Hi there, thank you for joining me. This is section 18 for ISO 27001 lead auditor. We're going to talk about audit documentation and quality review. And as a part of that, we'll be talking about work documents and quality review. So this section is going to discuss the purpose of work documents and what auditors should include inside them. In addition, the importance of the quality review is also discussed in this section, how quality review helps the audit team to comply with the audit procedures. What potential mistakes can be encountered during the quality review, which should be avoided by auditors, and lastly, how to document the quality review itself. So work documents. Work documents serve as a the ability to support audit evidence Proof of the audit or proof to the audit quality and adherence or reference for future audits. So work documents should include Uh facts only. So the auditor should document only sufficient evidence to support the audit findings, but only facts. Now if those facts are observed because you did not have digital or written or any other form of evidence, but you personally observed it, then you can write observed, then whatever it is. Be written, these work documents should be written professionally and comprehensibly. Notes should be written concisely so that other auditors can understand what is written and why it was written and what was said. Thus, the auditor can use abbreviations and write in point form as long as the form is standardized and the terminology is known to auditors So be consistent in your terminology, which should not be too difficult amongst auditors. Identify the weak points Work documents sh must enable the rapid identification of any weak points in the audited management system and the arguments supporting the audit findings. So work documents are critical for the audit process because they allow you to record your thoughts, your findings, your observations. But we also need to understand that we we're going to point things out very quickly. Now, I don't know if it's in this section or not, but I'll bring it up right now. Work documents are the property of the certifying body. not the audit. They are a product that's created by the auditor, the audit team on behalf of the certifying body. So they belong to the certifying body, not the auditee. So here's an example of a work document. And the reason I say example is because there is no real requirement for templates. But most certifying bodies will have some templates that they're going to want you to follow, and each certifying body's template is going to be different. They could have more information, less information. They could have branding or logos or whatever. Just go with the flow with whatever the certifying body says. So uh you should be expected as an auditor, you should be expected to follow some sort of internally developed template So in cases like that, you must follow the template developed by the certifying body because that is part of their process on certification and using templates is a part of that If there's no work document template, the responsibility of developing one falls on the audit team leader. So ideally, again, from the efficiency standpoint, certifying bodies should have a whole bunch of templates and all you have to do is is use them. However, if if there is no template, again the team leader creates one. And the whole concept behind the template is that it's a standard document across the entire audit team So let's talk about this example. So here we have a clause, top left clause control. It looks like physical security perimeters. We talk about what needs to be, you know, the notes in the clause, security perimeters shall be defined and used to protect areas that contain information and other associated assets. Then we have the audit procedure. How are we going to review and look at the physical security perimeters? One of the options in the middle, observe the external environment, reception, alarm system, and so on. Who is the owner of the control? And then what's the audit notes? So in this case, equipment theft is the principal risk identified. uh at the entrance, the reception desk, and the inspection report confirms that the building meets the building code and and so on. There's also other evidence that could be added in there. There's documentary references like interior and exterior plan, risk analysis report, and so on. from different areas. We could have interviews, uh, that who are we going to talk to, what date and time we talk to them. Now for me, uh From my standpoint as an auditor, when I interview people, I don't use titles, I use their actual name, and I don't use just the date. I use the the date and the time as well as the time zone. You don't want to have a be in a position where security manager, you investigated or talked to this person on November 7th of 2022. Well, what time? When did you do that? Where did you do that? Was it online? Was it in person? And so on. Then we have conformity. C is means it's uh conforms with the requirement, and NC means it's non-conformity. It doesn't require Or it doesn't conform with the requirement. You could also have a date and signature if you chose to In some cases, I've seen people use initials. In some cases, I've seen them not do anything at all in relation to dating signature, but it can happen. Here's another example. Again, physical entry, Annex A 7. 2, secure area, same, basically the same thing. How are they going to audit that? They talk about verify lists of employees and their access rights. Again, owner of the control and so on. And then there's the notes from the auditor. So not really anything special in relation to templates. And again, we have documentary references, persons interviewed. And again, from my standpoint, I always use a real name uh a date and a time and a time zone that I did the uh interview. As well as in this in this example we have a non-conformity And it looks like it's nonconformity number one. So if there was another nonconformity, it would be nonconformity number two. And then there's also Dayton signatures of the meetings. So again, looking at example one. And going back to example two, uh there's no real firm template that has to be used. Uh there's no real requirement for any particular template. So if the certifying body has a template, use that, yeah You must uh use that. If the certifying body doesn't have a template, then uh the team leader creates one and it it works out. But It can really really be anything so long as it's consistent across the whole audit and everybody on the team understands that. So audit records archive. Audit records usually contain number one audit agreement So that's why there's going to be an audit in the first place. Uh audit plan, org chart for the uh audit T. Work papers and checklists used during the audit, interview and observation notes Correspondence, interview questionnaires, number eight, audit test plans, number nine, audit tests and their results, and then the evaluation of those results So that's in the archives. So audit documentation should clearly state the type of the document, how it was created or changed, and the person who not only reviewed it, but who created it. So who created it, who reviewed it? We want to protect the confidentiality of any information at all stages of the audit Especially when evidence is shared. Again, confidentiality is important unless it's a mandated reporting event. But if it's not legal, if you're not legally required to report something, then you have a confidentiality agreement. We want to make uh or prevent any potential changes to or unapproved changes to the uh the audit documentation We also want to protect it not only from the uh outside unapproved people, but possibly other people in the auditee environment. Remember, work documents are not the property of the auditee. They are the property of the of the certifying body. So, audit records represent the entire documented information gathered during the audit. Drafts, copies, previous versions, or other similar documents are not generally kept as records With the exception of the actual product that is created by the auditors or audit team, other documents like policy standards, procedures, screenshots. Things like that that are provided by the auditee to the audit team or the auditor are generally destroyed after there is a resolution or a firm understanding of what's going to happen in relation to the audit. So if it's a certifying audit and any evidence that's provided to the audit team that's not generated by the audit team themselves. It's it's not uncommon for the auditee to ask for those documents back or uh some sort of attestation that they were destroyed. And from the certifying body standpoint If they have the information and they don't need it anymore, then uh it's totally uh it's not under unreasonable to think that they're going to destroy it as well, whether the oddity wants to or not. So quality review. Work documents are the first audit evidence that get reviewed. So peer quality review enables all the audit team members to ensure compliance with audit procedures It's important to understand that quality review is performed by an experienced auditor. I'd also suggest that quality review, even though there may be a more experienced auditor on the team but everybody on the team get a chance to perform quality review. So reviewing of the work documents is necessary for ensuring that the audit procedures were appropriate, reliable, and used properly. The auditors have sufficient evidence or information to support their conclusions. And the audit findings and conclusions are logical and objective So, as a part of the peer quality review, peer quality is certainly a key element in generating high-quality work documents. And remember that certifying bodies as a part of competence, one of their options to make sure that people are performing high-quality work is to review audit reports or work documents or other things. Each auditor's work documents must be reviewed by the audit team leader. Documents of the audit team leader must be reviewed by another auditor. So we can't audit ourselves For solo audits, the review is done by another auditor mandated by the certification body. I've never been on a solo audit. I've only been in audits with Audit teams and generally the smallest one was only three people. The audit team leader must verify if the audit team members have followed best audit practices and established procedures. The audit evidence gathered is relevant, reliable, and sufficient. The established audit findings are based on strong evidence And any problems that were encountered during the audit were resolved. So, as a part of the quality review, the following is a list of potential mistakes that auditors usually encounter during Quality review. So number one, the template that contains information about previous clients was used. Yes, seen that before. Where you open up a template where a new client and a previous client stuff is already in there Auditors to uh forget to enter the information related to the person interviewed. Again, when you interview people, uh name, uh date, time, time zone, write down what their job is. Make sure you take adequate records. Auditors forgot to close notes and provide information related to it, like name, name, date, and reviewer. The information that auditors gathered was inconsistent. And information on the audited clauses could not be found. Like did they audit a particular clause but did not document it Uh I've seen that uh before where they legitimately interviewed, they legitimately saw the evidence, they just didn't write it down. uh to prove uh that they actually did it. So something we learned in the military is if it's not written down, it never happened. So make sure you write things down. All right, number six here, the evidence gathered was neither relevant nor reliable. So in this case, auditors did not document sufficient evidence to support the audit findings. You have to always make sure you have sufficient evidence. And then it's accurate. The sampling approach was wrong and not documented properly, so auditors did not clearly document or justify that the chosen sampling methodology. In relation to sampling, if you're going to request sampling because you have a large data set of some sort If you're not going to specify to the auditee exactly how you want the sampling done and you're going to leave it up to them, you should also probably ask for another So for example, if I had a thousand users in a database and I said to the auditee, I want you to provide uh ten percent of those thousand people so I can review them. So that's a hundred, hundred people, hundred users. How they came up with those hundred users would be important. Are they picking those hundred users because they know they're going to pass? Or is it the first hundred? Or is it every 10 person that they created the 100 users out of? So you want to document how sampling actually occurs There were errors in the samples section, so did not follow the selection rules during the evidence collection. For example, the audite selected and provided the list of persons to interview or prepared the sampling themselves. That's exactly what I just kind of described. Inconsistencies and nomenclature. So again, it's super important that everybody stay on the same page in relation to wording and terminology. Document the quality review. So here we have some examples. Note number one, clause 752, creating and updating. Comments of the reviewer, looks like they marked some things out, answers of the prepare, whatever the change was has been implemented. So you can see that there's multiple areas uh where uh notes were entered, uh comments were made, and then there were um Responses from the prepare. So number two, uh the evidence collected is not related to the control objective of physical entry, and then there's a red line. The evidence the objective of the control is to verify that the perimeter enters through a physical access control point, not the existence of the perimeter. So the first black line, the evidence collected is not related to the Control objective, the preparer says, in my opinion, the presence of a two-meter security wire fence demonstrates the existence of a security perimeter. And the reviewer responds by saying The existence of the perimeter is not the objective of the control to verify physical access control point So then the preparer responds by saying, okay, I added a note on the need for additional evidence. So there's a little back and forth between the reviewer and the preparer in this case, and that's not uncommon at all. So be aware of that. But again, there's there's not really a template that needs to be followed to do this. Just understand that every time you create a document, if somebody reviews it. and disagrees or whatever, then uh there needs to be some sort of resolution before you submit it. Alright, and this is the summary for section 18. Auditors must create and keep work documents during the audit in order to support audit evidence, to serve as reference for future audits, and to serve as proof to the audit quality. Work documents must be written concisely and professionally and must include facts. Audit records represent the entire documented information generated During the audit, drafts copies, previous versions, or other similar documents, and are not generally kept as records. Peer quality review is a key element in generating high-quality work documents And the documents of the audit team members are reviewed by the audit team leader whose work documents are reviewed by another auditor. So again, just like previous sections, there's a quiz with this one, quiz 17. So open up the quizzes worksheet and uh Take that quiz, and with that I'll see you all. See you on the next one. Thank you.