9. 4. 2. The certification body audit team shall require the client to demonstrate that the assessment of information security related risks is relevant and adequate for the ISMS operation within the ISMS scope. So in a previous section I briefly talked about qualifying and quantifying risks. Again, qualifying risks means you're Using a high, medium, and low kind of scale, whereas quantifying risks means you're using actual numbers. So nine out of ten we're or ninety percent. So that doesn't mean that you can't use or an oddity can't use qualifying uh uh qualification as a as a method. It's certainly Acceptable. It's just that it may be better to encourage them to not do that. But anyways, however they're doing information security risk and how it's relevant to the ISMS, that's still your job to make sure that they can adequately demonstrate uh uh you know this process. We also want to establish whether the client's procedures For the identification, examination, and evaluation of information security-related risks and the results of their implementation are consistent with the client's policy, objectives, and targets The certification body shall also establish whether the procedures employed in risk assessment are sound and properly implemented. So again, a lot of this goes into the knowledge and competence of the uh audit team themselves to determine if If it is actually sound and properly implemented, as opposed to what the client believes it is So 4. 3 conduct audit tests. So number one, collection of information. During the audit, the audit team continuously collects information that will serve as audit evidence. Number two, audit tests with appropriate procedures. To gather audit evidence, the auditor performs tests by using a series of procedures such as observation Documented information review, interviews themselves, analysis, and technical verification. Then we also have corroboration and evaluation of evidence To establish sound audit findings, an auditor systematically looks for evidence. So we don't stop looking for evidence just because we feel like it's uh completed, uh we may not look as hard, but if we find evidence that's directly related to something else, then we still need to ask questions. In a broad sense, the auditor's work mainly consists of collecting information, conducting tests, and corroborating the various types of evidences uh with each other as well as with the um the control the requirements in 27001 so the activities of you know one two and three there uh illustrate that there's that the whole process is really iterative in nature. So it's a circular, it starts over and over and over. We're always uh qualifying uh the data Meaning that in relation to the iterative part, that the auditors switch back and forth between those steps in order to make sure that the audit's done appropriately So conducting tests can be one of the most important steps in the audit itself, both in terms of importance and duration. So testing could include interviews with personnel involved in the processes and top management to make sure they're aligned. Equally in relation to what they think is going on. Examination of documented, paper information, electronic data to make sure it's consistent. Examination of procedures An examination of procedures could be not only a review of the procedure itself if it's if it's electronic, but if you're on site, you could even say something like, Demonstrate to me how you back up systems and then just literally observe it. And you can say that you observed it personally You can also do a site walkthrough, which could be some sort of physical security audit, as well as evaluating the other physical-related security controls and other administrative controls. Like uh do you have to check in as a guest? Are are you escorted everywhere? Were you given a badge once you uh checked in? So 4. 4 determine audit findings, draft nonconformity reports, and conduct a quality review. So this is 19011, clause 6. 4. 8 Audit evidence should be evaluated against the audit criteria in order to determine audit findings. Audit findings can indicate conformity or non-conformity with audit criteria. And when specified by the audit plan, the individual audit findings should include conformity and good practices along with their supporting evidence, opportunities for improvement, and any recommendations to the auditee. So determining the audit findings is a significant part of any audit. During this stage, auditors can evaluate the evidence gathered during That portion of the audit against the criteria, and then uh and then make a determination. Equally important is the need to accompany the audit findings with their supporting evidence So when the audit is performed by several auditors, the audit team members should meet at relevant stages during the audit to review findings. The audit team leader should strive to resolve any differences in opinion relating to evidence or audit findings within the audit team. So in relation to uh meeting uh regularly, I guess I w I always suggest that uh you have a meeting at the beginning of the day so you sync up on what you're gonna do during the day and at the end of the day you have another meeting to go over what you went over uh during the day. That way everybody's on the same sheet of music, everybody's on the same page. Just understand that the the initial, the meeting in the morning and the meeting afternoon, that should be very private. Only team members should be in that, so no guides from the auditee. You should also understand uh resolve any diff the audit team leader resolving any differences and opinion uh within the audit team. There may be people in the audit team that just simply have more experience than other people and may have a difference of opinion. Realistically, if somebody with more experience has the actual evidence to prove their point, then they're most Probably most likely right. Um but the audit team leader needs to figure that out. The uh it's also important that the audit team leader uh maintain um control of the audit team themselves. Uh I've seen audit team members get in arguments with each other about about something. And it's realistically most of the time it's just one person's opinion, it's different, and they have to deal with it. Quality review. The quality review of audit findings will ensure that the audit conclusions are reliable and valid. So we have our audit findings, they roll into quality review, and then from there we have audit conclusion. The quality review, the audit findings will be explained in detail in other sections. But there should be a quality review. Also, in relation to uh quality review, uh if if it's possible uh having the entire team uh aware of that what the findings are and and uh there's no disagreements on what the findings are. It's always good to have the opinions of other people as a part of quality review. And this could be in a variety of different forms. Not just the belief that there's a finding, but also how uh word products are created And this is the summary for section 13. So in the beginning of the on-site audit, it's recommended to hold an opening meeting. It's not recommended, you must do an must hold an opening meeting with the representatives of the auditee and the person responsible for the operations or processes to be audited. Remember, it doesn't have to be on site. With the pandemic, a lot of people, actually everybody because of the pandemic, we're all doing uh remote. audits for stage two. That doesn't mean that you won't have a stage two audit that's on site. It's just that it's very popular not to do on-site audits now The following activities are included in the opening meeting, introduction, introducing the audit team, confirming the audit plan, briefly explaining how audit activities will be conducted. Confirming the communication channels and identifying potential audit problems or obstacles. The auditor has the right to require access from the auditee to all sources of information related available in order to adequately evaluate the procedures and their conformity to the applicable requirements. So as an auditor, get whatever information you need in order to validate one way or the other if requirements are being met. If a uh if a oddity uh says they're not going to give you something but you deem it to be um relevant Then first off, you need to understand there's a lot of trust placed in you by the auditive, but you also need to understand that could be uh something that requires you to reach out to uh the certification body to basically say they're not giving me all the evidence I need. I know it's there, uh, but I can't see it. They're refusing to give it to me and and maybe discuss with them about a path forward Because that could be a case where logistical changes on audit teams happen. Audit evidence should be evaluated against the audit criteria in order to determine audit findings The quality review of audit findings will ensure that audit conclusions are reliable and valid. And of course, there's a quiz here, but this is a recording, so you'll have to do that on your own time. So go to the quizzes worksheet within the uh uh the material and take care of that quiz. Thank you very much