Okay, so in this section we're going to explore the concept of communication during an audit. We're going to have a look at a few different things, including things to think about when conducting on-site visits, how we communicate both within the audit team and to the auditee during an audit. We'll have a look at different audit team meetings that are important. And we'll also explore the issue of conflict management, both conflict within an audit team potentially, and potential conflict between the auditee and the audit team and how we Try and address some of that. We'll also consider cultural aspects, which is an important part of audit planning and execution, and also how we handle the communication with top management, another vital part of the audit process So let's address the first point here, behavior during on-site visits. I appreciate you're all professional people and some of these things might come across as being sort of relatively sort of obvious things to say in terms of professionalism, there are a few things to to think about. Of course, we want to make sure that if we're involved in an audit, you know, conducting an audit on site, that we do conduct ourselves professionally, you know, making sure we know and follow any rules and policies that the organization might have, particularly around things like health and safety and so forth, making sure of course turning up on time, following the audit plan, you know, just demonstrating that all-round professionalism And that also comes sort of in dress code as well. And part of that is understanding, let's say, the expectations of the auditee in this case. But the big one for me out of all of these is the being a role model so to speak. What we mean by that is the old practicing what you preach, so to speak. So believe it or not, I have seen audit situations before where auditors who are auditing information security come on site and do things like leaving the laptop unattended unlocked or leaving notes on the desk. or using removable media and things like that. The last thing we want to do is be expecting the organization to behave one way whilst doing completely the opposite. really set a good tone. So if anything, I would say that is probably one of the most important points, as well as you know the obvious stuff of being polite and courtes and so forth. Now during an audit there is many ways in which we exchange uh information whether that be between ourselves as an audit team or between us as the audit team and and us as the lead auditors and the auditee And communication can be done in multiple ways, whether that's verbal, in writing, and so forth. And there are a few important points to take into account. account. And one of those is when we're planning an audit we should think about the ways in which we're going to exchange information, particularly with the auditee. So some things I try and agree in advance of any audit is how will I keep the auditee appraised of what's going on? So usually I would recommend at the end of every day, for example, having a summary meeting with the auditee. to explain how well the audit schedule is going. You know, are we on plan? Are there any concerns? If there are any potential non-conformities or issues and communicating those to them. We should agree in advance as well about how things like that are communicated. Also, what if we run into problems during the audit? Whether that be conflicts, which I'll come to a little bit later on, or any other concerns that we might have, how do we report those and in what form? So it's important to think those things through because we want as smooth as possible. interaction. So let's think about the different types of communication that would be valid in an audit setting, starting with verbal communication. Well that's going to form the vast majority of the audit because ultimately as an auditor or a lead auditor or an audit team we're always going to be talking to the auditor. Getting this right is a great way of building those professional relationships. It's a good way of immediately transferring and sharing information. Rather than me emailing somebody and asking for a response, you know, being able to interview somebody and ask them directly about how something works. And of course it's feedback, we can give feedback as we go. Now the only point I would make about verbal communication is from an evidence point of view, verbal evidence is considered the weakest form of audit evidence. In other words, you know, if somebody says to me, you know, yes, we have the following process in place for anti-malware management, for example. That alone is a starting point. That alone is not evidence in that case. In other words, I'd want to then see the process if that makes sense. sense. So it is important that we um we address that. Now one of the things that's really important I find from experience of doing audits Is making sure that the audite is on the same page as you in terms of understanding. What I mean by that is you may well be the information security expert and an expert on ISO 2701. So maybe some of the technical jargon like clause numbers or technical jargon about a particular area of security might be second nature to you It might not necessarily be second nature to the person you're interviewing. So it's always important whenever we're having an interview or we're exchanging information with the audience. Just to make sure we we're speaking in the right level. And if we're using specialised terminology that we explain it the best way we can. We don't want essentially a misinterpretation. If I ask a question and the person I'm asking misunderstands me. So we recommend as much as possible to use plain language, avoiding technical jargon. Now I appreciate if you're in a conversation with a network engineer or a you know a software developer at that point fine you might need to get into more technical discussion but certainly at uh those higher levels thinking very carefully about the term we use. I tend to avoid when I'm actually talking to auditees quoting clause number or control numbers from the standard. For example, I did an audit recently we talked about threat intelligence. And rather than me just saying tell me about threat intelligence, I just kind of explained what we meant by threat intelligence and then allowed the audite to give some feedback Feedback. It can be useful during an audit as well if there's anything complex to present to think about using things like visual aids. So for example, when I'm explaining the certification process Rather than just verbally explaining the steps, I uh I do use the diagrams. Okay, this is step one, this is how we progress to stage two, this is what a re- when a recertification audit happens, for example, we walk them through the process and It is also a good idea as an auditor to constantly seek feedback about whether of course you're being understood, whether you're clear. So sometimes if I'm in a conversation with somebody, I'll say you know one of my bad traits or good traits depending on your view is I'll often say things like does that make sense um you know is that clear uh and I'm not doing that to sort of vindicate myself it's almost let's just make sure um because if it if if i'm not making sense or i'm not clear enough then it's down to me to then re rephrase the way I'm asking questions. Essentially I want the auditee to feel as comfortable as possible, familiar as possible with what we're asking so we can get the best quality answers and Go in the right direction. Now speaking of communication, one thing that a lead auditor really needs to think about is managing their audit team effectively and managing the audit end-to-end. Because ultimately, as a lead auditor, it is you who is responsible for the overall audit conclusion and the report back to the auditee. So this needs to be very well managed. So we recommend if you've got an audit team to have every day two meetings, even if they're small, a morning meeting with your audit. team before the audit starts, maybe 15 to 30 minutes, to talk to the team about what's expected for that day, to discuss any potential challenges or problems that might come up um and so that we prepared. What I don't want to happen is to start the day and have auditors in the team maybe not clear for example about what's ex Or you know, have somebody worrying about a potential problem and they haven't told us about it. So this is the opportunity. Equally at the end of every day, what I always suggest is again with your audit team, 15 to 30 minutes. to get the team round the table or online and to discuss any issues encountered in the day. You know, did the team members who are working on your behalf, did they manage to cover everything? Did they run into any problems? Are there any conflicts or issues? Do they have adequate evidence or a bit of a quality review of any audited items? So for example on a recent audit I had an auditor in the team who during the day had identified something that was potentially a non-conformity, but because in this context I'm the lead auditor that's come from me in this case as the lead auditor. So at that evening meeting the auditor took me through what he believed to be a minor non-conformity, explained why, you know, we both looked at the evidence. And uh in this case agreed that you know his view was correct. And at that point, I then know I can take that to the audite and present it. Um equally, if any of your auditors have run into any trouble, problems, you know, gone off track with the um. The agenda, these are things that can come up because as a lead auditor I want to capture problems early. I don't want to be getting at the end of the audit and find out there's been various problems that I wasn't aware of So make sure you bake them into your audit plan. Now what these meetings and discussions might reveal is potential conflict. And there is two types of potential conflict that can occur in audits and it is down to the lead auditor to deal with these. And these are conflicts with the auditee and conflicts within the audit team. So let me deal with conflicts with the auditee. First of all. So there is a possibility, and I'll go through each one of different scenarios that could crop up. So in some organizations, there can be internal conflict between people Or teams within the organization. And the point here is: as an auditor, I'm not there to referee or indeed to take sides in this case. And I can think of a prime example when I was interviewing a particular um person it was a well it's a CISO it was actually a security team within the organization uh and this security team was still doing a lot of hands-on network management And I I simply asked the question, which was a legitimate question, well how come this is under your team's remit and these you know these firewalls and other devices are not being managed by the you know the the IT team? And then this person basically went into a bit of a uh uh a rant you might want to call it about how incompetent the other the IT team was and how they didn't have capability and one thing or another and how certain individuals should be fired basically and things like this. Now at this point, um it is not my place as an auditor to start commenting on that. I've got to be very careful Obviously the last thing you want to do is show signs of agreement here because the last thing you want to do is create the impression that you're taking a side. You've got to try and manage that. Now in that case, because I I I just kind of changed the subject a little bit, it's okay. Right, I understand, you know, these devices are controlled by you. So now let's go into how that's done without sort of taking it any further. Um so trying to be as neutral as possible is the important point here, no matter what your personal opinion might be. Other situations that can crop up, unsuccessful interviews. So an unsuccessful interview, maybe you've got some time scheduled with somebody and the interview maybe goes off topic, for example, or maybe the person in front of you isn't kind of the right person to answer. those questions. So there's a couple of things. Usually at the start of an interview I'll ask the person I'm interviewing just to describe a little bit about their role. And part of that is to make sure have I got the right expert in front of me? So let's say I want to speak to somebody about network security and maybe I want to Have a deep conversation about that, have I got the right individual in front of me? Because there's very little point in plowing on with the interview, asking questions that the person may be unable to answer because it's not their role or their area of experience. expertise. So you can usually avoid that if you plan properly. Also if you've got an interview which may be going off topic a little bit, you know, the person's talking about something else sort of, you know. tr you're wasting a little bit of time and so forth. It's down to you just to bring it back on track. Now it doesn't mean you have to be unfriendly if the person, let's say, starts talking about the uh you know what they watched on TV last night or the weather or something like that that of course you can manage a bit of that kind of talk but if it's something to go much deeper I'll say something like that's interesting perhaps we can catch up on that over the break or something and bring the the the the interview back on track That's different to deliberate what I would call antagonism or lack of cooperation. So this is a situation where the person you're interviewing, the audite, maybe sort of for whatever reason against being audited or may even be deliberately difficult. Now I'm pleased to say that despite mentioning it in here, that's a rare occurrence. I find most auditees ideal With quite professional and willing to share ideas with you and so forth. But it can happen. And I had a case, prime example of this, was I was interviewing a HR manager because, of course, there are requirements. people controls and I remember interviewing this HR manager and I introduced myself, I explained why I was there and you could see he was obviously very busy and he said to me at this point he said to me I don't understand why I'm here. This this topic's got nothing to do with me. You know, we have an IT team, we implement things like firewall and antivirus and all of this, and we're really good at security, so why am I spending my time in a meeting with you. Quite antagonistic at this this point. And so of course I tried to be as polite as possible. I said, I understand what you're saying. I said, and you're absolutely right. You know, you do have these controls in place but part of the standard also covers uh things like recruitment and managing starters and levers and so forth. That's why we have this session And he wasn't overly convinced and more or less told me, long stuff, long story short, that I was wasting his time. Now at this point, I'm not going to get into a heated argument with this individual. What I actually did is okay, I can see you're busy. Thank you for your time. I'll probably stop that here and move on to something else. Then what I did after the interview is if you have a situation like that or an unsuccessful of you you've got to tell what we call your audity contact. Not because I want to get this person into some kind of trouble or cause any more friction But I've got to explain this because I can't just say, well, the interview didn't go very well and I don't have the evidence, let's move on. What I did was I fed back to my contact at the audit Just look, I've attempted to have a meeting with this particular HR manager. They seem extremely busy. Um, I'm not sure they're too keen to take part in this. Um, can we resolve this? Now that might be by Bringing that person back. In this case they put me on to somebody else in the HR department who I spent some time with and we resolved it. Reporting these things back to the audity as well. Again, it's not about making trouble But it's about a principle in auditing called fair presentation. You know, uh if I just keep that quiet and don't say anything, uh that could cause problems later in the audit. Also, we could get situations of what we call wasted time. You know, what happens if you turn up for an interview and that person isn't there, for example, they don't turn up on time or something along those lines. Well again you can't just leave it. Again you need to speak to your auditee. Maybe the reason somebody's not there if there's a like an emergency situation I can actually observe them dealing with the real-world problem. But whatever happens, any cases like that, we need to reschedule. Similarly, imagine that you've gone for a lunch break and it's taken a bit longer than planned for every We can't just say, oh well, we've lost that working time. It's down to you as a lead auditor to address those problems. And I am pleased to say that despite presenting those, they are uh You know, fairly rare, but you have to be prepared for them. The other type of conflict that you could see potentially is conflict between auditors in the audit team Again, it's down to the lead auditor to have the management skills to deal with this. And some of these I would argue are more likely than others. So the first one, difference of opinion, that's certainly very possible You know, I know some really excellent auditors who would fight like cat and dog over certain things because as we'll establish, for example, determining if something's, let's say, a minor non-conformity or a major non-conformity. Can sometimes be more of an art than a science and comes down to a level of professional opinion. So as a lead auditor, ultimately you've got to oversee that. Now that doesn't mean you need to be arrogant and say, I'm the lead auditor, therefore I know everything. and I'll make the final decision. I do try and listen to people and listen to different opinions, but at some point the lead auditor has to say, okay, based on what I understand, this is the position we're we're going to take. So we try to be inclusive and manage that as best we can. The others I hope are less likely but should be mentioned. Difference in work methods I would imagine should be very unlikely because when you work for a certification body, the certification body usually sets the work methods. They'll lay out the procedures that should be followed. followed, the audit templates that should be used, etc. So it'd be very unlikely that I'm finding auditors arguing over work methods. But again, making sure before the audit starts everybody in the audit team has been properly Trained has access to the right information and is happy with what we're asking them to do is part of that. Personal conflict, well, really I would argue personal conflict between individuals can happen in any workplace. specifically in an audit team and speaking of somebody who in the past was a line manager who had to manage a team I recognize a little bit of this. Again, a bit like the dispute with an auditee. I'm not there to referee personal conflict. It is up to you as the lead auditor to potentially manage that. If there is real conflict, do we separate people. Worst case we could you know remove people from the audit team. I don't advise that unless things are really extreme. But again is about recognizing and managing that situation. If two people really don't get along when let's not put them on the same part of the audit for example And work attitude is a similar thing. Now what I would say about work attitude is when you work for a certification body, whether you're a lead auditor or a co-auditor reporting into a lead auditor auditor, your work performance is actually regularly reviewed. So I think any auditor who really was demonstrating a problem here, this would be hopefully route it out fairly early on but what I would say is it's down to the lead auditor to manage this and I do remember speaking to somebody who was a lead auditor so I was a consultant in this case My client was audited by basically a small audit team and I spoke to the lead auditor who I knew very well after the audit. And he said basically said to me, don't ever work with person X. And he actually named this individual, which I didn't think it was overly professional, but anyway, named this individual, don't ever work with M And I said, what was the problem? He said, well basically, he said, he didn't um write up the audit notes, he didn't finish parts of the audit report, and basically this lead auditor said to me, I had to stay up until three o'clock in the morning writing up his section. Now ultimately that staying up till three in the morning writing his section Was the right thing to do because the lead auditor takes ultimately responsibility. But the lead auditor will also, when they review the performance of that auditor, will hopefully feed that back. But again, I'd like to think those situations are very rare. So whilst we do need to talk about conflict in here, I don't want to frighten anybody into thinking that this is a hostile environment or anything, but yeah, let's be prepared, let's be willing to handle those situations. when they occur and a lot of them don't necessarily come from what somebody like me would say on a training course a lot of this you're actually going to learn through real-world practice real world experience