All right, discipline and sector specific competence of auditors. So this is out of 27006-1 clauses 7. 1. 3. 1. 2. And 3. 1. 3. 1. 3. Each auditor in an ISMS audit team shall have, that means must. Shall have knowledge of ISMS-specific documentation structures, hierarchy, and interrelationships, information security risk assessment and risk management, processes applicable to the ISMS. Each auditor in an ISMS audit team shall have knowledge of all requirements contained in 27001. An easy way of thinking about that is. You have to be certified in 27,001 as an individual in order to be an auditor. That's the whole purpose of this course that you're in right now. The audit team members shall collectively have knowledge of information security management related tools, methods, techniques, and their application. The current technology where information security can be relevant or an issue. So the audit team members shall collectively, that's a key word, have knowledge of all controls contained in 27001 Annex A and their implementation. That doesn't mean that each audit team member has to know every single thing, but collectively you do. And again, if there's particular areas when you're performing an audit that you're simply not aware of uh then get a technical expert to help out. Specific knowledge about clients this is out of 27006-1 clauses 7. 1. 3. 1. 5 and 7. 1. 3. 1. 6 Each auditor and ISMS audit team shall have knowledge of the legal and regulatory requirements in the particular information security field, geography and jurisdictions. So again, I've said repeatedly how You need to be aware of the organization and its context. So where it is, what it does, what regulatory environments it's involved in. So a big one that's easy to use. would be uh GDPR in European countries or companies. Um it's it's just something you have to know. If you're in California And you meet certain requirements, you're going to be held bound to CCPA. If you have anything to do with the medical field in the United States, it's going to be HIPAA-based. If you have anything to do with credit card transactions globally, you're going to fall under PCI DSS. So you have to be aware of all that. Information security risk related to business sector. That's again going to change based on the type of auditee that you're working with. generic terminology processes and technologies related to the client business sector that they're in. The one thing I will say about generic terminology, if if you have a client that you're auditing Make sure your terminology aligns with their terminology. There could be cases where somebody views auditing terms. differently inside the company. So make sure that uh you have some sort of Rosetta Stone translation capability in there to understand uh what auditors mean is is the same or if there is a difference than what the uh business sector uh agrees with. Also the relevant business sector practices, so the criterion may be shared among the audit team The audit team also needs to have collectively have knowledge of impact of organization like type, size, governance, structure, functions, relationships. implementation of the ISMS and certification activities, including outsourcing, complex operations in a broad perspective, as well as the legal and regulatory requirements applicable to the product or the service. All right, communication skills, presentation, and interviewing. This is 17021, Annex A, 2. 9, and Annex A 2. 10. Perhaps two of the most important aspects related to communication are presentation and interviewing skills. The auditors should be capable of presenting audit findings and conclusions to be easily understood for the team leader. Easily understood. So the team leader presenting in a public forum, like a closed meeting, audit findings, conclusions, and recommendations appropriate to the audience So an easy way of understanding this is that if you're going to do something highly technical as an auditor and you're going to report on it, don't get highly technical for the non-highly technical people. uh that you're reporting on. If if for example y you have to s uh basically give a presentation about lack of encryption Uh you don't really need to tell the CEO of a company about how AES 256 works or the lack of uh configuration uh based on your findings or something like that. All you have to really do is say you're not adequately protecting data at rest. and have the other people within the company uh maybe give them a more technical explanation of something, but You don't really need to overwhelm people because ultimately what will happen if if you don't if you're not aware of your audience when you're doing a presentation They will get confused, they'll get lost, there will be numerous questions about what do you mean, how does this work, stuff like that. It could raise uh raise their stress level uh get them you know they could freak out or something you just don't want to do that just be aware of the people that you're presenting to interviewing skills so capable auditors should be capable of interviewing to obtain relevant information by asking open-ended, well-formulated questions and listening to understand and evaluate the answers. So there's a actually a lot in relation to interviewing, but definitely be open-ended, well formulated. And you want to listen, evaluate the answers, but at the same time you want to understand that the answers that a person that you've interviewed may not be the same answer as another person you've interviewed. So not only understanding and evaluate the answers, but also comparing the answers to make sure that they align with each other. Knowledge of certification bodies processes. So this is out of 17021-1. Annex A 2. 4. The auditor must have knowledge of certification body's processes sufficient to perform in accordance with the certification body's procedures and processes. This implies that the auditor must thoroughly understand the certification body's policies and procedures relevant to them. applicable to the audit process. Other relevant policies such as quality and information security of the certification body, not the auditee. So, if you're an auditor working for a certification body, performing a certification audit, you need to understand the policy relating to information security and quality for the certification body itself. So you understand so you don't violate those policies. Any established guidelines from the certification body. And then tools such as forms, templates that the certification body provides to its auditors. In in most cases, if you're an auditor and you're working for a certification body or you're contracted to a certification body, For a particular audit, they're gonna provide all the templates for you and they'll they'll give you all this uh in advance. But While certification bodies may do that, that doesn't mean that every certification body is going to have the exact same template for every single audit. So make sure you understand that it will be provided to you, but at the same time also understand there's no consistency. From one certification body to another. Responsibilities and competencies of the audit team leader. So as stated in 17021-1, the audit team leader is responsible for assigning or reassigning work to each and audit team member to audit specific processes, functions, sites, areas, or activities Generally, when work is assigned to an audit team member, that is going to be based on the skill sets of that audit team member And generally that also means the audit team leader is aware of those skill sets in advance of assigning uh work. Now reassigning work could be for a variety of reasons. Maybe the audit team leader felt like It wasn't done very uh good very well, or maybe uh the audit team leader didn't assign work uh equally across the board and somebody's now has has too much work and it has to be reass uh allocated to somebody else. The audit team leader is responsible for reporting to the audit client and certification body when evidence indicates that audit objectives are unattainable. Reviewing with the audit client any need for changes to the audit scope. In all of my experiences with uh audit clients, every single time the audit scope is going to get discussed Either the audit client uh underscopes or they over scope. And uh the auditor and the team leader uh uh you know has to Help the audit client saying, yeah, you know, this is really not in scope or that should be in scope. The audit team leader should attempt to resolve any diverging opinions between the audit team and the client concerning audit evidence or findings. It's going to be uh politically, diplomatically, uh professionalism, things like that. Uh but that doesn't mean that The audit client is going to be accurate in their assumptions. Sometimes audit clients produce evidence that totally contradicts what they believe is true. Overseeing the preparation of audit conclusions. conducting the opening and closing meetings and preparing the final uh the preparing the audit report. Uh in relation to preparing the audit report, uh that's the responsibility of the team leader, but that doesn't mean that the audit Team itself is not going to be involved in preparing the audit report. I I've worked in uh audits for very large entities. Can't name them, but uh very large entities where the team leader uh basically said, okay, Carl, you're gonna do this section, Bob you're gonna do that section, Joe, you're gonna do this section, you know, Janet, you're gonna do this section And then I will do this part, and then we'll all come together and and put all these sections into a singular document, and then we're going to do a constant peer review process to make sure we all agree. That is a very realistic scenario. Maintaining competence out of 17021-1, clause 7. 2. 10, 7. 2. 11. Auditors should maintain their competence and aim to complete their audit assignments. To the best of their abilities, they should adhere to all competency, requirements, standards, policies, and procedures of the certification body This is important because as per 17021-1, the certification body monitors and evaluates each auditor considering the type of management system. To which the auditor is deemed competent. So there's a variety of ways that we can maintain competence. We've listed some. We can have an on-site evaluation by the By the certifying body. We could review audit reports after the fact to understand the competence in relation to auditing. Do they write well? Do they read well? We could also have feedback from clients in general or the market. Now there's other areas where you can maintain competence, and that's something after you finish this complete course and you take your test And you get certified, you've met all the minimum requirements, and you're certified, and that's called taking uh continuing education. So that's another way of maintaining competence. Another area of maintaining incompetence or maintaining competence is taking other courses related to 27,001. For example, you could take 27,002, you could take 27,005. All of that can tie into maintaining competence and improving yourself. So a form of professional development. All right, and that is the summary of section six. So ISO 19011 provides guidance on managing an audit program and planning a management system, whereas 17021-1 Consists of requirements for bodies providing the audit and certification to the management system. An audit is the assessment of the fulfillment of certain criteria by means of evidence and professional evaluation Internal audits are also known as a first party audit. External audits are known as second and third party audits. Understand the difference. A second party audit could be A client auditing the auditee in order to determine if they want to hire the auditee for a function. Or it could be the auditee auditing vendors or their suppliers. And that's commonly called vendor due diligence. A combined audit is an audit carried out together at a single audity on two or more management systems. So it could be 27,001 or 9,001 at the same time. If you're going to do a combined audit, make sure that you have appropriately certified and trained people to do that Some audits, well for example, ISO uh ISO audits require that, but in other cases, for example, you could do an ISO 27001 and a SOC 2 with less certified people. Also understand that you may actually have in relation to a combined audit, you may actually have multiple audit teams in order to save time and money in relation to the auditee. The principles of auditing are integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach So keep in mind what I said about integrity. Once your integrity has been tarnished, it's going to be difficult for you to be an auditor So make sure that your integrity, your honor, your ethics, your moral courageousness, that is never violated It's your name means everything in the world of cybersecurity and auditing. Also understand the concepts of confidentiality. Unless you are given permission, do not release information about anything In relation to the client. The only exception to that is what's called what I call mandated reporting events. Audit team leaders must be professionally competent to plan and audit using resources efficiently Manage and counsel the audit team members, prevent and solve conflicts, and prepare, explain, and defend the audit conclusions. So if you're a team leader Leading an audit team, you have to be able to lead your team. Sometimes you'll have team members on your audit team, they will just disagree with each other. So maybe you have to change some work assignments As a team leader, you may also understand the culture or the personality of the people that are being interviewed. And you might want to reassign uh interview people Who are going to interview the auditee based on the type of culture and environment that you're in? There's also some questions. We'd ask those if this was a uh uh in-person class there's an exercise exercise two in quiz five you should do those on your own time obviously we can't do them because this is uh recording And with that, I want to thank everybody for your time. I will see you on the next one.