So we mentioned a little earlier that we would have this document called an internal audit charter that would basically lay out a number of uh commitments to the internal audit process. And two of those, which are particularly important principles, are the first one, access to resource and collaboration. What this means is As an internal auditor, if I need to carry out my audit, I should be free, within appropriate boundaries, to be able to interview the people I need to interview. Have access to the data that I need to have access to, to be able to review evidence, you know, look at systems and so forth without unfair restriction. And this is what we mean about the access authority. So the internal audit charter should lay out what permissions internal auditors have. what can be done if for whatever reason you know internal auditors are prevented from performing their role. So as I said a little bit earlier on, this is not about giving internal audit has access to anything they want at any time, but it's about having that reasonable balance in place. The independence bit we already mentioned as well when we talked about the internal audit charter This is laying down clearly where those internal auditors report and how we can have an assurance that they're free from undue influence. you know, or any sort of unfair situations. We might back this up as well with some kind of code of ethics that all internal auditors are required to follow or sign up to to have a again a greater assurance. What we want to make sure of is that an auditor is free to give an honest evidence-based opinion on what they see Now when we think about internal audit, of course like any auditing it's a good idea to have some clear plans in place. And we suggest that there should be long-term and short-term plans. So I said earlier on that an audit program is not just carry out an audit and that's it. Usually we carry out a series of audits over a period of time. So for the long-term planning we might have a three-year plan and the reason I say a three-year plan is usually organizations are certified for a period of three years So assuming the organization in question is going through that certification cycle, we could have a three-year plan which says generally these are the areas that we're going to look at. So you might say you know next year in quarter one we're going to do a detailed review of network security. In quarter two we're going to focus on application security or whatever it might might be as being important. And then of course in the shorter term the plans that we have will be much more detailed. So for example, right now I have an internal audit client that I work for, and we've said that the next audit on the long-term plan is network security. And now we have a very specific agenda of exactly what we're going to look at, the devices we're going to examine, the particular topics we're going to examine. in more detail. So we'd expect to see a clear set of planning. Now usually the audit manager or whoever's heading up the internal audit function would put this together not just on their own, but of course by working with key stakeholders in the organisation. So that planning should be based on risk. You're thinking about what are the most critical areas of the ISMS Because usually the most critical areas are the ones we want to visit more frequently as part of internal audit. Now there might be a concept that you might have heard about before called continual internal audit. Now what we mean by continual internal audit is not Auditors continually sitting in front of people interviewing them in a traditional audit sense. What we mean is establishment of tooling and technologies that will allow auditors to have continuous access to data. So for example, when I think about the health service, they had an example of that where the internal audit function was always able to review and run reports on the patient databases to identify data quality issues. That was a a simple example of continual audit. They didn't have to book an appointment And schedule a time to conduct their audit, they had the ability to execute that test at any time over a period of time And some of the benefits of having tooling like that is an auditor can more easily detect non-conformities early, so rather than waiting till the date of the audit and then discovering a problem. We can get an early heads up if an auditor's looking at data and evidence regularly and saying there's something not quite right here. It also can remove some of the manual tasks in an audit. So in the example I gave there The auditors don't need to come along, do a manual data extract, manually sift through the data to find the problems. They already have access and tools that can allow them to easily query the dataset. And this means for specific controls that auditors are looking at, they can continually monitor them over a period of time and possibly look at a large dataset. So many benefits of doing continual internal audit, but we can't hide from the fact that this is not quite as simple as I might be making it out to be. It can be difficult and expensive to implement insofar that the tooling that allows those auditors to conduct those tasks often requires significant investment. investment, not just investment in terms of finances but in terms of time. Because we've got to be clear if we're going to do continual auditing like that, what are the specific data sets that specific things that those auditors actually need to look for and technically how can we grant access to the data. There's also a risk that it may produce what we call a false sense of security. And the reason I say that is if we think or people in the organization think Well, the internal audit team are constantly monitoring this particular control. There might be sort of a an attitude, a little bit of Well, we don't need to worry about it because if there's anything wrong with it, these auditors will spot it. So let's say the internal audit function we're constantly reviewing backup logs to detect whether backups are successful or not. Is there a danger, and I pose that as a question rather than a statement, is there a danger that those involved in implementing that control be a bit more relaxed? because they think the error will be spotted. So it could lead to a false sense of security. And if the auditors are overwhelmed with information and have too much, there is a risk that we don't actually see those deviations. So a lot of people will try and sell the idea of continual audit. I would say it's not a silver bullet But in particular areas where there might be an important thing to look at, like that data quality example, internal audit, continual internal audit can be very beneficial. Now, when we think about building an internal audit program, depending on the size of the organization, just like building an ISMS, we need to think thoroughly about the resource requirements for making this happen. Implementing an effective internal audit programme does have a financial cost, whether that's the financial cost of hiring auditors, training auditors. buying the software and tools that they need to use and certainly that might change as we expand or change over time. One of the biggest challenges of course is making sure we have competent personnel. And when we speak about competence, that's kind of twofold. There's the competence to conduct audits which is understanding audit principles and techniques. Then there's the subject matter competence. Now this is something I would like to highlight here. And this is not a criticism of anybody in particular at all but sometimes what I've seen in some organisations is they'll have an internal audit function that might focus on things like risk, operational risk processes, etc. And those auditors go off to conduct information security audits, but don't necessarily have the technical background to identify key problems. And then that's another way we get into a false sense of security because you get reports saying things are okay and so forth. So it's not just audit competence but subject matter competence that is important here as well We also need to think about tooling. So are we going to give the auditors audit software? We talked earlier in the course about statistical analysis, so there might be need for tools that calculate sample sizes and so forth. And another thing that's important, we want auditors to operate in a consistent, repeatable way. So we need very clear, defined audit policies and procedures. So if I was, let's say your organization was setting up an internal audit program and I was joining you as an internal auditor, what do you expect in terms of the way we'll plan audits, in terms of the way we'll do sampling? How am I meant to complete my report? All of these things should be clear in your procedures. And the logistics part may be relevant if these audits involve on-site audits. especially if you're you know geographically dispersed, how will you get the auditors to and from where they need to be? Is there any logistical planning that might need to be taken into account Now another important aspect as well that we need to think carefully of is when audits happen, what we get out the back of audits is not just a report, but we get audit records. So audit records include the report itself, but of course any evidence that was gathered, any correspondence between the auditors and the auditee. any data that they've taken for sampling and so forth, these are all things that prove that the audit happened and are often used to prove that the audit happened to a certain level of quality But we do need to have then in our audit program our records management program agreeing, for example How that those records should be kept and where, how long they should be kept for, how they should be protected from a security point of view. So speaking as an external auditor, for example, if I go out and conduct an audit, and let's say I use my laptop and gather notes, when I'm finished, I basically am required to upload all of those to a portal that belongs to the certification body. I'm also required to confirm in writing that I've erased anything that I shouldn't have from my local device. That's part of their records management and security policy. For internal audit we'd need to set something in motion as well. And the reason we want good quality audit records is let's imagine a new auditor comes along next year to do a follow-up audit Well they need to be able to see the evidence and details of what's happened on previous audits Now earlier in the course we looked at following up on non-conformities, but we looked at that from a certification body point of view For external audit. Well, the truth is it's not a lot different for internal audit. If in an internal audit we discover non-conformities, it's still a requirement of the standard, as you know, in clause 10. 2 To ensure that corrective action is taken, a root cause analysis is done. What we're expecting here then is from an internal audit point of view, we have a clear procedure about following up on corrections and corrective actions. Now the difference between internal and external audit Is in external audit there are very specific time frames that must be followed, like three months for a major nonconformity We don't have to follow that exact timeframe for internal audit, so we can set a shorter or longer time frame as we expect, but we do expect to see. That internal auditors will follow up on non-conformities will encourage the organization to close those non-conformities out and we'll seek evidence to see that the root cause analysis has been done and corrective actions have been applied. Ideally we w what we want to see is these things being done before the external audit. So for me, as an external auditor, I always feel very comfortable, well uh uh or comfortable at least, if I see an internal audit's been done and non-conformity has been detected, but the organization's acted on it before the external audit, as long as that acting obviously is you're based on a sound root cause analysis that gives me a confidence that the internal audit process is indeed working properly and that they're not just producing, let's just say, reports that aren't followed up on. This is a an important point. I do remember at one point being an auditor for an organization three years in a row. And uh honestly I could have gone back three years in a row. Uh this wasn't a certification audit by the way, but it's a sort of semi-external audit. But in this audit I could have gone back three years in a row and really just change the date on the audit report because nothing was being acted upon. That's exactly what we want to avoid by having that proactive follow-up and the commitment from top management that follow-up is acted upon. Now, like anything else, if we set about building a good all-round internal audit program Just like building an ISMS, we would expect that that program is reviewed at certain periods in time. Now in this case, it's those who are managing that program. So that might be a lead auditor or an internal audit program manager. And the kind of things they might want to review at periodic intervals is things like, are the audits that we're scheduling being carried out? Are they being carried out to the level of quality required and meeting the objectives? How are the audit team members performing? So when we get feedback from the audit tee, is that positive feedback? And when we look at the work that the auditors are producing, You know, is it meeting the minimum quality standards? Does it look rigorous enough? Are those auditors following procedures correctly? You know, is there an opportunity to improve their skill set? What sort of feedback are we getting from the auditees in terms of interaction? Do they find the results from these audits useful? Do they enjoy the audit experience? Now you might raise your eyebrow at that. uh who enjoys an audit experience but what I mean is um are the auditees seeing value in this they're not just seeing the audit as a sort of a box ticking exercise Are we getting when we're raising findings enough evidence? Is the tooling working, the procedures working? All of these things, what we're trying to do is find out. And this is not about looking for problems, this is about learning how we can improve that process. So ultimately we have an internal audit process that's effective and value adding, and that's what we're really looking for So in summary, we've had a look at the internal audit process. We can use ISO 19011 to build an effective internal audit process. Internal audits are absolutely fundamental to the successful running of an ISMS and all the principles and skills that you've learnt through this course you can apply in an internal audit context. But we do need to have support for effective internal audit and therefore we need an internal audit charter laying out the independence of auditors, their independence requirements giving them the authority to perform their job effectively. And we do need to make sure that those auditors are competent, properly supported. and that we look to drive continual improvement overall. And if we get this right, then really the external audit is another set of eyes, but getting a good internal audit function working means we can have a real confidence that over time we can improve our security posture and capability and improve and further develop our ISMS.