Section 10 aims to provide information on receiving an audit offer, appointing the audit team leader and other audit team members, determining, of course, the audit feasibility, accepting the audit establishing contact with the auditee and defining the audit schedule. So this is really the kickoff of the audit. So let's have a look So PECB has developed a methodology developed for auditing a management system. It's known as the accepted auditing methodology for management systems and standards. In short, it's AMS2. This methodology has been developed based on best audit practices and on ISO 1911 guidelines, and it also meets the requirements of ISO 17021-1. So the AMS II consists basically out of six phases. It's very similar to a normal audit cycle. So the six phases are the initiation of the audit process. Then we go to the stage one audit. Step 3 is the preparation for stage 2 audit. Step 4 is stage 2 audit itself. Step 5 are the audit conclusions. And step 6 is beyond the initial audit. So each phase within the AMS II has three to five steps, which are further divided in separate activities. The methodology also consists of two supporting processes which are communication during the audit and management of audit risks. During the training course these steps will be presented and illustrated in a chronological order The activities in each step. So each phase has two to five steps, and in those steps there are a multitude of activities that need to happen. We will not dive deep into the activities because they depend on the specific context of the audit. So the appointment of an audit team leader, for example, will depend on whether the certification auditor has a qualified auditor or not. And these steps involved then a series of activities such as a job interview, signing of the contract, which we will not go deeper into So on the slide, you see the six different phases with the activities included there. And you see, as a supporting process, is of course the communication during the audit and management of the audit risks. So, for this section, we will dive into phase one, which is initiation of the audit process, and we will talk a little bit about the five different steps that need to be taken there. So, first of all, you need to accept an audit mandate, and the certification body needs to accept the audit mandate and the certified auditor as well, and you need to appoint an audit team. So prior to accepting that audit mandate, the auditor receives an offer from the certification body. So that's of course a little bit dependent. on how the qualified auditor is appointed. Is it an employee? Is it a full-time employee? The engagement in audit is already part of the employee contract, so there might not be an official offer or an official mandate. The same goes goes when a certification body works with self-employed auditors and they have like a contract which is uh an open-ended contract um then you don't have that specific of offer either. So the process of accepting the audit mandate helps of course in avoiding any misunderstanding that might arise during the audits. And the official audit offer then offers as the yeah as a contract between the auditor and the certification uh body um and it's best that it's formally signed. So if I look at my experience as an external audit I don't get um specific offers per audit. I have an an open-ended contract as being self-employed And we agreed on the number of days that I would do audits. And as long as the days have not been fulfilled, the calendars are checked and there's also of course a check of on the independency. and then the audit company just uh completes um the planning in my calendar so but it will be different from certification body to certification body Now looking at the audit offer, what is usually included in an audit offer? Of course the audit scope um the audit objective and the criteria. The duration of the audit and will it be ten days, will it be twenty days, will it be only three days Potential audit team members, the responsibilities of the audit team members, what are the limits of the audit engagement And um of course uh almost also very important uh the auditor's payment is also very important, of course. Um so the auditor and the certification body should agree on that uh audit offer and on the terms of the offer mandate. So just to ensure that there is no misconfusion, there's no discussion afterwards. So on the following slide you see um an example of an audit offer where you see Basically, name of the auditor that they state that there is an um an audit that needs to be happening against the ISO 2701. You see there is a line on Your responsibility will be to ensure that the organization has implemented and continually maintains and improves in signing the offer as well as the attached terms and conditions. You agree to those and you will perform the audit in uh name of the certification body. You see the duration it will last 16 days which is already a pretty long audit And the audit scope covers the organization's headquarters, including the data processing centers and seven offices. And the other team members will collectively have the necessary skills and expertise to conduct it. And the payment details will be specified. in an uh a separate document. So it really entails everything that you need to know before engaging in an audit for you as an auditor. Now, um appointing an audit team leader is of course very important. Before each audit, the certification body should appoint only one audit team leader. That person is a is responsible. For conducting the audit until its completion. So the audit team leader is the one who uh drafts up in the end the non-conformities, who comes with the conclusion he's and responsible. So um very important here on the terminology and the term audit team leader is not um the same as certified lead auditor. Although uh there might be a lot of team members on the audit team that are also lead auditor, but the team leader is basically the one that leads um the audit who has um the duties and has certain duties and responsibilities And everybody involved in the audit team should also agree, of course, on the authority of that audit team leader. If you have misconception on what the audit leader is supposed to be doing, you get a lot of frustration. So the audit team leader is responsible for a lot of things. He needs to he or she needs to plan the audit. He needs to think about potential audit risks and he needs to think about how he's how he's going to address them. He or she is also responsible for undertaking the communication with the audit team. He needs to manage the audit team. He needs to assign the responsibilities to each team member. Here she also needs to solve any conflicts within the audit team or conflicts with the audit team. Here she is also responsible for drafting and reporting the audit conclusions. And he or she needs to uh prepare the uh audit report as well. So um there are a lot of responsibilities that come with the audit uh team leader. How it usually happens is that the team leader is basically responsible for everything and you have in an audit regular touch basis during the audit to check whatever goes wrong or what non-conformities that you have have encountered during the audit Of course, you also want to select an audit team. Any successful audit will be dependent on the audits, the auditors that you choose, the competence that they have. um the expertise that they have uh with the industry. So um when you decide on uh the size and the competences of an audit team um you need to take into consideration a couple of things First of all, you need to have a look at what is the audit mission and what are the audit objectives, what is the scope, what is the location. So you Um you also need to ensure because everything um needs to be paid by the audity, so you have to have a look at okay where is the the audit happening uh Do I have auditors close by? Do we need to fly them over? So that will be uh one part to think about. You also need to think about what are the required competences of the audit team And do we um need any specific expertise um to communicate with the oddity? Um is there technical knowledge necessary? Uh what language is the audit uh in Is there any um social or particular cultural characteristics that we need to take care of? Um for example, I can imagine if you go and audit in Saudi Arabia, it might not be the best thing to send uh a woman or perhaps it is or and the same goes for Israel for example. So you want to think uh about any social and particular cultural characteristics And you want to have a look at each individual team member. Is there a conflict of interest? Are the auditors obviously available? What is the specific expertise as well? So Um if you just pick and choose without taking these things in consideration, that will have an impact on the effectiveness and the efficiency of the audit, of course. So it might also be the case that you don't have any specific technical knowledge in the audit team and that it's still required then you can add technical experts um or translators um to uh the audit team just uh to help them um yeah perform the audit and when you use of course translators or interpreters uh they should not um yeah affect the audit as such as so they're just there uh to basically translate whatever needs to be done So when selecting um the audit team, um you there is a difference, of course, um in what you uh should be looking at. So um the individuals that manage the audit program, and the so the the lead auditor. needs to appoint those members. It usually is done together with the certification body, but you need to take into account competences needed to perform in line with the objectives to perform that individual audit. So of course you need to have a look at the overall competence of the audit team. So you need to have a look at okay what is the competence needed as I already explained And you also need to select those other team members so that you have all relevant uh knowledge in there. So you need to have a look, and depending on the size and complexity of the audit, of course, you need to think about okay, what is the overall competence that we need? What is the complexity of the audit? Is it a combined audit? Are you doing multiple management systems? What are the audit methods that you're going to use? Can everybody act in an impartial and objective way? How are people working together? How are they able to communicate with the external parties? What is the complexity of the processes? What is the language? But when looking at the audit competences, uh each auditor mainly needs to be able to communicate in a good way. They need to be able to work together. although usually uh auditors um are used to working in solitude. Uh you don't always have an audit team. Um but if you have an audit team you need to be able to work together well. You need to have good communication skills because you also need to communicate of course with your customers. You need to know the risk-based approach to auditing. You also need to of course understand the standards, the audit standards, the procedures In ISO 27001, you of course need to understand what requirements of 27001 are, and you also need to understand organizations main business processes. So you need to have a basic knowledge on whatever the organization is doing. At least one audit team member should have knowledge of the industry in which the Audity operates Knowledge of the Odity's language, of course, expertise in each domain to be audited, and some knowledge about legal and other requirements that the auditee is subject to So it is very important that uh you take that into consideration. Of course, um not everybody uh will have all uh the knowledge and that's not really necessary. You can add as I already s stated. Technical experts. You can also add auditors in training, but they're not supposed to be working alone, so they always need to participate under the direction and guidance of an auditor. So it's very important that everybody knows what their role is in the audit process, and you need to ensure that you have the necessary skills and competence available. Usually, at least that's my experience, this is checked beforehand, also in the initial stage, to understand what is the specific need that the organization has. Now, an audit client or an audit tee has the right to request a replacement of an audit team leader, of course. You need to have valid reasons. So, what usually happens is that the certification body provides with the names of at least the lead auditor but also the team members And an certification body can also present with a resume or some background information to the certification to the auditee. um to give them enough time to do an analysis if that's happened. Now I haven't seen that happening a lot. I we usually provide with the names um but an RDT Can say I I don't want to have that person um on the team, I don't want it, but there needs to be a valid reason of course. A valid reason can be a couple of things. It might be that there is a conflict of interest. That might be a real one. For example, the auditor has previously worked for the Odity, or a perceived conflict of interest. For example, the auditor has worked for a competitor and uh the audit doesn't want uh the auditor um to see their internal processes as well. Um the fact that an auditor has previously displayed uh unprofessional conduct might be a good uh reason. It might also be the case case that in certain industries, some sectors like um aviation, um anything that has to do with defense, nucle nuclear power, those kind of things It can be the case that an auditee requests the auditors or members of the audit team to hold a security clearance or a background check because you need to do that from out of legislation sometimes. So it might be the case that that is requested as well. So it is of course very important that you communicate the reasons that a customer or an oddity asks you to remove somebody from the audit team to communicate that as well. So um as I already said uh you don't have if you don't have the clearance you cannot go and audit. Um I know uh um unprofessional conduct um conflict of interest, all good reasons um b by which an um an audit um yeah an auditee can refuse to have you Sometimes you also have like um yeah it doesn't click yeah sometimes you you just don't have the glue that sticks you together. That might also be a reason um for an auditee or even from an auditor um to ask a replacement if you feel that you it's not comfortable, it's not working, if you get frustrated from one another, you should take that into account.