When you're appointed as a lead auditor, you first of all need to determine the audit feasibility. The audit feasibility is very important because it gives you the reasonable assurance or the reasonable confidence that the audit objectives can be achieved. So how do you now come to that determination of feasibility? So you need a couple of things that you need to consider. So first of all, you need to check, okay, what is the information that we need to plan the audit? Do you receive the necessary information to really plan and conduct the information? Do you have everything available? Secondly, you also need to check okay what is a corporation from the audites part. You need to have as an audit team full access to the information related to the ISMS. So for example, if an Audit refuses to give you access to, for example, firewall configurations, claiming that the information is too sensitive, it would be impossible to check the control. So it is recommended, of course, you usually have a confidentiality agreement. It might also be the case that sometimes you can do background checks. I haven't I I ha only have a couple of uh customers where I need to do a full uh security clearance, but that's based on legislation. In all other um areas and some countries it's not even allowed To do a full um criminal records um background checks. Usually the confidentiality agreement is enough. But you can also state that sensitive information can only be accessed on site and when somebody from the audity uh team is uh represented. Um you also want to check um to the proposed length um of the audit. Uh if um sometimes you get into a situation where you think okay I don't have enough time uh to perform the audits. So you need to check that as well. So for example at the ISO 2706 on which certification bodies need to be certified requires a maximum of five-day audit, of which three needs to be held on site. In a research and development company, in the pharmaceutical sector sector, it would not make sense um and it should not be uh accepted. So depending on um how big the organization is, the complexity of the processes, you need to check do I have um enough time do I have um enough time to check if everything is implemented accordingly. Of course you also need to have a look at the competence of the audit The audit team leader needs to be sure that everybody is part of the audit team has the right competences, has the right interpersonal skills to feel comfortable to conduct the audit. And then lastly, you also need to have a look at the cultural aspects. Do you have an issue with the language, with the social background? That might also be an issue, of course. Again, I want to reiterate here, resources also include adequate access. As an auditor, you need to have full access to whatever you want to check. Now how long should an audit last? It's not something that certification bodies um can come up uh with um out of the blue in the ISO 27006. There are tables that help you with deciding how long an audit should last. So that also means that if you compare audit firms as certification bodies with each other Um it's um you won't see a difference in audit days. Uh usually the audit days are the same, price will be different. um reputation will be different um but um basically there is a table that is used and a certification body is allowed um to use um a couple of um indicators like complexity of systems, um outsourcing of uh systems Um is it a combination audit that will give them extra parameters to either uh reduce or increase the number of days? But In the in the basis, the table that is shown on the slide gives you an indication on the number of days. So number of employees, if we look at the ISO 27001 column, which is the third one If you're an organization between one or ten FTEs, you will receive a five-day audit, of which three days will usually be on site. From 11 to 15, it goes up to six. If you're 176 to 275, it will be 14 days. And it goes up all the way to 10,700 where an auditor comes and lives with you for a month. So what usually happens when you have like uh days like 28 or 10 um you usually um get uh because that it's that is per person. So usually uh the people um get divided so that you don't have four weeks the same person in the company, but you get like two or three or four audit uh auditors that visit your company So um the basic thing here is that certification bodies um need to give uh enough time to auditors to complete the audit. So the time available will depend on a couple of things. So you have the basic table, but then certification bodies also look at what is the scope of the management system, what is the complexity. What is the field? For example, in a ho in a healthcare sector, it might be a different complexity. Are there multiple sites that need to be audited? Um what is uh the complexity of the technology? Are you using one technology stack or are you using multiple uh technology stacks? What are um outsourcing uh services? Um what are any regulations? Um Um or loss that needs to happen. So as I stated, at the minimum time for an audit is five days per person. So that means that usually you have like half a day that you use for uh planning and auditing. You have one day that you do the phase one or the stage one which is the documentation audit. You will have three days to do an on-site audit and then half a day to do the drafting of uh the final process. So um that means that an auditor performing an audit um on their own um must in five days conduct everything so do the opening and the closing meeting, they do need to do the interviews, they need check the documentation. So that becomes uh that's a pretty challenging task. Um so um the auditor must use time wisely and that's why they only uh focus on key processes. So you won't be able to see everything. So that's the reason why you need to focus on the key processes and the critical systems that you want to audit. Now looking at the audit objectives, they need to be stated by the certification body So usually a certification body uh creates um um audit objectives for ISO 27001 audits that might be different from a stage one and a stage two, but the audit objectives are there to verify. If the ISMS conforms to the requirements of the standard. Also to check if the ISMS is effective in meeting their intended results. And it's to check if the organization can reach their information security objectives. based on their own criteria. So having those audit objectives in place is your first step of course to start your audit. Now looking at the audit objectives, ISO 17021-1, class nine dot one dot one dot too gives a little bit more information about that. So the audit objectives really need to describe what is accomplished by an audit and needs to include a couple of things. So there are four things that need to be included. So first of all, needs to include that there is a determination of the conformity of the client's management system or parts of it with the audit criteria There needs to be a determination of the ability of the management system to ensure that the client meets all statutory, regulatory, and contractual requirements There needs to be a determination of the effectiveness of the management system to ensure that the client can reasonably expect to achieve the specified objectives. And of course, there needs to be, as applicable, an identification of areas for improvement to the management system. So that's usually what is stated in the audit objectives. If you look at an audit report That's usually stated on the first page. Besides that, the audit scope will need to be determined. Also, ISO 17021 Uh gives there some uh insight. The audit scope will describe what are the boundaries of the audit and what is the extent, what is the the boundary like what are the number of sites, what are the organizational units What are activities and processes to be audit? So the audit scope is something different than the scope of the management system. So the ISMS scope is probably more broader Then the audit scope. It of course the audit scope needs to be consistent with the audit program and also with the audit objectives But it doesn't necessarily include all of the organizations processes and products which may be covered by the ISMS. So if we look at an example, it might be that in a bank, for example, that for auditing the overall activities of a bank that has like a head office, four processing centers um a couple of regional offices and uh a multitude of branches um that for the audit scope we would all only um visit the head office One data processing center and only five regional office and twenty-five branches, for example So that would mean that you will not would not need to visit all the sites and all the branches because that would be become very expensive And that would also mean that it would take a lot of time to do that. So the audit scope is not necessarily the same as the ISMS scope It's usually a little bit um uh smaller than the ISMS scope, but it needs to be in line with the audit program and the audit objectives We'll have a look at the audit scope. So it might also be so you he will he or she will look with the audit tee at the audit scope and to see if there need to be any changes made when they're on site. So it might be that you determine an audit scope and you come on site, you d conduct a couple of interviews and you come to the conclusion that basically the audit scope is not completely correct And then the other team leader needs to have a discussion with the client. So what might that, for example, be? For example, the ISMS scope wasn't really clear at the beginning of the process and while doing the interviews it becomes more clear. There are recent changes in technology that have not been communicated. There have been an acquisition that has not been communicated. Or there might be something happening, for example, like a fire that yeah. And forces you to change the audit scope. Whenever that happens, those changes need to be documented in a clear way. And of course, the certification body also needs to be informed So there are a couple of things that then can happen if you uh if uh the auditor and the auditee don't agree on the change of the audit scope, there are two possibilities. Either continue with the audit as in the initial scope or state that you stop the audit and that you withdraw with the audit because it's impossible to complete the audit. So there are two things that you can do uh in that instance.