Now, what type of documents need to be audited? So it's um there are um actually four levels of documentation that can be audited So on a first level, which is also called the strategic level, which is anything that has to do with the governance framework. So the ISMS scope The objectives, the policy, any other strategic documentation, that is basically where you want to start first as an auditor because it will give you the general overview And you basically go uh you dive deeper into detail um along the way. So after level one you go to level two uh two, which is um information that is um yeah basically related to risk management so it is the documented information on all the processes and the controls. So it really describes the why, what, how, when, by who. So it gives you that description of the process. At third level, you go to the individual processes and procedures where you check from okay how in detail are procedures being performed. And then on a third fourth level It's really the records where you um have any supporting documentation, the evidence of conformity happens uh there. So basically um starting with the governance uh framework, looking into the risk assessment then looking at all the different processes and procedures, and then checking for the evidence. That's basically the the strategic approach or the structured approach that an auditor should take to really see the um the linkages between the documentation uh within an organization. The auditor must validate, of course, that the documented information includes records that demonstrate the audite's management commitment. To the establishment implementation, operation, monitoring, and of course the continual review update as well. So that means that the strategic documents need to have um a couple of um central things in there. And it's all related to whatever decisions have been taken, any approvals that need to be taken. So the ISMS scope is of course something that the management team has been involved with. So you look at that You look at the information security policy, it's also a policy that top management needs to create and needs to sign and communicate to the organization. So you want to have a look at that Risk management at a risk acceptance and the risk evaluation criteria is something that stopped needs to sign off on. So you want to ensure that you have a look at those as well. the resources um uh that are um meant to implement the ISMS so people, money, uh consultants, you wanna uh check that and of course The management review and the internal audit program are uh two documents, two uh elements that uh should not be forgotten to verify if the management system is in place. So second step is of course after the risk assessment, so it's basically the third step, you want to verify the processes and the procedure So the processes and procedures need to give you information on what is happening in the organization. So basically they need to give you an answer to the five Y's and the One H. So Who, what, when, where, why, how. So that means, and you see an example written out on the slide. So that means that you need to, in some way or another, need to Detail that in the organization, but you can do that in different formats. The standard doesn't tell you that you need to use a physio diagram to do that. So you can use that in basic text formats, you can use an Excel spreadsheet, you can use Visio. So you can use whatever you have available in the organization and what is used in the organization to work with to create these processes and procedures. The auditor must also verify if the documented information related to the internal audit demonstrates that the auditee has implemented a planned and structured approach. um towards the audit program and that it meets the requirements of the ISO 2701. So the auditor will um We'll have a look at a couple of things. So um first of all, um the auditor wants to see any documented information related to that internal audit program. So Based on the ISO 27001 requirements, an organization needs to have an internal audit program available which really defines what is the frequency that you will do an audit What are the methods? What are the responsibilities? What are how does reporting work? So that must be sufficiently documented to have evidence basically of that implementation. So you need to have something written down The auditor will also look at files of internal auditor. With files meaning that checking that the internal auditor has the correct competences to execute the internal audit So that might be a resume, that might be a training plan or an annual evaluation. So anything that can attest to the competence that is required to perform their mission. The auditor will have a look at the internal audit plan to check that the audit plan covers all the ISMS activities That the internal audit program has detailed out that they are planned for the duration of the certification. So in this case that's three years. So it's best practice that it is conducted for three years. Of course, will the auditor also look at the internal audit procedure to see that there is any documented information available that gives information to the internal auditors on how they need to perform audits and that it's done in the same way? They will have a look at the report, and that's the very important document. So they will have a review of the internal audit report so that to see what has been found in the internal review. So at before going to a certification audit, you should have at least one internal report. So one internal audit report should be available. And it is of course best practice to have done the internal audit for the full scope Of the ISO 27001 or at least the full scope where you're implementing it for. Documentation of the audit follow-up activities Of course, if there were any non-conformities, observations, areas for improvement, they should be documented in a good way. There should be a follow-up plan or action plans. So the auditor will also have a look at those to see if you've done anything With the findings out of the internal report. So the internal audit is a very important document, a very important process that will be verified during the stage one. During the stage one audit, the auditor will also determine to what degree an auditee uses electronic documented information. So you should reach an agreement on how an auditor will get access to that documentation. So it might be that you give the auditor access and some instances you get a guest access. To go through the document management system. Sometimes you need as an auditor a little bit more explanation. So what needs to happen is that an audite gives you, of course, all the explanation um the not too many permission rights as so viewing rights um and of course give you detailed information on how you can uh walk through the documented information management system So of course, um auditors for an ISO 27001 should be competent in the use of IT um infrastructure and development trends. So, you need to have as an auditor a minimal practical understanding of general trends, of course, in technology development Auditors should pay uh in particular uh attention to development, technological developments in their respective area and how these innovations might be used in their work. So being up to date in any document management system or an electronic document management system uh is something that you would probably um do best in in gaining some access. And most commonly used is of course uh SharePoint uh confluences of these worlds uh but um asking some explanation is good uh thing to do. Of course you want to review that electronic uh documentation and so um it will depend on of course if The audity is able to make that information available either through a web-based application or through email transmission, but it will also be dependent on technical and security factors. So the audit approach here is of course dependent. And so during an on-site audit, the auditor's responsibility will be basically to oversee the physical location of the audited process. So in case when a document management system is applied, the amount of time required to confirm the evidence in order to validate that the requirements are being met may be dedicated to a computer workstation where the document is stored and which may not be located near the actual process. The actual auditing time at the physical location may then be reduced, where you can spend your time in reviewing the documentation in another part. So that is of course very important In using an electronic document documented information, of course, you also need to have a look at um yeah what is the format that the organization uh uses it. Is it plain text Is it HTML or the PDFs or their Excel Excel? So there needs to be suitable measures in place to protect those electronic documents as well, because it's much easier to change an electronic file than it is in an in uh in a paper-based file so you need to have a process in place or you need to check as an auditor if there is a process in place for the uh the review, the publication, the distribution, and the disposal of that document management uh system. So having um having a look at that electronic documentation um either separate in a separate document review sometimes we do that as well and that we spent one full day to review all the documented information and that might be done off site because you can access uh somebody's SharePoint from uh from a remote location. So that is uh basically uh what you uh should do. Lastly, of course, when you um evaluate uh the audities controls of the retention of that storage media, so you should also check okay what what is the time uh what are the retention periods that documents stay in the organization, um how what do they do with archived documents? Um how is backup uh done? How do we ensure that there is enough storage capacity? Um so It might be uh that um and because there is a lot of um where used to be everything used to be uh written down on paper nowadays A lot of electronic documentation is available. So the role of IT becomes more and more critical. So um in relation to that electronic document management system, an auditor should also check If an organization has allocated enough resources, enough IT resources, so that means both people and infrastructure to make sure that the system operates effectively and without interruption. So, and that also goes to looking at the competences of the people that are working with that. So that electronic document management system is becoming more and more important in every organization Of course, after you've done the full stage one audit, you need to create stage one audit output. So that a stage one audit report is usually shorter than a stage two audit report. And an auditor should at least document observations that run can result in nonconformities during the on-site audit. Means that you can write down as an auditor areas of concern That could be classified as a non-conformity during a stage two. So stage one doesn't necessarily need to meet requirements of a full audit report So in in um any case and when there are major nonconformities detected during that documentation audit The organization or the auditee should make time available to do the modifications to the management system and submit the correct documentation also to the auditor to ensure that you are ready before the stage two So it might happen that there are some big gaps that need to be closed, and then an auditor will ask you to either send the documentation or to set up a Teams call or some remote meeting. To check if you've closed the gap in order to successfully succeed with the stage two. So, in summary, the purpose of a stage one audit is really to review the overall design of the ISMS. The main activities undertaken during an on-site visit on a stage one audit are the evaluation of the auditee's site-specific conditions. Contact establishment with the personnel of the Audity and the observation of the technologies used and the operation of the ISMS in general. The main objectives of reviewing documented information are to get a general understanding of the function of the management system. To evaluate the management system design as well as the related processes and controls, and of course to verify if the internal audits and the management reviews have been conducted Strategic documents should include the ISMS scope and the ISMS policy, the risk evaluation criteria, the resources for the ISMS operation, the management review, and the internal audit program.