Hi there, my name is Carl Carpenter. I will be your instructor. I am a consultant for Arrakis Consulting, a full service cybersecurity firm. I've been dealing with cybersecurity for over 30 years. I'm also a former chief information. Security officer for a $6 billion entity dealing with all types of regulatory environments. And for this course, this is the ISO IEC 27001 lead auditor course Sponsored by PECB. Hi, thank you for joining me. This is section six for the ISO IEC 27001 course. Fundamental audit concepts and principles. In this section, we're going to talk about audit standards, what is an audit, types of audits, involve parties, audit objectives, and criteria a combined audit, principles of auditing, and competence and evaluation of auditors. Be warned this is a fairly long section, so make sure that you have plenty of coffee So what is an audit? Well as per ISO 19011 Clause 3. 1, it's a systematic, independent, and documented process For obtaining objective evidence and evaluating it again objectively to determine that the extent to which the audit criteria is fulfilled. So it's basically An assessment by an auditor on the evidence and the facts that a company is trying to present to that auditor. So it's it's very simple just asking a lot of questions and then evaluating the evidence that's provided, making sure that the evidence is in alignment with uh policy standards, procedures, processes, things like that, as well as possibly national or international guidelines So audits can come in a variety of flavors. There could be financial audits, there could be administrative audits, there could be an information systems or information security audit, which is what ISO 27001 is based on. So there's international standards on auditing, so ISO 1911, that provides guidance on managing an audit program, planning and conducting management system audits, as well as the competence of auditors. 19,011's most crucial aspect is that it provides the fundamental principles of auditing. But we also have 17,021. Uh-huh, which contains requirements for bodies providing audit and certification of management systems. So by complying with this standard, a certification body can prove competence, consistency impartiality and ensure credible certification. There's also ISMS audit standards, so 27,000 six-1, in addition to the requirements of 20 of 17,001-1 Certification bodies that provide ISMS auditing and certification services must also meet the requirements of 27006-1. This standard specifies requirements regarding the competencies that auditors must possess to audit an ISMS. There's also 27,007 And that twenty that standard provides guidance on managing an ISMS audit program, on auditing an ISMS against the requirements of ISO IEC 27001, and on the necessary competencies. That auditors should have to effectively audit an ISMS. So this standard focuses on ISMS audit activities and their steps. The importance of vocabulary is critical when it comes to auditing, not only from the standpoint of what the auditors say or do or write, but also from the standpoint that when the auditors are interacting with the auditee, that we're all using the same language and we understand that. So auditors need to have a firm understanding of the vocabulary and terminology that ISO uses in its management system standards and the terms and definitions that are specific to 27001. And we'll go over some terms and definitions in a few slides for now. So there are potential sources for the different types of vocabulary. So the one that uh is highly suggested is online browsing platform. It's a tool developed by ISO which provides access to ISO standards, terms, and definitions. But you can have other sources as well. So there could be specific publications by ISO, guidance documents, articles. possibly a glossary or or so on. You just want to make sure that if you're going to pick a term for vocabulary in or when you're interacting with the auditee, that you are using consistency in in relation to the terms. So standards themselves, like guidance standards, they will also have terms that could be relevant that you'd want to make sure that you're consistent with in relation to your conversations and your uh your recording of information or reporting or so on. So for example, ISO 9000 has uh deals with uh quality management. 27,000 is the ISMS family of standards. 27,001, as you know, is this is the course that would be for uh information security. And then based on the harmonized structure of the management system standards, clause three of a management system. Standard will contain relevant terms and definitions which are typically organized according to the veri uh hierarchy of concepts It's also important to understand that clause 3 is fairly consistent across any standard. They're always going to have the same set of terms. So we also have verbal forms. So ISO IEC directives provide the general principles for structuring and drafting ISO IEC documents. So, among other things, the document states that particular attention should be given to the verbal form of a document to distinguish between requirements, recommendations, permissions, possibilities, and capabilities. So auditors should be aware of these forms as well as how they evaluate the auditees when they're evaluating the audite's conformity to 27,001. So the important part in in relation to these uh different verbal forms, so if we have the verb shall, That is a requirement. That's not something that the uh the oddity can decide to not do. It's they shall do it. If there is the the verb should is uh in use, then that means they should do it, but that's not a requirement. It's highly suggested that they do it, but it's not a requirement. And then may means that the auditee could do something if they chose to, or maybe they don't. And then the other one is can, which is a possibility or a capability. So again, from the standpoint of shall, should may can, it is very important that you understand the difference Not only from the standpoint of auditing, but also from the standpoint of when you're going to basically be taking the certification test, you are expected to understand those words. Now in relation to shall uh shall you know is a requirement. It's also important as an auditor to understand that in certain cases if something is not done then there needs to be uh there needs to be some sort of explanation of why it's not applicable. So for example If a company is completely hybrid, they have no physical location, but the ISO 27001 requires physical security. uh it it's not possible. So while there is a shall statement in relation to physical security, that doesn't mean it's uh completely applicable. So isoglossary, these are the definitions, so terms uh applicable means relevant, appropriate, possible to apply appropriate, suitable, meaning suitable, authority, power to command or give a decision. And the authority could be in a variety of different ways. It could be the CEO of the auditee uh or could be some other internal group. Competence, the ability to apply knowledge and skills to achieve the intended results I think that's fairly fair fairly self-explanatory and what competence is you guys are taking this course so you can gain the uh the competence so you can perform activities But that doesn't mean you're not going to continuously learn elsewhere. Conformity, fulfillment of a requirement. So in 27,001 If there is a requirement and they uh they meet the requirements, the guidelines of the requirements, then then that's a conformity. They've conformed with it. And obviously the opposite of that would be a non-conformity. which are repeatedly discussed in 27001. Continual improvement, that's recurring activity to enhance performance. Corrective action, that's some sort of action to remediate or mitigate a possible nonconformity and to prevent recurrence. So if there's an issue with an oddity of some sort, uh and you've identified that issue and they've they've understood it, they've recognized it, and so on. And you've said, hey, we need to have a plan to fix this problem, that would be known as a corrective action plan. So or a CAP, CAP. Documented information, that's pretty self-explanatory, information required to be controlled and maintained by an organization and the medium on which it's contained. So continuing on with glossaries. Determine, appraise or analyze quantitatively or otherwise find out. Identify Find out, mark or label, show, to reference something without ambiguity. Interested parties, persons, or organizations that can affect, be affected by or perceive itself to be a affected by a decision or activity. In relation to interested parties, it's important to understand that interested parties don't always have to be internal. They could be external. They could be regulatory bodies. They could be law enforcement It could be clients, it could be board of directors or shareholders. Interested parties are essentially going to be anybody that might have a reason to care about whatever it is. Maintain can enable to continue. So if you're sufficiently doing something correctly and you continue to do it correctly, then you are maintaining Nonconformity, that's the opposite of a conformity, that's when you're not meeting the requirements of the standard or whatever particular area of the standard. Organization, company, corporation, firm, enterprise, authority, or institution, person or persons or part of combination thereof, whether incorporated or not, public or private. That has its own functions and administration. So again, in 27001, you'll hear this a lot through other sections, understanding the context of the organization. So think of that as uh in most cases it's going to be the um the odd T. Retain means keep top management. Person or group of people who directs and controls an organization at the highest level. So there's different types of audits that you should be aware of. We'll go through those. The first party audit is when the organization audits its own processes. So say for example an organization had an internal audit team. And they audited themselves and most organizations at some point will get to that point or uh or have somebody do it for them. That's a first-party audit. Now you can also have It's still a first-party audit, but you can also have an organization outsourcing internal audit functions to a trusted entity that basically acts as an internal audit team. So if you're auditing yourself, that's a first-party audit. We also have second party audits. So if uh a second party audit Could be where the uh the the actual customer of the organization itself is auditing the organization to determine if they want to do business with the organization. And it's important to understand that the organization is the auditee. So we have the audit the auditee and we have the customer. If the customer wants to do business with the auditee, then they can audit them And to find out if they're safe to do business with. That would be a second party audit. Another type of second party audit is when the organization or the auditee has vendors So possibly say for example uh an audit T is uh on Amazon or or Azure or G Suite or something like that, and they want to evaluate are those entities safe to do business with. So they may audit them. That's also a second party audit. In some cases that's that could be known as vendor due diligence. Now in a lot of cases, not saying Microsoft or Google or Amazon or Oracle are dangerous to do business with, because they're probably not. But other vendors that are less well known, that are probably startups or something like that, that an organization might do business with, this might be more critical for that. You can also have third-party audits. A third-party audit is when a organization is audited by an independent organization that's completely independent. They have no knowledge of any previous audits. Uh they have no knowledge of anything. They're coming in uh basically not knowing anything at all, and uh they're gonna audit and and uh give an assessment. And that's the kind of audit that uh you'll have certifying bodies uh participate in so that they can certify the auditee themselves So in this particular slide, we can see different forms of audits. We have the customer, which could audit the organization. That would be a second-party audit. We have the organization that could audit their own vendors That would also be a second party audit. If the organization audits themselves, that's a a first-party audit. And then again, a third-party audit would be something like a certifying body coming in to uh to double check make sure the organization is following the the guidelines of 27001 and then that could lead to certification for the organization You can also do a combined audit, and a combined audit is exactly what it sounds like. It's taking more than one framework or more than one standard, but auditing it all of it at the same time. There are some benefits to this because uh most in most cases it's going to save time and money. Uh so it's not necessarily a bad bad thing to consider. In relation to combined audits, 27,000 one, 9001, 37,001, and then 20,000-1 A combined audit can be much more than just ISO IEC frameworks. So in the United States, for example, it's very common to do 27001 and SOC2 together. And that's two different two different standards, two different frameworks completely. So again, from the standpoint of combined audits, they're certainly possible. You just need to make sure that there's adequate planning And again, if you're going to have somebody who's going to do a combined audit, make sure you have adequate competence training, certification to even do the audit um and and go from there. Involved parties out of 1911, clauses 312, 313. 314, 315, and then out of 17,021-1 clauses 38, 39, and 316. So these are some examples of A uh involved party, we have the audit client, otherwise known as the auditee. That's the organization or person requesting an audit. We have the auditee, that's the organization as a whole, or parts thereof being audited. And again, remember for 27001 or basically how you set up different frameworks. You don't necessarily have to audit the entire organization. You can audit just sections of it if if that's the goal of the audit client. You have the auditor, the person who conducts an audit, and that's basically you guys who are taking this course. You're going to be the auditor. You have the audit team, one or more persons conducting an audit supported if needed by technical experts. So obviously the audit team would be people composed of auditors. and everybody's capable of doing the auditor job, they're certified, or or so on. You can also have a technical expert, person who provides specific knowledge or expertise to the audit team. It's important to understand that as an auditor, you're not required to know every single thing for every possible concept of every single framework that's out there. So for example, if you're going to audit a software development company, for example, and you're not a developer, you probably are going to have to have some help. Or maybe there's a company, an auditee. uh audit organization that uh wants to that's heavily heavily using databases or something like that but you're not necessarily a database person you may want to bring in a database person to evaluate their configuration So technical experts are certainly possible. They're certainly also possible in the areas of network engineering, network security from the standpoint of network architecture, and so on. So it's not it's not unheard of to do that. There's also observers, a person who accompanies the audit team but does not audit. This could be a person from the audit company themselves, possibly somebody who's uh learning how to be an auditor or possibly somebody within the audit company that is uh evaluating the performance of the auditor or the audit team uh themselves And then there's also a guide. That's a person appointed by the client to assist the audit team. I'm a huge fan of implementing and using guides whenever I help a company get ready or if I'm involved directly with audits. The reason why is because a guide will generally have direct access uh to people or areas of the auditor or audity environment that allows for faster access to get things done. They basically can cut through what we call red tape. You can get things done faster and smoother with less hassle. And realistically, guides make things go uh a lot easier