All right, prepare and distribute the audit report. The audit team leader must be responsible for the preparation and the content of the report The audit report must be clear or must provide a clear, accurate, concise, and complete representation of the audit. The audit report must be recorded in writing The certification body maintains ownership of the audit report. So again, the audit report is not the uh property of the auditee. Neither is the work products, neither are the work products. The only thing that remains a property of the auditee is the actual evidence that is provided by the auditee. So we do need to make sure that we are clear, concise, and we've had every bit of evidence and explanation that is needed in the audit report is included in the audit report. Contents of the audit report 17021-1 clause 9. 4. 8. 2. The audit team leader shall ensure that the audit report is prepared and shall be responsible for its content. The audit report shall provide an accurate, concise, and clear record of the audit to enable an informed certification decision to be made and shall include or refer to the following Identification of the certification body, the name and address of the client and the client's representative. The type of audit. So is is an initial surveillance or recertification or is it a special audit of some sort? The audit criteria, the audit objectives, the audit scope, particularly identification of the organizational or functional units. Or processes audited and the time of the audit. Any deviation from the audit plan and their reasons Any significant issues impacting on the audit program, identification of the audit team leader, team members, and any accompanying persons. Contents of the audit report. I do want to add one other thing. Generally, the certifying body is still going to have some sort of template that Jill follows. So it's not like you're going to have to create this on your own. If you're working with certificate certification body, then just ask them, do you have a template for the audit report? And it's provided they do, then generally you just have to fill in the blanks Fill in the paragraphs. So continuing on with the uh audit report, uh the dates and places where audit activities occurred, whether it's on-site, off site. uh virtual or over the phone, just like literally verbal over the phone, where it's conducted. Audit findings, relevance to evidence to evidence and conclusions. Consistent with the requirements of the type of audit. Significant changes, if any, that affect the management system of the client since the last audit took place. Any unresolved issues if identified, where applicable, whether the audit is combined, joint, or integrated. And again, remember that a combined audit is when you have more than one framework being audited at the same time. So in a previous section, we used ISO 27001 and 9001 at the same time. So auditing two different frameworks and so on. There's also joint audits working with another audit team. A disclaimer statement indicating that auditing is based on a sampling process of the available information. Recommendation of the audit team. And again, remember recommendation for certification are what the auditees are going to be looking for. The next one that's kind of less of a hassle is recommendation for certification provided There is a correct action plan provided that is and does not require on-site visit again. The audited client is effectively controlling the use of the certification documents and marks if applicable Verification of effectiveness of taking corrective actions regarding previously identified nonconformities, again, if applicable. Alright, then we have contents of the audit report. The audit report shall provide the following information or reference to it: an account of the audit of the client's information security risk analysis. Any information security control sets used by the organization for comparison purposes as required by could be legal, regulatory, contractual The audit report shall be sufficiently detailed to facilitate and support the certification decision. It shall contain the significant audit trails followed and audit methodologies utilized And a reference to the version of the statement of applicability and where applicable, any useful comparison with the results of previous certification audits of the client. All right, distributing the audit report. So this is 1901, clause six dot five. The audit report should be issued within an agreed period of time. If it's delayed, the reason should be communicated to the auditee and the individuals Managing the audit program. The audit report should be dated, reviewed, and accepted as appropriate in accordance with the audit program. The audit report should then be distributed to relevant interested parties defined in the audit program or audit plan. When distributing the audit report, appropriate measures to ensure confidentiality should be considered So what uh what we do, what we personally do, when we have a uh uh uh An audit report that we're going to distribute, we only distribute the audit reports to one person, and that's the contract holder that required the audit in the first place So whoever that person is, they're the person that the audit report is distributed to and it's only distributed through uh like DocuSign. uh some some electronic something that requires an electronic signature saying they've accepted it. We do this because if we distribute it to only one person and it goes anywhere else after that one person That's the responsibility of that one individual. Plus, we have a record that says, you know, January 1st, 2025, we gave John uh this audit report, here's his electronic signature indicating acceptance. The other thing about the audit report, if there's non-conformities in there, uh Each nonconformity, because it's electronic signature, each nonconformity can be attested as being received by that signature holder, by the contract holder. So that last one there where it says when distributing the audit report, appropriate measures to ensure confidentiality should be considered Again, we just send it to one person, the contract holder, and if they send it to other people, then it's on their shoulders for confidentiality. We don't have to worry about it. We don't even share in even internally, we don't share uh audit reports uh even with other internal people. So 5. 5 make the certification decision. The certification body must make the certification decision based on an evaluation of the results and conclusions of the audit. Any other relevant information, for example, public information or client comments on the audit report. So auditors that take part in the audit itself never take part in the certification decision. So you can't uh you can't make a recommendation for certification and then make the decision for certification at the same time So the information provided by the audit team to the certifying body for the certification decision shall include at a minimum the audit report, comments, nonconformities, where applicable, corrective, corrective action plans, and so on. uh all sorts of other things that are in there that um help the certifying body make a decision one way or the other. Generally, if the auditors recommend certification, the certifying body is most likely going to accept that recommendation. There may be a few cases where there's not enough evidence or the audit report was not written uh clear enough that the certifying body could not make a decision one way or the other. And they asked for clarification uh from the auditor Then there's completing the audit clause 6. 6 out of 1911. The audit is completed when all planned audit activities have been carried out or as otherwise agreed with the audit client. Such as there could be an unexpected situation that prevents the audit from being completed according to the audit plan. Who knows? Maybe somebody you know uh went on vacation, got sick, had a had a baby Uh and there maybe that person was critical to being interviewed or performing a demonstrating a process. There's all sorts of different things that could happen. Documented information pertaining to the audit should be retained or disposed of by agreement between the participating parties and in accordance with audit program and applicable requirements. As I indicated before, uh other uh entities when they uh have information after the audit report and certification decision has made. If there's nothing critical, then information is simply destroyed. Lessons learned from the audit can identify risks and opportunities for the audit program and the auditee. So there could be methods by simply having the audit, whether they pass or fail, to identify room for growth and how to mature. And again, remember that unless you're granted permission or it's required by law, do not disclose anything in relation to the audit, audit activities, or even who you talk to as a part of the interview. Alright, closing the audit aspects to take into account when closing the audit, first off is the format. The evaluation form should be brief. questions concise the time required to complete this form should not exceed 20 minutes. So that's realistically a how did we do? An evaluation of the auditors. Delay the evaluation form must be completed following the end of the audit mandate. Then there's also report and follow-up evaluations, compilation of the audit evaluation results. Should be sent to the audit team. Again, how did we do? Could we do better? Were we not clear enough? Were we not competent enough The evaluation by the auditee is a significant source of information for improving the audit practices of the audit team and the audit team members The evaluation of the auditors and the audit team leader should be recorded and retained by the certification body to provide a basis for the annual assessment. of each auditor. Remember each certifying body is required to ensure the competence of each auditor. So this is one way they can do that. It makes life easy for them. All right, uh closing the audit. The certificate that is issued by the certification body contains the following information: the name and geographical location of the auditee Date and expiration of the certificate. In most cases, it's going to be three years. Unique identification code, that's basically the serial number for the certificate itself, and that serial number is associated. To the auditee from by the certifying body. The standard against which the auditee is certified, so like 9001, 27,001, and so on. ISMS scope Name and address of the certification body. And it's important to understand because a lot of people don't, that for example, ISO 27001, 9001, that information is public. It's doesn't require non-disclosure to send somebody a copy of your 27,001 or 9001. So if you're um If you're in this course, then obviously you're going to be a lead auditor. And if as a part of that You know, if you're going to help companies get ready for audit or something like that, then uh if you suspect that a vendor of a client is uh ISO 27001, There are various online databases that you can look up companies, but you can also just ask them and say, can you send me a copy? If they uh say no you need a non-disclosure to get a copy of the 27001 certificate, then that should give you an indication that they truly don't understand 27,001. There is also a new uh database, worldwide database that's coming out. I can't remember the name of it right now, but uh there is a new worldwide database coming out where all certifying bodies are going to be required to put uh all of their certifications for for uh auditees in that one centralized database uh to make it easier to do the research Here's an example of a certificate. It looks like that. So XYZ uh strangely looks like the PECB fonts. Is uh offering a certificate to ACE Corporation for 27,001. The old version, 2013 That's what it looks like. So it's the certificate's valid for three years before this validity of the certificate ends. The organization has to be recertified. In between the initial certification and the recertification, there's also going to be what's known as surveillance audits. And a surveillance audit is an audit of a smaller nature, but just as critical. The following are a few examples of scopes as declared by certified organizations. The ISMS scope covers the protection against external and environmental threats. The ISMS scope covers the protection of confidential information. The ISMS scope covers the monitoring of outsource system development The ISMS scope covers the detection, prevention, and recovery control to protect against malware. So in that certificate, I think it's really small, but in that certificate where below ACE Corporation that would be uh where you'd have the scope declared. But it'll be on that certificate somewhere or another All right, this is the summary of section 19. The audit team should confer before the closing meeting to review the audit findings. Agree on the audit conclusions and prepare recommendations and discuss the audit follow-up activities. Recommendations relating to certifications include the recommendation for certification, the recommendation for certification, Conditional upon filing corrective actions plans without a prior visit, then the same thing but with a prior visit. And the unfavorable recommendation for certification. When discussing audit conclusions, possible reactions include accepting the conclusion, submitting new facts, or at least wanting to submit new facts. Looking for solutions that can make your nonconformities go away, negotiating the conclusions, denying the facts, or adopting a hostile approach Or seeking to assign blame to a person. There's a variety of different things that could happen. I personally have never been involved with a situation where seeking to assign blame or denying facts or adopting a hostile uh approach. I have seen negotiating, but the reality of it is is there's not really a negotiation. They're either doing it or they're not. And they're either compliant or they're not. The audit report must provide a clear, accurate, concise, and complete representation of the audit, be recorded in writing, and be compiled by the audit team leader Aspects that should be considered when closing the audit are format, delay, and reporting and follow-up evaluations. And much like other summaries, other sections, there is a quiz, so go to your quizzes worksheet and uh Give it a shot. And with that, I want to thank you for your time. I will see you on the next one. See you. Bye