Hi there, thank you for joining me. This is section 19 for ISO IEC 27001 Lead Auditor. This is closing of the audit. So we've done stage one, stage two And now we're closing the audit itself. In this section, we're going to talk about the steps of closing the audit, which includes determining the audit conclusions. discussing the audit conclusions, conducting closing meetings, preparing and distributing audit report, and completing the audit. So as you can see, and then we're also going to talk about making the certification decision and then Finally closing the audit. Alright, as a part of the audit conclusions, uh we're gonna determine and agree on audit conclusions. draft the audit conclusions, conduct the closing meeting, prepare and distribute the audit report, and then make a uh the certification decision. And when I say the make the certification decision, that's not the auditor. uh to do that. That's the certifying body. The auditor makes a rec a recommendation for certification. So uh there is an exchange of information for closing the audit. The following are some of the summaries of the information that gets exchanged after evaluating the evidence gathered during the audit, the audit team. uh presents their findings and observations, including nonconformities to the auditee. The auditee accepts the audit findings provided, but if they don't, then they uh provide additional information to justify that. But they're generally in most cases they're going to accept uh your findings because they're actually the ones who provided evidence. That created you, uh, that gave you the opportunity to have those findings. All right, then the audit team uh presents the audit conclusions to the audit T. And issues a favorable or unfavorable certification recommendation to the certifying body. Then they present the uh the findings and everything else, uh the audit conclusions to the Auditee's management. The Auditee accepts the audit conclusions and the certification recommendation. Or they don't, and then they uh they appeal. Uh but then there is a closing meeting of the and the closing of the stage two audit report or the creation of the stage two audit report It's sent off to the auditee where if they agree, then awesome. If they don't agree, then they can appeal. They also may be required to have some sort of action plan. in order to uh remediate any nonconformity that was uh a finding by the audit team. It's it's important to understand there is an appeal process that the auditee can uh choose to use if they chose to. Um it's that doesn't mean that you're wrong as the auditor or they're right as the auditee But uh occasionally uh appeals do happen. The auditee does not have to absolutely accept your findings or your report just because it's you creating it So if there is a nonconformity, then there are action plans that will be required to be created by the audit. They submit the action plans to the audit team and hopefully start right away. The auditee then implements corrective and preventative measures to hopefully fix whatever whatever problem there was. And then assuming they get certified by the certifying body, then they'll have that. And then later on down the line, there'll be what's known as a surveillance audit. Okay, so I'm going to talk about surveillance audit real fast A surveillance audit after the certifying body says yes, the audit T is uh certified. Uh In a year, there's what's known as a surveillance audit, which is a it's still an audit, still follows the same process, but it's uh less intense than a certifying audit. All right, determine and agree on audit conclusions. We're going to uh talk about that now. Uh this is 19011 clause 6. 4. 9. 1, the audit team should confer prior to the closing meeting in order to review the audit findings and any other appropriate information collected during the audit against the audit objectives. Also, agree on the audit conclusions, taking into account the uncertainty inherent in the audit process. Prepare recommendation if specified by the audit plan and discuss audit follow-up as applicable. Once we've had that meeting, there's going to be a certification recommendation. When concluding the audit, the auditor must issue one of the four following Recommendations related to certification. Number one, recommendation for certification. That's the one that everybody wants. Recommendation for certification conditional upon the filing of corrective action plans. without a prior visit. So that means that the auditor found something that needed to be fixed. They're okay with recommending for certification But there must be a corrective action plan of some sort that does not require a prior visit. So that that could mean that the corrective action plan involves some sort of technical uh evidence that could simply be emailed. Uh or possibly if there's an internal auditor uh team inside the auditee environment That the uh internal audit team is uh trusted enough to provide uh assurance that the corrective action plan was accomplished. There's also recommendation for certification conditional upon the filing of corrective action plan with a prior visit. Much like number two, this is where same thing, except for they have to show up and see it personally And then there's also unfavorable recommendation for certification. This is the one that the clients don't want. Because this means they're not going to get it. They're also not going to get a refund on their money. So ideally if a client's fully prepared, uh best case scenario is you get a number one recommendation for certification. Uh occasionally you might get a recommendation for uh certification upon the filing of corrective action plan. Uh but I personally have never run across uh corrective action plans required uh as well as a another visit. All right, discussing audit conclusions. So prior to the closing meeting and submission of the final audit report It's important that the audit team discuss the audit findings with the auditee's management so that any oversight or misunderstandings are avoided. Here's another one. So the management is not caught by surprise. You don't want to surprise management in relation to findings. The management is given an opportunity to answer certain questions and provide new evidence. The audit conclusions are corroborated with the auditee's management. The implementation of corrective actions as soon as possible is encouraged. So discussing audit conclusions is really being very polite and professional in relation to the interaction between the audit team and the audit tee. If there is a possible finding of some sort, making them aware in advance is certainly an opportunity to relieve a lot of stress. As well as uh possibly uncover issues that were not previously fully understood. So, for example, let's say you uh you audited uh auditee for some control It doesn't matter what the control is, and they just gave you bad evidence because they didn't understand what you're asking for. And then you you you know judged that to be a non-conformity and you brought brought it up to the management or or the auditee's uh team and they said, Oh, uh my gosh, we uh were totally wrong in what you we thought you were asking for. Are you asking for this and if that's what you're looking for? then maybe that gets gives the uh the uh auditee a little bit uh flexibility. But again, from the audit conclusion standpoint, you never want to surprise them uh the oddities. You never want to surprise them with uh situations that uh they're just not aware of. It's it's not going to be a good uh pleasant conversation. So the audit team must ensure that the audit report contains evidence that's accurate and that the audit conclusions are easily understood by the auditee's management So again, write your audit, write your reports, your findings, and so on to the audience that you're presenting it to. Not overly technical, but uh straight to the point and direct. So hence the discussion between the audit team and the audit team prior to the submission of the final audit report is important to avoid any potential misunderstandings. Lots of reliable communication. So possible reactions from the auditee. They accept the conclusions. They submit new facts. That's possibly because they didn't understand or they did not provide enough evidence Or maybe it's just an inexperienced auditor. They look for solutions. How can they employ compensating controls that can solve the problem? They negotiate the conclusions, deny the facts, or adopt a hostile approach saying that the auditors they don't know what they're doing or maybe uh they're totally wrong, uh things like that. And then also certainly possible, seek to assign blame to a person. Now they're not going to be able to blame the auditors unless the auditor or the audit team was a gross negligence. uh as you know from the stages of negligence of uh gross negligence or fraud but the reality of it is is they may uh the audite may attempt to blame internal people internal to the auditee's team just because that's their the culture of that company. So we want to draft the audit conclusions. So audit conclusions must be drafted and reported. Auditors should draft the audit conclusions based on evidence that is examined. And its adequacy is evaluated in terms of quality and quantity. The auditor must draft the audit conclusions based on evidence and facts, not on assumptions. The auditor must also consider in the audit conclusions any revisions that resulted from the closing meeting or other discussions. The auditor must draft the audit conclusion against the audit criteria, and this should be pointed out in the audit report. So audit conclusions are not a summary of the audit findings but a conclusion based on the audit criteria. So 5. 3 conduct the closing meeting. So this is out of 17021-1 clause 9. 4. 7. 1 So a formal closing meeting where attendance shall be recorded shall be held with the client's management and, where appropriate, those responsible for the functions or processes audited So who? Audit team, members of the audites management. So basically everybody on both sides that were involved in the audit. What? We're going to present the audit conclusions and the certification recommendation. And again, clients want to hear that you're going to recommend certification. Where in a conference room, and again, this could be over Zoom, that's very popular now, when on the the last day of the on-site audit. So the closing meeting agenda, here's an example, the attendance list, we're going to take attendance acknowledgements. You could The team leader is going to thank people for being there. Thank you for your help. Thank you for your uh, you know, making this efficient and easy. and so on. Then we'll recap uh audit objectives and scope. Then we'll recap or present for the first time official findings relating to the audit and the conclusions. Presentation of any nonconformities if there are any limitations of the audit, questions and answers, and then there's an audit follow-up. Now, in relation to presentation of non-conformities, uh again Certifying bodies are going to have a template for everything. So I I use a I literally use the PECB template for documenting non-conformities because it works great. So if you're going to present non-conformities, understand the audience that you're presenting to. How you present it could be very simple or it could be very complex, but we want to definitely understand the audience that is that is uh participating. Also under questions and answers, you should expect as a on the audit team, you should expect numerous questions So be prepared to answer all of it. They'll ask you what's next, when are we going to do a surveillance audit? Are you going to do the surveillance audit? Uh if there's anything involving a corrective action plan, they're most likely going to say, how long do we have? Do we have to Do we have to do it within the time period that you're saying we have to do it? Can we do it next year? All sorts of different things that can come up. So be ready for that. And just kind of go with the flow, be very professional and responsive. So other topics to address in the closing meeting out of 17021-1 clause 9. 4. 7. 2? So the closing meeting shall also include the following elements where the degree of detail shall be consistent with the familiarity of the client with the audit process. Advising the client that the audit evidence obtained was based on a sample of the information, thereby introducing the element of uncertainty. The method and timeframe of reporting, including any grading of audit findings, the certification body's process for handling non-conformities including any consequences relating to the status of the client certification, the timeframe for the client to present a plan for correction and corrective action for any nonconformities identified during the audit. The certification body's post audit activities, and information about the complaint and appeal handling process So uh if we talk about this a little bit more, remember just speak unless they're you're gonna recommend certification right off the bat They don't have to accept your your findings as as fact and accept it. They can go through an appeal process or a complaint process if they feel justified to do so. There could be a case where a client may go through the appeal process just because they can't handle that they didn't pass. So there's that. Uh but the other thing that's comes up that I've seen a lot is the time frame for the client to present a plan for correction or corrective action. For any nonconformities. Most clients, they're not very receptive to the fact that they have to fix something within 30 days. And they'll they'll most likely say Well, this is really going to impact our revenue, our business. It's going to disrupt our business, things like that. And that may be that may be true, but the reality of it is that If it takes forever to implement a corrective action plan, then essentially the entire environment could have possibly changed during that time. And it would be not very realistic for you to recommend certification six months after the fact because the other areas of the environment may have changed So it's there's there could be some risk there. So again, time frames for correction, uh things like that, that's that's something that uh comes up a lot.