The responsibilities of a guide. So this is 17021-1. Uh clause 9. 2. 2. 2. 3 Each auditor shall be accompanied by a guide unless otherwise agreed to by the audit team leader and the client. Guides are assigned to the audit team to facilitate the audit. The audit team shall ensure that guides do not influence or interfere in the audit process or outcome of the audit. So, guides help facilitate audit activities, maintaining logistics, ensuring that health and safety policies are observed, witnessing the audit process on behalf of the auditee. As somebody who's done audits, I really enjoy having a guide from the auditee being there and available because they cut through what I call the red tape They uh they make it easier to accomplish the audit itself. They can make people available that you normally wouldn't have access to. They can get you into areas that uh you normally wouldn't get into All sorts of different things. So I'm a big fan of using a guide at every possible opportunity. They can also do scheduling They'll uh they'll basically be your personal assistant to schedule uh audit activities uh while either virtually or on site or or whatever. But it's also important to understand that as auditors or people on an audit team, those companies that you're auditing, they're responsible for your well-being, your welfare while you're there. So it's important if you're going to audit somebody that the auditee know how many people are showing up, where are they going to be at, what are they going to do, uh, and so on. There might be a case where it's uh it's an industrial environment and uh The uh guide is gonna make sure that everybody puts a hard hat on or safety glasses or or something. But there's also the case that What if there's a fire in the building and the and the guide is there? The guide would be responsible for making sure that the audit team got out safely. Then there's also witnessing the audit process on behalf of the auditee. This is certainly true. Um, and I have seen situations where the guide basically acted as uh off-the-record surveillance for the auditee. And as comments were made around the guide, then the guide would run off and tell the auditee, hey, this is what Carl said. This is what John said, and so on. So if you're gonna have private conversations about the oddity itself, then just make sure that the guide is not there. Because you don't want to influence, you don't want to make a comment that the guide hears, gives to the auditee that could possibly influence the auditee in a wrong direction Or put the audity at risk. So unless there's something absolutely critical, just keep it to yourself and understand that everything you say around a guide is probably going to go back to the oddity within a few minutes. All right, preparing audit test plans. Following the development of the audit plan, the audit team prepares the test plans. Test plans involve the use of several audit procedures such as observation, interviews, documented, information review, analysis, and technical verification. Since the audit team cannot validate all the elements of the management system, the processes and systems to be tested will be selected based on their materiality. Audit test plans will be explained in detail in the following sections after this after this one. Knowledge of auditing techniques is a prerequisite for understanding the means of creating effective audit test plans. All right, prepare the documented information for a stage two audit. This is out of 1901 or 6. 3. 4. Audit team members should collect and review the information relevant to their audit assignments And prepare documented information for the audit using any appropriate media. Again, media could be paper, could be digital, could be anything All right, so the documented for the audit can include, but not limited to physical or digital checklists, audit sampling details. or audiovisual information. Audit team members should prepare the work documents that will serve as audit records. This could be interview guides, meeting records, checklists, sampling results, and so on. The audit team must maintain their work documents until the end of the audit. Afterwards, the documents should be archived or destroyed. As I said in a previous section a lot of audit certific certification bodies once once they've evaluated the material and agree that certification should be awarded then they they actually destroy uh any any sensitive documents or or notes from the audit team It's important to ensure that protection of all work documents during the audit because they may contain confidential information of the auditee. It's also important to understand that work documents That are created by the audit team are the property of the audit team, not the client. So if if I take personal notes or I work with uh uh other people on my audit team But we're just documenting our observations or things like that. That is not the property of the client. So the client cannot demand that that information get turned over. Principles of maintaining audit work documents, so consistency and standardization, accuracy and timeliness clarity and conciseness, completeness, authorship and review, and then confidentiality. So working backwards, confidentiality is obviously keeping whatever you write or your thoughts of anything written down as secret. Authorship and review. So there's going to be people creating work documents, but there should be reviews and collaboration on those work documents as well If we're going to create a uh start creating a final audit report, then we definitely want to have some sort of review. Completeness, make sure every single thing that is relevant to the control or anything else is absolutely all there that people don't read it and go, what does this mean? Uh because you've skipped the step in in uh explaining it. Which again goes to clarity and conciseness. We don't want to write a bunch of stuff in our work documents that are confusing to understand that some other team member can't figure out what we're talking about. Accuracy and timeliness. So audit work documents should reflect the planned tests and results in an accurate manner. Documents about the timing of the work carried out should be provided And then consistency and standardization. So auditors should maintain consistent writing by using standard formats in Work documents. Again, the certification bodies are most likely going to have templates and you just have to fill in the details, fill in the gaps. But if we have consistency and standardization, it's going to be easier to understand and review the documented information itself. So continuity will be promoted when an auditor takes over a work that has been initiated by another auditor because it's consistent in exactly using the same template All right, checklists. There are pros and cons. So the advantages of checklists help keep objectives in mind. It creates a structured and standardized audit approach. Helps guide the auditors, it saves time during the audit and facilitates record keeping. But there's also some downsides to this It can appear to become a rigid frame. So less flexibility. And remember I I indicated in another section that uh while you may have a plan and everybody agrees to the plan, you should also uh be very flexible in relation to the fact that the plan may change uh you know later into later on in the actual once the audit started. Disadvantages of checklists, it should not be used as a substitute for audit planning Subject can be too limited or maladapted to identify the important processes or controls. And it can intimidate those being audited. I've actually seen this before where uh people get intimidated. They feel like they're being interrogated or uh being interviewed by the police or something. Um so we we just want to make sure that we're not intimidating the auditees. They're under a lot of stress as it is. With what they're doing, what they have to do, how much money they pay just to have people there. So we don't want to create a situation where they're intimidated or feel that way. And you can understand that uh in relation to checklists, some of the items could simply be out of scope, so you might not even do them, even though you have a checklist. Implementation of a documentation standard. The team leaders responsible for establishing a standardized documentation procedure. Most of the time, uh there that will be provided to you by the certification body itself. So the documentation standard usually involves guidance on the following aspects: language to be used, which In a lot of cases it's going to be English, but uh make sure you're aware of your countries and your certification bodies requirements Media to be used. So are you going to use some sort of audit software? Are you going to use audit templates? How are you going to do it? Are you going to just use a sheet of paper? Use of abbreviations. Again, not only use of abbreviations, but making sure that the auditor's version of an abbreviation is consistent with the auditee's version of what that same abbreviation means. And then documentation of audit evidence. Alright, and this is the section 12 summary. So the purpose of stage two audit is to evaluate the implementation and effectiveness of the auditease ISMS. The audit plan should be reviewed and confirmed by the certification body and audited before the stage two audit is initiated. A key factor in ensuring a successful audit is the selection of competent and professional individuals to be part of the audit team. The involvement of technical experts can help in filling any potential gaps in the audit team members' knowledge or qualifications. And lastly, the audit team leader is responsible for establishing a standardized documentation procedure. Much like the other ones, there is a quiz for this section. So be sure and do that on your own. I will see you in the next one. Bye.