Section 9 presents the type of audit risks discusses how to determine and evaluate the audit program risks and opportunity as per ISO 1911 and also introduces the concept of materiality and how to determine the materiality of a system. So looking at the audit approach based on risks. So there are a couple of um different audit risks That we can determine. First of all, we have the inherent risks. So the inherent risks really refer to the risks that despite that an internal control mechanism is active in the organization, a significant defect occurs in the management system. These defects are related to the industrial sector in which the oddity operates. Secondly, we have the control risk. A control risk refers to risks that have a that a significant defect will not be detected or prevented by the organization's internal control mechanism. These risks are obviously higher, according to auditors, in organizations that have ill-defined processes, and where those processes are mainly manual. In contrast, automated processes will have a lower risk of failure. If they are well configured. And lastly, you have a detection risk. Detection risk refers to a risk that a significant defect could not be detected. even by the auditor. In order to minimize such risks, auditors apply the audit principles based on risks. And we will go about talk about that in the later slides, or on materiality. Now, if we look at ISO 1911, that ISO standard gives us an explanation on risk. So risk is really an effect of uncertainty. So an effect is a deviation of what is expected, and that can be both positive or negative. And uncertainty is basically a state, even partially. Of deficiency of information related to understanding or knowledge of an event, its consequences, and its likelihood. So risks are often characterized by a reference to a potential event or consequences or even a combination by those. So understanding what risk is is obvious very important if you want to use an audit approach based on risk. Now If you look at an audit approach based on risk, we of course need to have a look at a couple of things. And there can be risks associated with a couple of things. There are risks and opportunity related to the context of the audity, so the organization that you're auditing, that can be associated with an audit program, and that can affect The achievement of the objectives of the audit. So there are a couple of things that need to be taken into consideration So there can be risks associated with the planning. For example, a failure to set relevant audit objectives and to determine the extent, the duration, location, or even a schedule of the audit. There can be risks associated with the resources. For example, you don't get enough time, the resources are not available, you didn't receive training to set up the audit program, or you don't know how to conduct an audit. There can be a risk associated with the audit team, selecting the right people, because you, for example, don't have people with the right competences to conduct an audit. There can be risks associated with communication. That there are ineffective communication controls. You don't have effective communication channels. Think about You're sending like 20 emails and there isn't a response coming back and perhaps the email address was wrong. So there might be issues with that. There might be risks associated with implementation So um an ineffective coordination of audits within the audit program or not considering information security and confidentiality There might be risks associated with the control of documented information. So might be the case that people don't know what information that is necessary. You can't process audit records to demonstrate the audit program effectiveness. So there might be risks associated with that. There might be is risks with monitoring, review and improving the audit program, so that there might be an issue with reviewing of ineffective monitoring of the audit program outcomes And of course, there might be risks with the availability and the cooperation of the auditee or the availability of evidence that has been sampled. So if you want to have an a sample done and you can't access the information or the information cannot be shown that obviously will pose a risk. So when looking at opportunities for improving that audit program, you can of course think about a couple of things. Firstly you can think about Having multiple audits in a single visit. You can minimize time and distance to traveling to another site. You might think about matching the competences of the audit team so that you have people that have a higher competence accompanied with somebody with who is less experienced and has less competence and you might also think in aligning audit dates with the availability of the audit key step which is uh usually the right way uh to go. So an auditor should um act as part of an assignment uh of an individual audit The risks and opportunities of the organization can be included. The core objectives for such an audit are I give assurance on the credibility of the risks and opportunities that uh were tracked in the identification process. So really understanding okay where are the risks coming from and what are the inputs that the organization uses um so that might be checking if there are external and internal uh issues the strategic uh direction of the organization did they get um input from interested parties, um are there potential sources like environmental aspects that have been taken into consideration. So really looking at the process if it's a valid process Secondly, an auditor should also check if the assurance that the risks that have been determined that they are managed in a correct way and also review how the organization addresses um its determined risks and uh opportunity. An audit of an organization's approach To the determination of risks and opportunities should not be performed as a standalone activity. So any review of your risk assessment process and the treatment should be implicit throughout the whole audit of a management system. Um especially when interviewing top management. What happens a lot of course is that um the risk assessment Is conducted by an ISMS manager and representatives of the organization, and that top management is isn't really involved. However, it's good practice to refer back to the risk management process because all of the controls should uh or most of the controls should be implemented based on risk. So looking at the risk assessment and understanding where the risks are coming from is a good practice to have that throughout the whole So the treatment, the including and the acceptance of a risk and what the organization determines, is of course based on judgment of the audit. If we look at mat reality, so um if you look at the uh definition of mat reality uh um in order to limit audit risks and obtain reasonable assurance The auditor must place emphasis on the processes deemed material to the oddity. So another word for material is of course critical. So you look at the critical processes of the oddity Information is of course considered material or critical if its omission or erroneous handling of statement can influence the decisions of the interested party. So the term materiality comes from accounting. It's not something that comes out of the world of information security, but it comes out of the financial world. Financial auditors usually measure materiality in monetary terms since what they audit is also measured in money. So it's normal that they measure that in monetary terms. term. So materiality really depends on the nature of the information and the seriousness of the error with within that particular circumstances of its emission or which something would go wrong. So, based on the oddity, the auditor, it's up to the auditor to really estimate the materiality threshold from which the interested parties could change their decisions concerning the oddity. So for example, if you would have an inventory loss of fifty thousand dollar undeclared or not detected by the auditor It would be non-material if the organization would make 10 billion US dollars revenue per year, but it would be material if that same organization would only make one million in revenue. So it's really based on What does the organization do? What is the impact? What are the interested parties to determine that materiality threshold? So that's really up to the auditor to determine that. Now, when determining the materiality of a system, there are of course a couple of factors that need to be considered First of all, you look at the cost of the process. What is the cost involved in material, software, potential licenses, or a combination of those? You look at the cost of the operation, like personnel, third-party general fees, combination of these again. What would be the potential cost of errors or non-conformities What are the resources that you need to conduct the process, of course? What are the conditions of service level agreements and costs of potential penalties? And what are the penalties in case of failure to conform legal, regulatory, and contractual obligations? So it's really um the combination of these six factors that make up that materiality threshold. So it's it's not something that an auditor does like on a P Sheet of paper to really come up with a calculated uh estimate, but it's something that based on um the experience of the auditor, based on uh understanding the context of the organization That auditors determine that materiality of a system. So materiality is of course very important when a process is really vital in achieving that organization mission. So In in determining or evaluating that materiality, the auditor should really consider what is the general level of error that is acceptable by management, but also what is acceptable by the certification body. So it's it's it's a combination of three things and what is acceptable by management, what is acceptable by the auditor and by the certification body. It might be the case I haven't seen it a lot though, but it might be the case that an organization decides that they are okay with a certain level of error, while um with common sense you would say, well, you're saying that because you want to get um through the audit in an easy way. So then you need to have a discussion about that. Or the possibility that small errors or small weaknesses would accumulate to um a materiality So evaluation of that materiality is really a question of professional judgment. So it's really based on the experience, the the context of the organization. So the auditor must really look at the general effect on the organization Now, when do you come up with that materiality of an audit? Well it's actually done throughout each step of the organization. So first of all, you have a couple of contact points with your odity. So you have usually your initial contact with the organization where you determine basically the duration of the audit based on inherent risks to the organization So that is where you check, okay, what is the sector that the organization is part of, what is laws and regulations, what are the number of workstations, what is the complexity of the sector system, how many employees do they have? So based on the inherent risks on the context of the organization, you make a first assessment of that In your stage one audit you will have a look at what are the key processes. So you will have a look at um your management system as such. So based on that You will have a look on okay, what are the processes that are now more material than others? So which are the ones that you really want to dive into in a stage two? So making that assumption on based on the initial contact, then checking that in the stage one will give input to your stage two audit where you will adjust the plan based on the materiality of Each process and asset. So basically, these three phases help you by determining the materiality and coming up with a detailed audit plan that will have a focus more on processes that have a higher materiality. So auditors um try to get basically a reasonable assurance that um yeah the audited management system is um free of uh erroneous material um representation and non-conformity. So the problem or the challenge with ISO twenty seven thousand one audits is that auditors are not able to obtain that absolute assurance that the audit conclusions reflect the reality because we always take samples so it's not a 100% uh check So in a ISO 27001 auditors, um auditors should be able to obtain that reasonable assurance That the ISMS as a whole conforms to the requirements as a standard, and it it's not the goal to achieve that assurance that each process is effective and in compliance with the standard requirements. course. So um there are limits of course uh to what an auditor can detect uh based on false material representation You cannot see you only have a limited set of time, so it might be that material might be false, that is not correctly. You cannot always see that there are issues in the internal processes. And you can also affect that several audit evidence is persuasive rather than conclusive. So there are limits of what you can see in an inter or in an uh in an audit based on ISO 27000 So in conclusion, the main types of audit risks are inherent control risks and detection risks An audit approach based on risks, consider the risks and opportunity of the audit that are related to the context of the audity. So you always look at the context of the organization. The main factors to consider when determining the materiality of a system include cost of operation, cost of the process, potential cost of errors or nonconformities, the resources needed for the process Conditions of service level agreements and penalties related to legal non-compliance. Materiality is evaluated at each step of the audit, meaning the initial contact, phase one and phase two audit And auditors cannot obtain absolute assurance that the audit conclusions reflect the reality.