Analytical evidence is obtained by analyzing data and their variations to find their tendencies as well as potential deviations. Analytical evidence includes any evidence collected by statistical methods. So examples of analytical evidence are analysis of network access logs to detect deviations or exceptions. Sometimes, depending on the level of intelligence you have with your technology, that could be called outliers. And again, we talked about outliers in artificial, the section about artificial intelligence Analysis of information security incident reports. Analysis of a sample of worker competency tests to measure the understanding of the information security controls, or possibly the the uh pop quizzes or quizzes at the end of information security awareness training. Come up with some analysis based on that. So there's a whole lot of different ways you can analyze the evidence. Obviously, as an auditor, we want uh we desire that our Auditees are up to speed on uh on as many things as possible. So we expect high numbers as auditors. And if they don't have high numbers and you know, we need to come up with a corrective action plan. There's also documentary evidence. This is really the easy ones uh to deal with and you're certainly going to see this in a stage one portion of a ISO 27001 audit We'll talk about the stages in a different section. But documentary evidence is obtained by verifying any record or document that exists already. So for example, information security policy. or any policy relating to information security for that matter. It could be encryption or asset management, it could be development, it could be anything. But those written documents that could be used as documentary evidence. Statement of applicability, where you're stating exactly in 27001 what is applicable and what is not and why for each one. Documented procedures. And any other documented information that the organization views as necessary for the effectiveness of the ISMS? And then also super important ed evidence of the result of management reviews. We can't create uh evidence or reports or reporting in generals, things like that and not actually have management review it to to sign off and endorse it. If uh if management is not aware of cybersecurity, then that is actually not a good thing. Not only in relation to the audit, but it's not good in relation to the health of the entity itself So other areas of documentary evidence could be non-disclosure agreements, policies of any kind, possibly records of backup. uh backup, you know, backing up the data, as well as if you're going to do a backup, you have to do a restore. Other areas of documentary evidence could be a penetration test provided by a third party uh which which would also be confirmatory uh evidence. There's also verbal evidence, which is obtained during interviews with persons that have the necessary knowledge and responsibilities to perform the operations. That are being audited. So general discussions carried out during the audit could be viewed as verbal evidence, and then formal interviews conducted during the audit. However, I will point out Do not assume that your answers from a ver from an interview, the verbal evidence, are accurate. Verbal evidence is very unreliable. compared to actually seeing like the firewall access control lists or seeing a penetration test. It's unreliable And you will find that uh there will be one person that says one thing to this to a question and there will be a person that says something else to the exact same question. And that's generally because the co the organization is not in sync with each other. or that or one person just doesn't know. So there's a whole lot of different ways we can have verbal evidence, but it's also important to understand that verbal evidence could could be uh a tied uh tied to different areas like for example is your leadership and management are they behind uh deploying the ISMS do you have top-down support People could say yes. Uh leadership is totally behind it. But how would we prove that? So we can believe it, but if we had some sort of email from leadership saying We're deploying a 27,001 ISMS. Everybody needs to be on board and we expect full cooperation. That's better evidence than just saying yes, top-down management or top-down support is in place. Quality of audit evidence, audit evidence must be first appropriate and then sufficient. So we have evidence And you can see there it's it's a is the evidence appropriate? Is it relevant? And is it reliable? So is it is when I say relevant, is it relevant to the requirement? But then more importantly, is it reliable evidence? If it's unreliable evidence, then as auditors, we need to figure out how to make it reliable or get different evidence. Once we've done all that Then we can compare it to the control, to the requirement, and we can determine is it sufficient or not. And if of course, if it's not sufficient, then uh going circling backwards, taking a step back. We go find more s more evidence until it is sufficient. But we have to get to a point Whereas auditors, we are comfortable that the evidence provided for any particular control in 27001 is sufficient to meet that control. And if it's not sufficient then we uh have to you know ask for more. Uh reliability of audit evidence, so the main determining factors is objectivity of the evidence, the timing, independence of the source evidence collection techniques and then the internal control system. So objective evidence is based on facts and proof Not hearsay, not belief or anything else. It's based on facts and proof. And we want to make sure that is accurate. So an example of this. If we uh if we said, hey, do you have uh surveillance system, physical security, like cameras or something, we could go around and observe the cameras in place, but that doesn't mean the cameras are recording anything. We could then ask, well, let's see the the the screen where all the camera feeds are going into and if we saw that then we could even go so far as to say Uh hey, uh how long are you retaining the data, the video uh surveillance? So there's all sorts of different things that um That's could be based on. So the objectivity is it's the evidence is based on facts and proof that you can actually see There's also timing of the evidence. So if if we had something with timestamps on it, then uh that proves that the evidence is recent, then that's sufficient. If we have uh evidence that's Say evidence is only required once a year for something. Uh so provided it's within that year time period, technically it's supposed to be good. But if we can regenerate evidence that's closer to the actual audit, then that's even better. But we don't want to say if we have a requirement for evidence that's some kind of task that has to be done monthly, we don't want to submit evidence that's six months old for a task that's supposed to be done monthly Independence from the source is super important to make sure that the evidence is collected outside of how it was generated And then we also have to care about the evidence collection techniques. There could be a variety of different ways on that one. There's collecting evidence or creating evidence in relation to sampling and collecting it that way as well. There's all sorts of different ways. I believe there's other sections where there's evidence collection techniques are discussed in greater detail. There's also the internal control system That has to do with uh the evidence that's collected. Where is it stored? How is it tracked? Who's monitoring it? Who's approving it? Who's saying that this is sufficient enough Are other controls being monitored and adhered to? So there's a quite a variety of different ways of looking at audit evidence. We have verbal evidence, which we've already said is the least reliable Documentary evidence, which could be like a document itself, like a policy standard procedure, but it's written down and we assume that they're doing it right. Analytical evidence. Is uh analysis of evidence to come up with a determination of the uh analytics for whatever the evidence is around Technical evidence like configuration files or evaluating like a server password management uh complexity, things like that. confirmative evidence, uh something that confirms evidence as being accurate and realistic. Then we have physical and mathematical evidence, which we talked about, uh physical evidence could be uh like an you're observing something. of you personally observe it. You're physically observing it, whether it's like a a surveillance camera or maybe antivirus on the workstation, uh could be anything. And then mathematical evidence is calculating, uh coming up with a calculation of of the auditee's environment to figure out, you know, how things are So a good example that they provide here is for mathematical evidence, calculations of the number of auditees computers and the number of antivirus licenses acquired. So if you had a hundred computers, but if you only had 50 antivirus licenses, well you got a problem. And in this slide you can see um The uh the layout of the types of audit evidence least reliable is verbal. Don't believe that uh when somebody says this is the way we do things, don't believe that that's the way they do things The most reliable is physical and mathematical evidence. Alright, this is the summary for section eight. There's seven major types of audit evidence, physical, mathematical. Confirmative, technical, analytical, documentary, and verbal. Again, remember, verbal is the least reliable. Physical and mathematical is the most reliable Documentary is when they uh you're you actually see copies of administrative controls like policy standards, procedures, and so on. Any information that can be verified, measured qualitatively or quantitatively, and used to determine the audit findings can serve as evidence Remember qualifying something is a relative term like high, medium, and low. Quantitatively is a numerical term, like 90%, 100%. Audit evidence should be relevant, reliable, and sufficient to be considered acceptable. In relation to sufficient, remember again that if it's not sufficient, your job as an auditor you would go around and uh and basically uh request more evidence. So there is a quiz for this section, but this is a recording, so you'll have to do that on your own. Thank you. I'll see you on the next one