Independence, this is out of 1911, clause 4E, the basis of impartiality of the audit and objectivity of the audit conclusion. So we have independent auditors that are going to audit the ISMS. We have management that deals with the information security management. Then we have the auditee and then we have the users. There's an independence in relation to all of those. So the independent auditors are not going to report directly to management. Their independent auditors are not one of the users. They're not the auditee either. Threats to independence. This is actually something that can happen and has been discussed repeatedly in a lot of different auditor courses. But out of 17021-1 clauses 4. 2. 4 and 5. 2. 11, the certification body shall take action to respond to any threats to its impartiality arising from the actions of other persons, bodies, or organizations. Threats to impartiality may include, but are not limited to self-interest, self-review familiarity or trust and intimidation. So it's important to understand the certification body shall take action, meaning again, it's not an option. They must take action. If they don't, then there could be an issue with the certification body itself, which could be very detrimental to their business So we want to make sure that we are always accurately being aware of what's going on. We're protecting all the information. So threats to uh independence, uh self-interest is one of them. So threats that arise uh from a person or body uh acting on their own interest. Uh so a concern relating to certification uh could be that way like financial self-interest. So say for example I was auditing a company and I, strangely enough, for some reason or another, had a whole bunch of shares of stock in this company Uh and I knew that if they passed an ISO 27001 certification audit that their business would uh improve and their likely their sales would go up or things like that And that would naturally make my uh my shares of stock uh be more v more valuable. Uh that would be a an example of self-interest. We also have self-review. You can't audit yourself. That's essentially what that means. You can't audit yourself Intimidation is obvious. If somebody says, you know, you are going to give us a good report so we can get certified or bad things will happen. But then there can also be familiarity or trust. So that's not necessarily self-review. That's where you have so much of familiarity with the oddity that It's almost you're almost part of the team that's being audited, which kind of rolls back into self-review. So items of or threats to independence. So we can uh some examples. Items Or GIFs. That's certainly something that I've I've never personally run across any of these before. But I have heard of situations where an auditor uh may have received a gold Rolex or may have received something else. a free laptop. I have heard of a in one case I heard of an auditor. He was going through an audit and the auditee said, here's the laptop we want you to use and when we're done you can keep it. So that's that would be a gift, we can't do that. Trips, there could be cases of of in of threat to independence for a trip where for example let's say a company says hey we're gonna get audited we want you to be our auditor okay great oh and we're gonna do the uh the we're gonna do the audit in Maui uh or in Hawaii uh or in Bora Bora or in Fiji uh and it's gonna take three weeks but we're only actually gonna be interviewed for uh four days That would be can viewed as a as a gift. It would be basically a bribe. Meals, again, very expensive meals or elaborate meals. That could be a threat to independence And another one is contracts. I have heard of cases where uh uh companies, an auditee has told uh uh an auditor If you pass us and if we get certified, then we will give your organization a follow-on contract. So again, that that is a threat to independence. We we don't want to We don't want to put ourselves in that position. We don't want to put the certifying body in that position. And we don't want to put our company into that position Consultancy services and audits. Auditors should not provide management systems, consultancy services for the auditee Meaning they cannot contribute to the design, implementation, or the maintenance of a management system for the Auditee. In case the auditee received consultancy from a body that has a relationship with the certification body A minimum period of two years must pass before the certification body can certify the auditee. So essentially this goes back into self-review and familiarity. You cannot Help the auditee get ready for the audit, uh maybe perform functions for the auditee, maybe perform services for the auditee. And then turn around and act as an auditor to evaluate your own work. That would be inappropriate. Now, that second bullet, in case the audite receives consultancy from a body that has a relationship with the certification body. It's in most cases I've seen companies they will have different wings or different divisions. They'll have the implementation division, then they'll have the auditing division, but it's the same company In my opinion, that is inappropriate. And in a lot of cases, they'll have a separate legal entities, but it's it would be common knowledge that they're the same company. Again, in my opinion, that's that would be inappropriate. Realistically, if you needed uh as an auditor, if you're auditing an auditee uh and the auditee needs help, then it should be a completely independent uh entity from the audit firm That doesn't mean that the auditee and the the consulting party as well as the audit auditing firm, that doesn't mean they may not know each other or they may not uh you know, interact with each other through different clients or or so on. But we definitely want to avoid the case of of a uh consulting company acting as an auditor and then uh grading their own work so to speak All right, consultancy services and audit requirements for the certification body. So this is out of 17,021-1, clauses 5. 2. 1 and 27006-1 clause 5. 2. 2. Conformity assessment activities shall be undertaken impartially. The certification body shall be responsible for the impartiality of its conformity assessment activities and shall not allow commercial, financial, or other pressures to compromise impartiality. So again remember commercial financial or other pressures, so other pressures could be viewed as intimidation. Commercial could be gifts in some form of fashion. Financial could be literally somebody trying to bribe you or the certifying body. And again, understand that conformity assessment activities shall be undertaken This is something that the certification body is going to do. Certification bodies may add value during certification and surveillance audits by identifying opportunities for improvements. Those are commonly called OFIs as they become evident during the audit without recommending the specific solutions. So they there could be a situation the auditor sees that there is a potential for improvement by the auditee. And they say, hey, you really need to do this, it's not a requirement, you really need to do that, but not explain exactly how to do it. That's where the audit T is uh suggested to go talk to a third party to maybe help them uh with that OFI. without it being considered as consultancy or having a potential conflict of interest. Again, avoid conflict of interest. And again, if you're the auditor and you're telling the auditee specifically how to do something or what to do step by step, then that could be viewed as consultancy. So you want to avoid it. The certification body shall not provide internal information security reviews of the client's ISMS subject to certification Furthermore, the certification body shall be independent from the body or bodies which provide internal ISMS audit So the certification body is an independent body. Then you have the the auditor, which is generally going to be a contracted individual or possibly a contracted company And then you're gonna have a separate the auditee in whatever environment they're in. Consultancy services and auditors. So 17,021-1 requirements In order to ensure there's no conflict of interest, personnel who have provided management system consultancy, including those acting in a managerial capacity. shall not be used by the certification body to take part in an audit or other certification activities if they have been involved in the management system consultancy towards the client or the auditee. A recognized mitigation to this threat is that personnel shall not be used for a minimum of two years following the end of the consultancy. So what this means if if I'm helping a company, uh XYZ company, uh get ready for an audit and then uh maybe their their audit company that's gonna come in and do the certification uh on this XYZ company, they say, hey Carl, we really want you to show up and and be an auditor uh for us because we we like your work and everything else Then essentially I can go to work for them as an actual auditor doing certification audits and things like that. But XYZ company I can't even go to for at least two years Now in my experience, uh it's actually a lot longer than two years. Uh I've seen companies that say three to five years just to make sure that any interaction you may have had, including maybe people actually just not working there anymore, uh That there's no uh connection anymore. So the implication of this clause, uh the provision of consultancy services may constitute a conflict of interest. Certification bodies establish safeguards such as a two-year waiting period or possibly longer, or even prohibit their auditors from providing consultancy services to their audit clients. Auditors must be aware of the safeguards and policies established by the certification body. So 5. 2. 12, all certification body personnel, whether internal or external, or committees Who could influence the certification activities shall act impartially and shall not allow commercial, financial, or other pressures to compromise impartiality. Basically, that means doing the right thing. Don't let yourself get bribed or influenced in any way that could be uh could look like a conflict of interest. uh that could affect the certification process or even the certification body or the auditee themselves. You have to maintain your independence through the audit. You have to be aware of possible threats to independence. And I gave some examples like gifts, hotel stays, trips, financial promises, or anything like that. Any undue pressure from the audit client should be reported to and consulted with the certification body. In a lot of cases, you're not going to run across any of these. I've personally never run across any of them myself, but I've heard about it. One that would definitely affect me would be anything that would concern me greatly would be anything involving the concept of a bribe or intimidation. You need to understand as auditors, your name means everything. The very second that your name is tarnished, and that means your integrity is untarnished And it very rapidly will go around the audit world that your integrity is not to be trusted. 5. 2. 13 Certification Body Shall require personnel, internal and external, to reveal any situation known to them that can present them or the certification body with a conflict of interest. In other words, if you're going to go in and audit a company and you are you have more information or you have a past with this company or something something like that, you have to disclose it before you actually do anything. Uh you want to disclose it right away to the certification body. We simply don't want to have any sort of conflict of interest. We have an evidence-based approach as well. 19011 clause 4F. The rationale behind this is the rational method for reaching reliable and reproducible audit conclusions in a systematic audit process. So we have information that's objectively obtained. It's also evaluated objectively, and then we have the evidence. So ideally, uh if we ask a company, uh, you know, we're interviewing somebody We're going to ask them, say, say for example, do you have encryption at rest? If they say yes, okay, well what level of encryption at rest? Encryption at rest is AES 256. Okay, well then how do we know that? So one of the things we can do is compare what they're telling us with the actual evidence. And the actual evidence could be a policy. an encryption policy for example. Or maybe they have encryption at rest in relation to their databases. We could say let show us the database settings that show us what level of encryption to support the words that you're telling us. Again, unless there's absolutely no way of doing it, never trust the just the words that uh an interviewee or auditee uh tell you because they in in some cases in most cases they're wrong uh or in some cases they'll just tell you what they're expecting you to hear