Negligence of auditors, there's different uh four levels of responsibility in case of torturous acts Now you may go, what does tortuous acts mean? Tortuous means the actual damage that is done as a part of your involvement in that. What damage is done to the company because you're involved? And that could be a variety of different ways. It could be financial, it could be commercial, it could be reputational. So definitely understand that. So first off is no negligence. And that's realistically where. Where you want to be. That means that you are a perfect auditor. You did everything great. You followed the rules exactly the way they're supposed to be followed, and everything else. And it's it's just ideal There's also ordinary negligence. Now that doesn't mean that you are a bad person or you're a bad auditor, but possibly you just didn't do 100% in one area. uh more like 98 or 95 or 80 percent uh success in that particular uh area that you're you're working in. So you're still able to produce enough evidence to show that The auditee does deserve a certification of some sort. They pass their certifying audit. It's just that there's areas that could be done a little bit better the next time So during a surveillance audit, anything that could possibly be viewed as ordinary negligence, that could get double-checked to make sure it's adequate at that point in time. However, there's also other forms of negligence, and that's not the kind that we ever want to be in. So gross negligence is certainly one of them. So that's basically a total lack of diligence. The auditor did not report the facts that another auditor could have easily observed without being even without being qualified to conduct an audit. So for example, let's say an auditor did not really conduct the audit very well, but submitted a uh a positive audit report to the certifying body. So what could happen, the audit findings could be challenged by the certifying body and a new audit assigned before the auditee can claim some sort of certification or be granted or awarded that certification. Disciplinary actions could happen in cases like this for uh you know for the auditor themselves, including uh administrative actions like termination uh or Just basically being banned from working with that certifying body. Now, in cases of ordinary uh negligence, if there were cases of ordinary negligence, That could be just additional training, or it could be just maybe somebody's observing the auditor the next time they go around. So gross negligence is not something that we ever want to be in. Fraud, though, is the worst kind. That's where the auditor knowingly, consciously and deliberately participates in falsifying uh reports that is being sent to the certifying body in order to deceive this the uh certifying body or maybe even another party of some sort, law enforcement, regulatory bodies Anything like that. That is pretty much a worst-case scenario if if you're accused of fraud and actually found to have been fraudulent as an auditor. uh you might as well just plan on not being an auditor anymore uh because again as an auditor there's a tremendous amount of trust placed on you not only from the auditee with the information they give you but also on the certifying body that has contracted you to perform the audit. So it's super important that you never want to be in the gross negligence or fraud areas. Always strive for the best job you can do. Ways to reinforce ethics with auditors, conduct background checks before contracting the auditor, if if that's uh or or employing the auditor Make sure you understand the background of people. So one of the examples I give in relation to background checks for auditors If you're going to hire an auditor to do a financial records check of some sort, you want to make sure that that auditor wasn't convicted of embezzlement. Uh if same thing with uh information security. If you're gonna hire an auditor to perform information security, uh you may wanna make sure that the auditor not only is qualified to do the standpoint of information security audits. But also they were not charged with or convicted of some sort of cybersecurity crime. So it's also important to understand that background checks also don't necessarily mean uh criminal action that could have happened, but also from the standpoint of what's their knowledge. If they say that they are former network engineer, Then they should be able to prove that. And a background check should possibly, depending on how you're doing it, uh, could possibly prove that yes, they were a network engineer. So they understand the concepts of TCPIP and subnetting and VLANs and routers and switches. Or maybe they don't, but they put it on their resume. So make sure that you do a adequate background check for your uh your contractors, your auditors, whether the contractors or employees, to make sure they're they're living up to the name that they say they are. We can also have the uh sign, the auditors sign a code of ethics on uh company policy, company actions code of conduct, things like that, uh on ethics or surrounding auditing, uh possibly you could make the uh auditors that you're uh bringing on aware of the laws that they have that they will be beholden to, things like that. Conduct training and awareness programs. This is always good. There's computer security awareness training in any company, in any regulatory environment requires it. There's no real reason you could not add additional auditor training. to auditors in relation to uh being an auditor or awareness around things they should that the company or the certifying body wants to make sure that they're aware of Draft workplace policies and procedures based on best practices. That's going to vary based on the entity that you're working with. Establish an ethics committee and implement their decisions. Just because an auditor really does a great job and everything, that doesn't mean that they would pass ethically. There might be cases where reports need to be reviewed, they need to be approved, they need to be uh evaluated, and so on. Number six, evaluate the auditors continuously. Always do that. Always make sure that you're being aware of what your auditors are doing, what their experiences are like, how they interact with the auditees, and so on. Implement legal and professional sanctions if necessary. And again, the certifying body, the auditee, the auditor environment, that's going to vary based on what it is. and perform external audits by accreditation authorities. So we also have a risk-based approach to auditing. So this is 19011 clause 4G. So the rationale behind this is an audit approach that considers risks and opportunities. The risk-based approach should be a Should substantively influence the planning, conducting, and reporting of audits in order to ensure that audits are focused on matters that are significant for the audit client and for achieving the audit program objectives. So we want to, when we're performing the audit or when we're going to perform the audit, we don't want to perform the audit in such a way that it creates risk for the auditee because you pretty much will never get asked to come back if you cause a problem for the auditee as a part of doing the audit. So we want to ensure that the audit process is being conducted efficiently. And as an auditor, we should follow a risk-based approach by focusing on the audit areas that pose the greatest risk. The audit process would be inefficient if auditors use the same level of effort and utilized the same techniques in less risky audit areas So an audit risk-based approach helps enhance the effectiveness of the audit, as well as reduce risk for the auditee So one way to address the audit planning and testing while considering a risk-based approach is the top-down approach. So a top-down approach is basically the ranking of detailed audit procedures from the highest risk to the lowest risk. And then auditors should obviously use professional judgment to perform a top-down risk-based approach This implies, if we're going to do something like that, this implies that we have technical experts who can help out, as well as constant communication with the auditee to make sure that they agree with our risk-based approach. So clause uh 6. 3. 2. 1 out of 1901, the audit team leader should adopt a risk-based approach to Plan the audit based on the information in the audit program and the documented provided by the auditee. Audit planning should consider the risks of the audit activities on the audite's processes and provide the basis for the agreement among the audit client, audit team, and auditee regarding the conduct of the audit Planning should facilitate the efficient scheduling and coordination of the audit activities in order to achieve the objectives. effectively. So again all of the planning that's going to go into place, we're going to communicate uh everything, make sure everybody's in complete agreement uh specifically uh not only in relation to the audit team uh with each team member understanding but specifically the audit client And the audit. We want to make sure that we don't create additional risk by performing the audit themselves. Audit risk refers to the risk that the auditor may express a flawed audit opinion. and recommendation for certification based on inaccurate audit evidence. There is no audit approach that ensures a perfect audit process. Each client is going to be different, each company is going to be different, each environment's going to be different. Different. However, the risk-based approach is considered as an effective approach for most organizations for minimizing the possibility of not meeting audit objectives. The focus of risk-based approach is analysis and risk management. So simply due to the nature of audit process, every audit is a challenge to auditors. Every audit is a puzzle that has to be solved, and every puzzle is going to be different. Every client is different Given that there are no two organizations with the same complexity of operations, meaning that while you may have two two two organizations that do the same thing, they don't Internally they don't do the same thing the same way every single time. They may produce the exact same thing that gets marketed to the public, that gets sold to the public or whatever, but how they do it is completely different for every single company. Risk-based audit planning requires auditors to keep a focus on risk throughout their audit activities. It requires that the focus on risk is maintained throughout the planning process, including the way that plans are broken down and implemented. It needs to be responsive to the risk management cycle as well as the adequacy of the cycle in meeting the changing risks of the industry. It must be based on and aligned with the organization's priorities and that of their key interested parties. Changing and evolving perspectives could come into play. And again, remember that uh interested parties could be anybody. It could be a regulatory body, could be law enforcement, could be uh clients, end users. The risk-based approach should continuously promote the view that risks are an integral part of the organization's operating processes, and they are not only related to compliance. and regulatory issues. So examples of risks that an organization could face that an auditor might be might want to keep in mind. Operational, so utility failure, inaccessible offices. So again, a guide can help out with inaccessible offices or areas. Utility failure, that could be something that the auditor accidentally creates or maybe somebody else creates it. IT and communication, loss of the internet and phone access. That's going to be out of the hands of the auditor in most cases. as well as the auditee, but it's could be something that needs to be reviewed or understood. Regulatory fines as a result of non-compliance violations of contracts. That could be a risk Financial budget reduction, fund canceling or decreasing personnel, staff loss, or possibly not enough staff in the first place. Or unqualified staff. And then reputation, negative media coverage, loss of trust from key interested parties. And again, key interested party could be uh shareholders, clients, law enforcement, regulatory bodies, and so on.