Section 17 will provide you information that will help you gain knowledge on the process of drafting and documenting audit findings and non-conformity reports. So apart from being one of the most important elements of the audit, and most companies are only really concerned about the audit findings, but audit findings are also the determining factor in drawing the audit. And they comprise all information relevant to the observation of a potential deficiency or effectiveness of the process. Auditors are obliged to pay careful consideration to the documentation of audit findings. This also helps them in decision making and whether a report is an issue in writing or to just just discuss it by the audit or to simply omit it. Audit findings is not the same as audit evidence. Audit evidence is factual. where an audit finding is um the product of the evaluation of an auditor, which is by definition subjective. So the auditor's observation of a change management procedure can indicate whether such a procedure complies with the requirements of The standard and the specific requirements of an audit by example. So the audit criteria is also the results of an evaluation of the collected audit evidence is always against the audit criteria. So it should indicate conformity or non-conformity. And audit findings can of course also lead to the identification of risks, opportunities for improvement, or of course also recording of good practice. If the audit criteria are selected from statutory requirements or regulatory requirements, and the audit finding is termed compliance or non-compliance. So non-conformities should be recorded, and non-conformities can be graded depending on the context of the organization and the risk. The grading can be quantitative, for example, from one to five. and qualitative, minor or major. They should be reviewed with the audit T in order to obtain acknowledgement that the audit evidence is accurate and that the nonconformities are understood. When there is any diverging opinion, you should undertake as an auditor all attempts to resolve that. And if you can't resolve it, it should be recorded in the audit report. So it should not be the case that an auditee is surprised by the findings that you have. You should communicate them with them. And of course, if you're working with an audit team You also need to come together with your other team to get agreement on the different uh findings that you have. So when we look at the annex A18. 1 from um the ISO 1911, there are a couple of things that is stated there um with regard to the audit finding. So of course Um you should look at the following things. It's a it can be a follow-up on previous audit records or conclusions You of course look at the requirements of the audit client. You look at accuracy, sufficiency, and appropriateness of objective evidence to support the audit finding. If you don't have enough evidence, you can't write it. You have to look at the extent to which planned audit activities are realized and planned results are achieved. You need to look at findings exceeding normal practice or opportunities for improvement. You also need to indicate the sample size. and the categorization of the audit findings, so major or minor basically. During an audit it's also possible of course to identify findings related to multiple criteria Where an auditor identifies a finding linked to one criterion on a combined audit, the auditor should consider the possible impact on the corresponding or similar criteria of the other management system. So depending on the arrangements with the audit client, the auditor may either raise separate findings for each criterion or one single finding combining the reference to multiple criteria. Now requirements can of course originate from several sources. So audit findings, you can either have a conformity or a non-conformity as stated in the ISO 9000 Nonconformity is a non-fulfillment of a requirement, and a conformity is then the fulfillment of a requirement. So those requirements can come from several sources. They can be specified in the standard But it can also be part of a requirement internal to the organization. It may be a part of a law or legislation, or it may be part of a signed contract with a client or a partner. So uh uh there are a couple of instances that can lead to a non-conformity, of course. Uh documented information is not adequate A process or a control is absent or does not fulfill its function, or the process or the control does not provide the extended output. So then we make a difference between a minor and a major nonconformity. So let's start with a minor nonconformity. If you look at the definition, minor nonconformity is the partial fulfillment of a requirement. So a minor nonconformity raises certain doubts about the ISMS ability to help an organization achieve this information security objectives and meet the requirements of the ISO 27001 standard It presents basically a minor risk, but not one to be ignored to the organization's interested parties. So but it basically does not affect the capability of the management system to achieve its attendant results. So it is a minor nonconformity. There are certain doubts, but it does not have an effect on the capability of the management system to achieve the intended results. So that is a minor nonconformity So some examples of non-conformities. For example, let's have a look. Some inconsistencies with the risk assessment report were observed. Or you have a few employees who have certain information security roles but they did not receive adequate training You have a couple of procedures that have not been reviewed or updated when it was supposed to be happening. Some of the non-conformities from a previous audit were not closed as planned and there was no justification provided. A planned changes related to the ISMS were not communicated, so there might be a different type of thing. So now how you um need to document them, like for example, uh this the the description of the detected nonconformities. Of course you you don't write like it's stated on the slide here as some inconsistencies with the risk assessment report and you need to uh describe it a little bit better. So you could, for example, uh describe the organization has implemented procedures to ensure compliance with the use of proprietary products. However, the Adobe Illustrator software is installed in 46 workstations despite the fact that the organization has only 40 user license And the audit criteria then would be that the organization shall implement appropriate procedures to protect intellectual property rights, which is control A532 If we then look at, for example, clause 5. 2 at the top management shall establish the information Security policy, then a description could be. The organization has defined and communicated the information security policy that includes a framework to set objectives and has outlined a general orientation and action principles Concerning information security. The policy takes into account the requirements related to business characteristics as well as the legal, regulatory, and contractual requirements. However, there is no reference to the continual improvement of the ISMS, which is a standard uh part of it. When looking at um clause 7. 5. Three, for example, which is documented information required by the information security management system and by this document shall be controlled to ensure it's available and suitable for use. where and when it's needed and it's adequately protected um against loss of confidentiality and property use and loss of uh integrity. a detected nonconformity could uh be something like this. The organization has implemented and maintains a document management system for its ISMS However, there is no documented information related to the ISMS that specifies the location of the official versions of the currently operating security Procedures. So that might be some examples of minor nonconformities. When looking to major nonconformities, is the non-fulfillment of a requirement or a total failure of its effectiveness? So a major nonconformity raises significant doubts about the ability of the ISMS to achieve the information security objectives and meet the requirements of ISO 27001. and uh presents an unacceptable level of risk to the organization's interested parties. So that really affects a major nonconformity really affects the capability of the management system to achieve its intended uh result. So you have a certain control not in place while it should be in place You have a couple of minor nonconformities that are associated with the same requirement that could also lead up to a major nonconformity. So what happens it usually leads to postponement of the certification and usually it also leads to a new audit, which is then called a special audit So what needs to happen then is that the audit T is required to complete a response to the major non-conformity within a certain period. And so prior to be putting forward for certification, all major nonconformities need to be resolved to move forward in that process. So again, what could be a couple of examples? Um, and I'll dive a little bit in the right description then. So there might be lack of commitment from top management, there might be lack of competence of people in charge of managing the ISMS. There might be lack of corrective actions to address recurring incidents, requirements not addressed properly, or lack of evidence of internal audit activity. So if we then look at how it would be officially described in an in a report and an audit report, if we then look at, for example, NXA8. 1 which is about information stored on, processed by or accessible via user endpoint devices shall be protected. So a description of a non-conformity could be The organization's personnel are not all aware of the policy and security measures for acceptable use of mobile devices. Might be a non-conformity. If you look at clause 7. 2b, the organization shall ensure that these persons are competent. So this is about a lack of competence. Possible description could be the organization has established an internal audit program with suitable audit procedures. Last year's audit activities were carried out by an intern, so recent graduate, with no experience or qualification in management systems. System audits, that's also an issue. Description SO if you look at the organ uh seven uh class six dot one dot 2E, the organization shall define and apply an information security risk assessment process that evaluates the information security risks A possible detected non-conformity could be the organization has developed a risk assessment methodology adapted to the ISMS. However, it does not allow the organization to effectively evaluate information security risks. So you have a risk assessment process, but it doesn't help with managing or evaluating information security risks. And then the third thing that an audit can find, or an audit finding that can be written, is an observation. So an observation is basically a situation Or an element observed during the audit that may be subject to improvement without necessarily being a non-conformity. So observations are often followed by recommendations to improve the efficiency of the management system, but the auditee is not obligated to implement the corrective actions for the auditor's observations. So observations are usually documented throughout the audit report because some of them may constitute weaknesses in the management system. So you want to follow up on such weaknesses as auditor during the upcoming audit. So you also want to check not only do you follow up on major and minor nonconformities But in a follow-up audit, you also want to check. We had a couple of observations. What did you do with the observations? Did you take them in consideration? What did you think about it? So you should document that properly. So there are two things that you can do. Usually it is included that an observation is included in the audit report. Um but um yeah it's not per se necessarily you can do it in the audit report or in the general attention points or general observations. It's a little bit dependent on how the template of the certification body uh works but observations um can basically not influence the conclusion of your audit and then we still have something like which is Called an anomaly. An anomaly is a deviation from a requirement or from the target set by the organization, but it still remains within the organization's established and acceptable levels. Um anomalies are also documented in your audit report, but um or in the working papers or on the notes that you uh make, but they're usually not included in the audit report, while an observation is included in the So to give an example of an uh anomaly, an organization with 100 employees has decided that 90% of the employees must attend an awareness session. In the first three months of employment. If the auditor finds that five employees have not attended the session within the three months, the auditor will consider the finding as conforming to the organization's requirement. At a five documented cases represent anomalies, deviation from the organization's requirement, but the overall process is considered effective. On the contrary, if um an auditor finds out that 15 employees um have failed to attend the awareness, they should report this as a non-conformity because the number of anomalies is beyond the acceptable threshold as uh set by the organization 10%. So if the organization would have put the threshold of 20%, then of course it would still be an anomaly. So that's really dependent on what the organization has set for itself.