# Threats to independence

The auditor must have independence in relation to the auditee, the persons responsible for its information security management, and the users.
The independent auditors are not going to report directly to management, the independent auditor is not the auditee or one of the users.

ISO 17021-1 clauses 4.2.4 and 5.2.11 mention several threats to impartiality: self-interest, self-review, familiarity or trust, and intimidation. If any of these are present, the certification body must take action.

**Self-interest** is the case in which a person or body acts in its own interest. This may happen, for instance, if the auditor owns stock in the company their auditing.

**Self-review** simply means that you can't audit yourself.

**Intimidation** is obvious.

**Familiarity or trust** comes into place when the auditor is almost part of the team that's being audited.

As an auditor you can't accept **gifts**, because they may be considered a bribe.
  
Auditors may not provide **consulting services** for the auditee, meaning they cannot contribute to the design, implementation, or the maintenance of a management system for the auditee, for two years prior to certification of the auditee.

---


All right, consultancy services and audit requirements for the certification body.

  

So this is out of 17,021-1 clauses 5.2.1 and 27006-1 Clause 5.2.2.

  

Conformity assessment activities shall be undertaken impartially.

  

The certification body shall be responsible for the impartiality of its conformity assessment activities and shall not allow commercial, financial, or other pressures to compromise impartiality.

  

So again, remember, commercial, financial, or other pressures.

  

So other pressures could be viewed as intimidation.

  

Commercial could be gifts in some form of fashion.

  

Financial could be literally somebody trying to bribe you or the certifying body.

  

And again, understand that conformity assessment activities shall be undertaken.

  

This is something that the certification body is going to do.

  

Certification bodies may add value during certification and surveillance audits by identifying opportunities for improvements.

  

Those are commonly called OFIs.

  

As they become evident during the audit without recommending specific solutions.

  

So there could be a situation the auditor sees that there is a potential for improvement by the auditee and they say, "Hey, you really need to do this.

  

It's not a requirement.

  

You really need to do that, but not explain exactly how to do it."

  

That's where the auditee is suggested to go talk to a third party to maybe help them with that OFI.

  

Without it being considered as consultancy or having a potential conflict of interest.

  

Again, avoid conflict of interest.

  

And again, if you're the auditor and you're telling the auditee specifically how to do something or what to do step by step, then that could be viewed as consultancy.

  

So you want to avoid it.

  

The certification body shall not provide internal information security reviews of the client's isms subject to certification furthermore the certification body shall be independent from the body or bodies which provide internal isms audit so the certification body is an independent body then you have the uh the auditor which is generally going to be a contracted individual or possibly a contracted company and then you're you're going to have a separate the auditee in whatever environment they're in.

  

Consultancy services and auditors.

  

So 17,021-1 requirements.

  

In order to ensure there's no conflict of interest, personnel who have provided management system consultancy, including those acting in a managerial capacity, shall not be used by the certification body to take part in an audit or other certification activities if they have been involved in the management system consultancy towards the client or the auditee.

  

A recognized mitigation to this threat is that personnel shall not be used for a minimum of two years following the end of the consultancy.

  

So what this means, if I'm helping a company, XYZ company, get ready for an audit and then maybe their audit company that's going to come in and do the certification on this XYZ company, they say, hey Carl, we really want you to show up and be an auditor for us because we like your work and everything else.

  

Then essentially I can go to work for them as an actual auditor doing certification audits and things like that.

  

But XYZ company, I can't even go to for at least two years.

  

Now in my experience, it's actually a longer than two years.

  

I've seen companies that say three to five years just to make sure that any interaction you may have had, including maybe people actually just not working there anymore, that there's no connection anymore.

  

So the implication of this clause, the provision of consultancy services may constitute a conflict of interest.

  

Certification bodies establish safeguards such as a two-year waiting period or possibly longer, or even prohibit their from providing consultancy services to their audit clients.

  

Auditors must be aware of the safeguards and policies established by the certification body.

  

So 5.2.12, all certification body personnel, whether internal or external, or committees who could influence the certification activities shall act impartially and shall not allow commercial, financial, or other pressures to compromise impartiality.

  

Basically that means doing the right thing. don't let yourself get bribed or influenced in any way that could be could look like a conflict of interest that could affect the certification process or even the certification body or the auditee themselves you have to maintain your independence through the audit you have to be aware of possible threats to independence and I gave some examples like gifts hotel stays trips financial promises or anything like that.

  

Any undue pressure from the audit client should be reported to and consulted with the certification body.

  

In a lot of cases, you're not going to run across any of these.

  

I've personally never run across any of them myself, but I've heard about it.

  

One that would definitely affect me would be anything that would concern me greatly would be anything involving the concept of a bribe or intimidation.

  

You need to understand as auditors, your name means everything.

  

The very second that your name is tarnished, and that means your integrity is tarnished.

  

And it very rapidly will go around the audit world that your integrity is not to be trusted.

  

5.2.13, certification bodies shall require personnel, internal and external, to reveal any situation known to them that can present them or the certification body with a conflict of interest.

  

In other words, if you're going to go in and audit a company and you have more information or you have a past with this company or something like that, you have to disclose it before you actually do anything.

  

You want to disclose it right away to the certification body.

  

We simply don't want to have any sort of conflict of interest.

  

We have an evidence-based approach as well. 19,011 clause 4F, the rationale behind this is the rational method for reaching reliable and reproducible audit conclusions in a systematic audit process.

  

So we have information that's objectively obtained, it's also evaluated objectively, and then we have the evidence.

  

So ideally, if we ask a company, you know, we're interviewing somebody, we're going to ask them say, say for example, do you have encryption at rest?

  

If they say yes, okay, well what level of encryption at rest?

  

Encryption at rest is AES-256.

  

Okay, well then how do we know that?

  

So one of the things we can do is compare what they're telling us with the actual evidence, and the actual evidence could be a policy, an encryption policy for example.

  

Or maybe they have encryption at rest in relation to their databases.

  

We could say, show us the database settings that show us what level encryption to support the words that you're telling us.

  

Again, unless there's absolutely no way of doing it, never trust the just the words that an interviewee or auditee tell you because they, in some cases, in most cases they're wrong or in some cases they'll just tell you what they're expecting you to hear.

  

Negligence of auditors.

  

There's different four levels of responsibility in case of torturous acts.

  

Now, you may go, what does torturous acts mean?

  

Torturous means the actual damage that is done as a part of your involvement in that.

  

What damage is done to the company because you're involved?

  

And that could be a variety of different ways.

  

It could be financial, it could be commercial, it could be reputational.

  

So definitely understand that.

  

So first off is no negligence and that's realistically where you want to be.

  

That means that you are a perfect auditor, you did everything great, you followed the rules exactly the way they're supposed to be followed and everything else and it's just ideal.

  

There's also ordinary negligence.

  

Now that doesn't mean that you are a bad person or you're a bad auditor but possibly you just didn't do 100% in in one area, more like 98 or 95 or 80% success in that particular area that you're working in.

  

So you're still able to produce enough evidence to show that the auditee does deserve a certification of some sort, they pass their certifying audit.

  

It's just that there's areas that could be done a little bit better the next time.

  

So during a surveillance audit, Anything that could possibly be viewed as ordinary negligence, that could get double-checked to make sure it's adequate at that point in time.

  

However, there's also other forms of negligence, and that's not the kind that we ever want to be in.

  

So gross negligence is certainly one of them.

  

So that's basically a total lack of diligence.

  

The auditor did not report the facts that another auditor could have easily observed without being, even without being qualified to conduct an audit.

  

So for example, let's say an auditor did not really conduct the audit very well, but submitted a positive audit report to the certifying body.

  

So what could happen, the audit findings could be challenged by the certifying body and a new audit assigned before the auditee can claim some sort of certification or be granted or awarded that certification.

  

Disciplinary actions could happen in cases like this for the auditor themselves, including administrative actions like termination or just basically being banned from working with that certifying body.

  

Now, in cases of ordinary negligence, if there were cases of ordinary negligence, that could be just additional training or it could be just maybe somebody's observing the the next time they go around.

  

So gross negligence is not something that we ever want to be in.

  

Fraud, though, is the worst kind.

  

That's where the auditor knowingly, consciously, and deliberately participates in falsifying reports that is being sent to the certifying body in order to deceive the certifying body or maybe even another party of some sort, law enforcement, regulatory bodies, anything like that.

  

That is pretty much a worst case scenario.

  

If you're accused of fraud and actually found to have been fraudulent as an auditor, you might as well just plan on not being an auditor anymore because, again, as an auditor, there's a tremendous amount of trust placed on you, not only from the auditee with the information they give you, but also on the certifying body that has contracted you to perform the audit.

  

So super important that you never want to be in the gross negligence or fraud areas.

  

Always strive for the best job you can do.

  

Ways to reinforce ethics with auditors.

  

Conduct background checks before contracting the auditor or employing the auditor.

  

Make sure you understand the background of people.

  

So one of the examples I give in relation to background checks for auditors, if you're going to hire an auditor to do a financial records check of some sort, you want to make sure that that auditor wasn't convicted of embezzlement.

  

Same thing with information security.

  

If you're going to hire an auditor to perform information security, you may want to make sure that the auditor not only is qualified to do the standpoint of information security audits, but also they were not charged with or convicted of some sort of cybersecurity crime.

  

So it's also important to understand that background checks also don't necessarily mean criminal action that could have happened, but also from the standpoint of what's their knowledge.

  

If they say that they are a former network engineer, then they should be able to prove that and a background check should possibly, depending on how you're doing it, could possibly prove that yes, they were a network engineer so they understand the concepts of TCPIP and subnetting and VLANs and routers and switches.

  

Or maybe they don't, but they put it on their resume.

  

So make sure that you do an adequate background check for your contractors, your auditors, whether the contractors are employees to make sure they're living up to the name that they say they are.

  

We can also have the sign, the auditors sign a code of ethics on company policy, company actions, code of conduct, things like that on ethics or surrounding auditing.

  

Possibly you could make the auditors that you're bringing on aware of the laws that they have, that they will be beholden to, things like that.

  

Conduct training and awareness programs.

  

This is always good.

  

There's computer security awareness training in any company, in any regulatory environment requires it.

  

There's no real reason you could not add additional auditor training to auditors in relation to being an auditor or awareness around things that the company or the certifying body wants to make sure that they're aware of.

  

Draft workplace policies and procedures based on best practices.

  

That's going to vary based on the entity that you're working with.

  

Establish an ethics and implement their decisions.

  

Just because an auditor really does a great job and everything, that doesn't mean that they would pass ethically.

  

There might be cases where reports need to be reviewed, they need to be approved, they need to be evaluated, and so on.

  

Number six, evaluate the auditors continuously.

  

Always do that.

  

Always make sure that you're being aware of what your auditors are doing, what their experiences are like, how they interact with the auditees, and so on.

  

Implement legal and professional sanctions if necessary.

  

And again, the certifying body, the auditee, the auditor environment, that's going to vary based on what it is.

  

And perform external audits by accreditation authorities.