Okay, so in this section we're going to have a look at the concept of managing an internal audit programme. So throughout the course now you've actually covered a lot of aspects of being an auditor and conducting audits, but we've delivered that very much from an external audit perspective. And as I was saying earlier in the course, all of the skills that you've learnt on this course can be used in internal audit as well. But we just want to spend a bit of time focusing on the internal audit program and how you could build one using a lot of what you've learned so far. So we'll have a talk about managing an audit programme based on the guidance in ISO 19011. We'll also have a look at the role of the internal audit function and how it might differ from external audit. And then we'll have a think about what do you actually need to have in order to set up this internal audit function. So what sort of resources do we need to think about? How do we deal with records? How do internal auditors follow up on things like non-conformities? And how do we validate over time that that internal audit program is getting better and delivering value? So the starting point to this is to highlight a diagram that comes in ISO 19011 entitled Managing an Audit Program. And this does a really good job of splitting two different things. So ISO 19011 remember is the guidance for performing management system audits And it's split into two, well, several parts, but two parts that are important for this discussion, clause five and clause six. So clause 5 focuses on not carrying out an actual audit, but it focuses on what we call the audit program. So an audit program means a set of ongoing activities to do continuous regular audits. So if we look at clause 5, it says following a plan to check up cycle logic will establish some programme objectives. So what's the purpose of your internal audit programme? Is it purely to audit compliance with ISO 27001 Or is it to assess security in more depth? Does it go beyond information security and into other topics? You would define that when setting up your objectives. What's the purpose? What's this program trying to achieve? Like everything else in ISO thinking, we would look at what are the risks and opportunities to the audit program. If we're going to establish an internal audit program, Are there any risks that could derail that program? Does it bring any opportunities with it? And when we establish and implement it, I'll get on to the implementing in just a moment. obviously over time will monitor how well that program is working. You know, are the audits happening as frequently as they should be? Are they to the quality that we expect? Are they uncovering the kind of Opportunities for improvement, for example, that we're looking for, and over time we'll adjust the program. Now, if I go back to 5. 5, implementing the program, and you see this line going into clause 6 This is because in an audit program we do many audits and clause six is basically related to doing an individual audit. So what we're saying is when we implement an audit program Let's say we do one of several audits in an audit programme. Each audit would follow a set of procedures. Each audit would have a proper initiation process, a set of prepared activities. a set of procedures that are followed which would result in an audit report being issued at the end and so we go through the cycle again. And the idea of a good quality audit program is each and every one of those audits as executed would be following a standardized approach based on the rules and objectives of the audit program. And of course each individual audit should be reviewed at the end, so reviewed for quality, for example. So maybe If we've got an internal audit function, the audit manager or somebody like that might be reviewing each audit to say was it completed well? What's the the feedback that we get from the auditee and that would feed into do we need to change the audit program as a whole. So this is an important point. Now I'll be talking about both of these things in this section Now one thing that's important to call out is really the difference between internal and external audit. So a lot of what you've covered so far has focused on external audit. So actually I'm going to start there and talk about that and then tell you what I think is different about internal audits. So we know with an external audit it is completely independent of the audit. If you bring in a certification body, they're a completely separate entity and therefore completely independent. In an internal audit, the auditors are independent or should be independent of the work they are assessing, but they're not necessarily independent of your organization, because they're internal auditors, they're part of your organization So that means we get a slightly different perspective. With an external audit, you get a completely different view. With internal audit though, the benefit is that those internal auditors, while uh Whilst being familiar with the organization, that's not necessarily a bad thing because they may be able to spot more opportunities for efficiency and so forth. An external audit and a certification audit considers what we call the effectiveness of the ISMS. So they're basically checking Are the requirements of the standard being met? Not necessarily how efficient you are as an organization. Whereas an internal auditor, because they may be more familiar with your organization than an external auditor, can also look at efficiency and say, well not only are you meeting the requirements or not, but could we do it better based on our understanding of the organization? An external auditor from a certification body does not have an advisory role. As we've spoken about previously, they can give Very very general recommendations, but an external auditor cannot recommend what you do. So I as an external auditor could not say, for example, you know, use this methodology for conducting your risk assessment and set it up like this. Because that could be a conflict of interest. I'm basically potentially then going to be auditing my own advice. Whereas an internal auditor can provide advice and guidance. Providing they're not actually doing the work, but they can certainly make more detailed recommendations. They are freer to do so External audits as well are all planned. They happen on a schedule that's pre-advertised. We all agree when the external audit is going to take place. And one of my colleagues put it like that. He said that the external auditor always gets to see the polished version. That's because most organisations, rightly so, prepare for their audit. Whereas with an internal audit, because you've got resource there all the time, we can do things like ongoing audit that don't necessarily need to be put in the diary to happen in three, six months time. And therefore, an internal auditor might get a better picture of the real world over a longer period of time. Now the reason to present this is not to pitch one against the other. I'm not trying to claim that internal audit is better than external or vice versa. They complement each other External audit has limitations for reasons, partially because of those accreditation rules, the strict rules that certification bodies need to operate in. They still bring plenty of benefit, but they need to go hand in hand with internal audit. So let's think about internal audit and setting up an internal audit sort of function or service. What we recommend is that an organization should put together an audit charter. An internal audit charter, the the idea of a charter is essentially an agreement between top management and the rest of the organisation. So an internal audit charter may lay out some of the key principles about internal audit in order to make sure it can run independently, impartially, with a level of authority. So what are the kind of things I'd expect to see in a good internal audit charter? Firstly, the formal definition and purpose of internal audit So why are we setting up an internal audit function? What's its aims? What's its purpose? Equally what's its scope? So is this internal audit function there purely to look at conformity with ISO standards? or with other things, you know, so in some organizations, internal audit does many other things such as you know investigating potential um problems in the organization, you know, assessing compliance with many different laws, regulations and standards. So in this organization, let's make sure the clear the purpose and the scope is clear. We want to make sure that the roles and responsibilities of those auditors are absolutely clear. What's the service that they're providing? And I do use that word service as a genuine word here. I've heard some people s make remarks like, oh, the internal audit's the company police department or something like this. Well, you know, you people may perceive that as the case, but ultimately I would argue that internal audit is a service. They're out there to help. identify opportunities for improvement to help the organization progress in the right direction. And two very important points. Formal definition of the internal auditors access authorisation. What this means is, is what authority do internal auditors have to ask for information, to ask to see things, to meet people and so forth. Now we're not saying that they need to have formal authority to just demand anything anytime. I'm not saying it's an internal auditor can turn up at three o'clock in the morning and knock on somebody's door and demand immediate access to something. But there needs to be a certain level of authority to allow those internal auditors to perform their job. You can't just withhold information and bring example from them. And we also need to lay out in this charter how these auditors will be independent. So that might be about where they report or sit in the organization. So in some organisations we might have an audit committee that reports into the board directly and those auditors report into that committee But whatever we want to do, we want to make sure they're not sitting in a place where they could be pressurized. Let's say for example I'm doing an audit on a function involving my line manager, well that could be a huge threat to independence if there's a chance I'm gonna be lent upon, let's say, to not report everything and so forth. So we avoid that by making sure we lay out the independence requirements in the audit charter. So, what is the role of the internal audit function from our perspective when we're thinking about something like an ISMS? Well, I would say the role covers three different things. It is there to help the organization check the effectiveness and the efficiency of their operations. In other words, the controls that are implemented, the processes that are implemented, internal auditors can validate Are they working as expected? Are they meeting minimum requirements? And not just that, but are we operating in the most efficient way possible? Are we achieving the results in the best way possible? Internal auditors, of course, can also go out from a security point of view and validate whether the security controls we're implementing are effective. In other words, are they really protecting our assets? If we've said, for example, we're putting multi-factor authentication in place and other controls, auditors can actually test those things Validate whether they're working correctly and doing their job. And also, audits can focus on how well we might be complying with laws, regulations, any contractual obligations. So those requirements can form the basis of various audits that are conducted in that audit program So going back to my point I made a moment ago about services, these are services that auditors are bringing to the organization. Now, how big the audit program will be, how many auditors we need, what they'll focus on, will of course vary depending on the size of the organization, the structure, and so forth. So in a small organization, an internal audit of an ISMS might literally be one audit of the entire ISMS per year because that This makes sense. In a larger organization, we might have a series of audits over a period of time. So there's one organization I can think of right now who has an ISMS And they have usually about two audits per month, each looking at different control areas from the standard. And some are looked at more frequently than others in further depth because of their criticality So again, there's no right or wrong way of building an internal audit program, but we want to make sure we have enough assurance, especially when we think about some of the requirements that might need to be met. So let's think about internal audit and the things that internal audit might look at, especially when auditing an ISMS. And I would say there's eight key areas here to think about. So from a an audit point of view you would expect that objectives are reviewed. So what I'm trying to say here is Auditors can conduct audits at a very high strategic level right through to a low technical level. So really when we think about an ISMS, I'd expect my audit team to be looking at the ISMS's objectives. Are those objectives fit for purpose Do they align with business objectives? Are they suitably thought through and planned? Are they being changed when they need to be changed? The auditors can look at the governance structure. You know, have we got the right reporting lines, the right oversight of information security risk? Are top management getting actively involved where they need to? Are risk owners making risk-based decisions? Auditors could review the risk management process. Are risk assessments happening when they should be? Are findings being acted upon Are the risk assessments being done rigorous enough? Is the risk method we're using suitable and fit for purpose? And as well as looking at that aspect, of course the auditors can then, as I like to call it, look under the hood and look at processes and controls. Are those pr let's let's take for arguments' sake the incident management process. They could review those that process. They could look at how effective it is. Are incidents being reported, responded to on time. uh analyzed properly and so forth so they can get under the hood and look at how well or not certain processes are working. They could look at the whole ISMS end-to-end, you know, uh is the ISMS improving over time. Are management reviews taking place? They could look at measurement. Are we actually gathering the right measurements? Are we monitoring our KPIs properly? Are we learning from our monitoring and making changes? And of course the other thing I would add to this, testing controls. I don't necessarily mean testing as in hands-on penetration testing, but I mean testing as in checking controls from a technical point of view. Are those security controls fit for purpose? So each and every audit might not cover all of these points I'm alluding to here. They might, you know, one audit might look at governance. Another one might examine a particular set of processes, but over time you you know the internal audit are having a good check of all these areas. Now the eighth one on here, which I do want to mention a little bit about is coordination with external audit. So let me try and elaborate on this a little bit. So I remember one of the very first certification audits I did for a certification body. And at the time I went to interview a particular department manager. And during this interview he said to me, look, I'm not being difficult. But this is the third time this year I've had an auditor in front of me asking me exactly the same questions, uh, and yet XYZ XYZ department's never been visited in the last, you know. X number of months, etc. What's happening here? And it was a perfectly legitimate question. And basically what was happening there was there was a lack of coordination between internal audit and us at the time, the the body I worked for, the external um certification body. And so what one of the things that was agreed after that as a piece of feedback based on that remark and other stuff is we basically agreed at the start of every year that us, the certification body, would meet with internal audit and we would discuss the objectives for the year ahead and therefore try and coordinate a little better. Now remember external audit still needs to check that internal audit is working effectively, so that doesn't mean we won't look in the same areas in some cases But we wanted to avoid too much duplicate or triplicate auditing. So point eight is about having a good relationship. And what I say is as an external auditor, if you've got confidence that the organization's got a good well-founded internal audit programme, then you can build that relationship and work quite closely together. Because in the end, both sets of auditors really are or should be focusing on the best interest of the organization.