So there's audit principles. This is out of ISO 1911, clause four Auditing is characterized by reliance on a number of principles. Adherence to those principles is a prerequisite for providing audit conclusions that are relevant and sufficient and for enabling auditors working independently from one another to reach similar conclusions in similar circumstances. So we have an example of integrity, fair presentation, due professional care Confidentiality, independence, evidence-based approach, and a risk-based approach. And we'll talk about each one of those in the following slides. So integrity out of 1911 clause 4A. Integrity is the foundation of professionalism. Auditors and the individuals managing an audit program should Perform their work ethically with honesty and responsibility, only undertake audit activities if competent to do so Perform their work in an impartial manner, and in other words, remain fair and unbiased in all their dealings. Be sensitive to any influences that may be exerted on their judgment while carrying out an audit So in relation to cybersecurity or auditing of any kind, integrity is the core principle of professional behavior. So let's talk about this a little bit. So perform their work ethically with honesty and responsibility. So meaning that You're not going to lie in relation to or be un less than truthful in relation to the work that you perform. We're we're not going to uh uh create wordy words and reports and documents or emails or anything like that that could possibly be misleading. We also want to make sure that we only undertake audit activities if competent to do so. So if you'll remember in a previous slide we talked about technical experts. You want to use technical experts if you feel like you need to. Just because you're the only auditor, that doesn't mean that you're expected to know every single thing about the audit. You want to perform your work in an impartial manner remaining fair and unbiased in all everything you do. That doesn't mean that you have to be insulting in how you do the work, but you do have to remain impartial. You have to be truthful. Fair presentation. So this is out of 1911 clause 4B. The obligation to report truthfully and accurately So audit findings, audit conclusions, and audit reports should reflect truthfully and accurately the audit activities So how did you perform the audit? Who did you interface with? What date and time did you interface with them? What evidence was provided to you? Things like that. All of this should be documented in the audit report. Significant obstacles encountered during the audit and unresolved diverging opinions between the audit team and the auditee should be reported. Now a lot of times in relation to obstacles, if you have a guide, some obstacles can go away. If you understand the organization that you're auditing uh fairly well, you get along with them, you're polite, you're respectful, and so on, then a lot of times uh obstacles can go away very easily. It depends on how diplomatic you are I don't want to say how politically correct you are, but you do need to understand the environment, the culture, the political situation, possibly with the audit. The communication should be truthful, accurate, objective, timely, clear, and complete. So again, no ambiguity. Make sure that you're always objective during the audit. You're not going to compromise yourself, your professional judgment on the ground of any predetermined prejudice or conflicts of interest or anything like that. If there is an issue in relation to some sort of bias or whatever, then you definitely want to try to avoid that at all all opportunities Due professional care, so 19011 clause 4C, the application of diligence and judgment in auditing Auditors should exercise due care in accordance with the importance of the task they perform and the confidence placed in them by the audit client and other interested parties. An important factor in carrying out their work with due professional care is having the ability to make reasoned judgment in all situations. So one of the examples I'd like to give for this particular slide The application of diligence and judgment in auditing relates to the the the fact that as an auditor, when you're asked to come in to audit a client or an auditee There's a tremendous amount of trust placed into you as the auditor. So we don't want to violate that trust The confidence and trust that the auditee is placing into you is expected to be upheld at all times. So, to conduct an audit, auditors will have to consider the following beforehand: the context of the organization, critical processes of the organization, the expectations of the clients complexity of the client activities to be conducted, and the resources needed in order to do the actual audit Again, there's a tremendous amount of trust placed in auditors, so you don't want to violate that trust. Professional judgment, this again goes into the trust. by the auditees. Professional judgment means applying relevant training, knowledge, and experience to make informed decisions in various situations. During an audit. In exercising professional judgment, auditors maintain independence and objectivity and adopt an attitude of skepticism to reach the audit objectives Again, a lot of the professional judgment that you're going to be making as an auditor is going to rely not only just on the auditor training that you're going on right going through right now, but also possibly prior training. So for example, if you're an auditor and you before you became an auditor, maybe you were a network administrator, maybe you were a network engineer, or maybe you were a security architect. That knowledge can carry over into auditing, but you want to make sure that if you're if you're uh auditing particular areas that you're not necessarily trained on or you don't have the knowledge on, then don't make informed decisions based on things that you don't know. Rely on technical experts or possibly other members of your own audit team Professional skepticism, that's necessary to reduce the risk of overlooking possible issues or intentional issues that are intentionally being hidden from you. Which could obviously lead to incorrect audit conclusions. So auditors should not ever take the word of the auditee as fact. Instead, what you want to do is look for evidence to support their claims. of whatever they're trying to tell you. So an attitude of professional skepticism implies that auditors perform a critical evaluation on the validity of the evidence obtained and are on the lookout for evidence that could contradict or question the reliability and validity of the documented information received The answers to questions asked during an interview or any other information related to the audit itself. So again, just because the auditee says that they they have antivirus, for example, across their entire network, that doesn't mean that you should believe them. You should ask them, okay, prove it. Uh you say you do, but prove it. Irregularities and illegal acts in an audit If auditors encounter exceptional circumstances, so significant irregularities or illegal acts that affect their ability to continue with the audit, they should take into account the legal implications. And they should also consider withdrawing from the audit. However, I will uh expand on this a little bit. So in the United States, and and I assume most other countries have something similar to this. We have the concept of mandated reporting if it's an illegal act. So examples of mandated reporting if it's an illegal act. Could involve national security like terrorism, uh things like that, anything to do with child pornography, uh that's a illegal act that it requires a uh reporting to law enforcement So based on the country that you're in the and the company that you're auditing as an auditor, you need to understand what your legal implications are. If, for example, I ran across a company that had a mandated reporting event and I detected that, I uncovered it somehow or another, and I did not call law enforcement, then I personally to be held accountable for that. So I'm I don't want that risk, uh that burden. So uh just understand if you have something that's a mandated reporting event, then you you have to report it, whether the c audity likes it or not. Now in other cases though, let's say for example theft, you run across a person who has stolen a computer. The victim would be the auditee. That is not a mandated reporting event. That might be something where you report to the auditee, hey, we we caught this guy stealing a laptop. or or something, uh you can do whatever you want with it. We're just letting you know. The victim in this case would be the auditee and it's up to the auditee if they want to report it or do something about it. However, you could also run across irregularities that may put the auditor, you guys, the students. For this course, then you may consider withdrawing from the audit because you're just not comfortable anymore in dealing with it Obviously, if you're in a situation where you're auditing a company and you run across a mandated reporting event, depending on how that interaction goes, You may still consider withdrawing from the audit just just because it's not appropriate for you to be there anymore. So there are different types of situations. So again, notifiable illegal acts Countries around the world have established various laws that obligate this to happen. Child pornography, again, is a major one. It's certainly a mandated reporting event in the United States. highly suggest that you understand the country laws uh for whatever uh country you're going to be auditing in. You may also want to understand your own country laws if you're auditing a client that's not in your country, but you are in your country where you reside and you're auditing remotely Confidentiality. So clause 19011, clause 4D, rationale is security of information. Auditors should exercise discretion in the use and protection of information acquired in the course of their duties. Audit information should not be used inappropriately for personal gain by the auditor or the audit client or in a manner detrimental to the legitimate interests of the auditee. And the con this concept includes proper handling of sensitive or confidential information. In most cases, when you go uh and Perform an audit, you're most likely going to be required to sign a non-disclosure of some sort. In addition, the certifying body that you're working under, so you can do the audit They're probably going to have a non-disclosure as well. It would be extremely irregular if you did not sign non-disclosures and then started doing audits. So again, with with some exceptions, always attempt to protect the auditee or the audit client. With whatever information that you're exposed to because again, as an auditor, there's a tremendous amount of trust that's placed on your shoulders by them working with you The only area that you need to be aware of in relation to confidentiality has to do with criminal activity. So again, there's mandated reporting criminal activity, which a non-disclosure clause is not going to protect you from. Confidentiality requirements. So there's several different requirements from 17021-1, 8. 4. 1. The certification body shall be, and again, shall means it will be. It's not an option. The certification body shall be responsible through legally enforceable agreements for the management of all information obtained or created during the performance of certification activities at all levels of its structure, including committees and external bodies or individuals acting on its behalf. 8. 4. 3 Except as required in the part of 1702 information about a particular Certified client or individual shall not be disclosed to a third party without the written consent of the certified client or individual concerned. So again, if you're going to release anything, make sure that the people you're releasing information about agree. Personnel, including any committee members, contractors, personnel of external bodies or individuals Acting on the behalf of the certification body shall keep, again, shall is a requirement. Keep confidential and information obtained or created during the performance of the certification body's activities except as required by law. That's your clause right there that says if there is a mandated reporting event, then as required by law, it's okay to release that information. The certification body shall have processes and where applicable equipment and facilities that ensure the secure handling of confidential information. So certification body is going to hold on to the information and get and going to protect it. A lot of certification bodies, they have the material and then uh after a certain time period uh they they purge the material so they don't have to protect it anymore. It's just simply not there. Implications for auditors in relation to those requirements. So the certification body will most likely include confidentiality requirements in the contract which the auditor signs. Auditors must be aware of these requirements and their implications. Again, it would be extremely irregular if you audited anybody without some sort of non-disclosure in place. Auditors must obtain written consent from the audit client before disclosing any information to a third party. The certification body may also have to be kept informed. Auditors must handle with confidentiality all information created or obtained during the audit except when disclosure is required by law. We talked about that Auditors must handle all confidential information per the certification body's processes. Auditors must have knowledge of the certification body's solutions for handling confidential information. information. This doesn't mean you have to be a network engineer and understand in great detail how data is encrypted or backed up with the certificate certification body, just that it is being performed. And again, a lot of certification bodies, they will capture the data, they'll produce a certification of some sort once they've evaluated that there's no more need for the audit evidence or whatever information that could be viewed as sensitive. A lot of them are actually uh deleting them uh on a on a time-bound basis. Exceptions to the confidentiality principle. Confidential information can be disclosed only if it is authorized by law by the audit client or by the auditee. So if it's authorized by any of those law clients or auditee, then it can be disclosed. Or required by law. So required by law is uh something you again you have to be aware of. An obligation or right to disclose when not prohibited by law. And I can't really think of too many examples why you would want to uh disclose something when not prohibited by law because you felt obligated uh to do so as an auditor. Uh you may not be asked to do too many more audits if that's if that's the case In a general sense, what I suggest people do, just don't release anything about any of your auditees, your audit clients, unless they say it's okay or the law requires you to do so.