Competence of auditors You do have to know what you're doing. So number one, personal behavior, generic knowledge and skills, discipline, specific knowledge, communication skills, and knowledge of certification bodies processes So in relation to competence, the three dimensions of competence are knowledge, skill, and attitude So knowledge is the acquaintance of facts, truths, principles during a study or an investigation, and it's the mastery of those concepts and theoretical knowledge So when you know something, that is knowledge. Now how you know it is is relative. So did you have a previous job where you learned it? Are you formally trained? Or are you Googling it and figuring out what knowledge means? Whatever the knowledge is for the uh oddity It's important to understand that if you're going to audit something, you should be competent enough to actually do that. And if you can't audit a particular area because you simply don't have the knowledge, get a technical expert to help you Skill refers to the practical competence and expertise of an individual. Attitude refers to the ability to display professional or behavior according to the characteristics of the environment situation or people. So read the room is a common common term. Make sure that you're professional in nature and so on and you understand the culture of the company. So personal behavior. So this is out of 17021-1 Annex D. Examples of personal behavior that are important for personnel involved in the certification activities for any type of management system are described as So ethical, open-minded, diplomatic, collaborative, observant, perceptive, versible Tenacious, dis decisive, self-reliant, professional, morally courageous, and organized. So let's go over a few of these So first off, ethical. Your word is your bond. If your word is bad, uh then then that means you're pretty much unethical. So always be fair, truthful, sincere, and honest. This ties greatly into integrity And again, in auditing, there's a tremendous amount of trust placed in you in information that's provided by the auditee. It would be unethical if you just simply disclosed all of that information uh unless you're r required to by law, it would be unethical to to do that. It would be unethical to uh not be truthful when you're writing uh you know certification suggestions or things like or uh reports to certification bodies. We always want to be ethical in relation to all activities we we do. We want to be beyond reproach. Open-minded. Willing to consider alternative ideas or points of view, basically meaning that maybe maybe you're making a mistake, maybe you're not right in uh how you're doing things So being open-minded. That could be being open-minded with your audit team, but it could also mean being open-minded with the audit client or the audit team. Diplomatic, being tactful and understanding, respectful of other people that you're interacting with and so on. Collaborative, working with other people as a part to uh you know coming up with a solution So you don't act like you're the Lone Ranger and nobody's there to help you. You're part of an audit team. They're there to help you and you're there to help them. observant, actively aware of physical surroundings and activities. As an auditor, I start the audit process the very second I get out of the car and I'm on the on the auditee's property. Uh if as I'm walking into uh the audit environment, I'm observing The doors, how are the doors secured? Are there cameras? Do I have to check in with somebody as a part of the you know a guest check-in process? I just observe all of those things before I even ask anybody questions And I take notes out of all of that. Perceptive, being aware of and able to understand situations. And those perceptiveness could be a variety of different types of situations could be uh also tied directly into diplomatic Versatile, adjust readily to different situations or be avail uh be able to uh uh flex. Tenacious, don't don't quit. Persistence is uh uh another way of saying tenacious, but uh just don't quit. Decisive, reaching timely conclusions based on logical reasoning and analysis. Self-reliant, basically you can act independently. You don't need other people. Professional, again uh being uh understanding of the culture, the environment, the people you're talking to, uh your professionalism is uh uh highly valued. Now also understand that a lot of these, for example, morally courageous, uh morally courageous and ethical are kind of hand in hand with each other. Diplomatic and professional are also diplomatic or also connected with each other So, and then organized, uh be organized in your activities, uh especially as an auditor in relation to organization. If uh if you're going to interview people and it it it appears that you're not organized, then what could happen is that the auditee uh might have a concern that you're not doing a very good job. Additionally, when you're interviewing people based on the stature or the position of those people, they simply just don't have the time for you to learn how to get organized while you're interviewing them So be very organized as much as you can. Generic knowledge and skills of auditors. So 19011 clause 7. 2. 3. 2. Auditors should have knowledge and skills in the areas outlined below. So audit principles, processes, and methods. That's the first one. So we should understand as auditors How to perform an audit. We should understand concepts of auditing, which we've talked about in other slides, like understanding risk. opportunities, understanding that we're supposed to be truthful and ethical and morally courageous as an audit principle. We should also understand the processes of audits That while an auditee or an audit client may say they have encryption, how are we really going to prove that? We should also understand other concepts around auditing in relation to processes and methods. uh like say possibly sampling or or so on and that that's other sections of uh this course We also have management system standards and other references. So this is a uh ISMS 27001 course. So Understanding 27001. That would be the management system that you need to understand. But this is this particular slide is talking about 1901, clause 7. 2. 3. 2 Which does not specifically say 27,001. So if you're going to audit, say for example, also 9001, make sure you understand it. Make sure you understand all the connecting references In relation to the management system that comes out. So here's an example. You have the ISMS 27001. But let's say you're a European company that you're also heavily involved in the GDPR space. You want to understand GDPR because there is a connection with 27001 in GDPR. So understand these references. The organization and its context. So essentially, in a nutshell, what does the organization do? What is the audity? What is their function? Do they make a product? Do they sell a product? Are they only financial? Are they this? Are they that? So understand the organization in its context. And an easy way of saying that is this is the organization, XYZ Company, and this is what the organization does. So understand as a part of that. You might also want to figure out what what regulatory environments are the organizations or the entity are they beholden to Do they have to uh you know comply with HIPAA or FERPA or GDPR, for example? Understand how big they are. Understand uh the the org chart of the company Understand the companies that they interact with. Try to understand the countries that they're in, and so on. So understand the organization in its context means understand the auditee. You don't have to be perfect at it. You don't have to know in great detail every single thing, but you do have to have the basics. Applicable statutory, regulatory requirements, and other requirements. I kind of touched on that under management system standards and other references. But yes, if if the company or the auditee is in a situation where they have to comply with other regulatory or statutory requirements, try to understand those too. Also understand though That every company is going to be different and not every company is going to have to comply with the same requirements that other companies do. Now it's it's also important to understand When it comes to statutory regulatory requirements or maybe contractual requirements, you don't have to be and you're not expected to be an attorney or a lawyer in order to uh do that portion of general of knowledge and skills. It it is expected that, you know, for example, if you're gonna work uh with a European company that once you get 27,000 women and they're also in a GDPR environment, it's expected that you understand what GDPR is, the basic concepts behind it But you don't have to understand every single article in GDPR in order to perform your skill as an auditor It would not be unreasonable though as a auditee if I was talking to an auditor and I knew I was in a GDPR environment. It would not be unreasonable of me to ask the auditor to have the ability to look up specific articles to make sure that we were good to go as a company. Knowledge of regulatory requirements again continuing. Auditors should have knowledge and understanding of regulatory requirements on the following Intellectual property, so non-disclosures are certainly going to come into there. Content protection and retention of organizational records That's going to vary based on the country and or state you're in. Data protection and privacy. So again, I've referenced GDPR, but there's other uh regulatory environments like uh hippa, FERPA, CAPA, CCPA. Uh the other countries like Brazil has a really uh intense privacy regulatory environment. Regulation of cryptographic controls. So regulation of cryptographic controls is something that uh you definitely want to be aware of. Some cryptography solutions are actually uh They actually fall under government entities uh environments in relation to arms trafficking. So for example, There's this guy named Phil Zimmerman. He's the guy who created PGP, Pretty Good Privacy. That was released outside of the United States. The United States FBI investigated him. Ultimately he was it was fine, he was let go, but um they the US government uh viewed PGP at one time as a uh regulated cryptographic control and it fell under uh ITAR. International trafficking and arms regulation So be aware, especially if you're crossing going from one country to another, be aware of the cryptographic controls. uh in the regulatory environment around that. Some countries literally do not allow high complex encryption because uh well It makes their spy agencies work harder to break in if they have to. But in other countries, they just don't care. Electronic commerce, so like uh uh PayPal and everything else. Um How money is uh transmitted from point A to point B electronically. Uh electronic and digital signatures, those are becoming more and more popular. Workplace surveillance The key thing to remember about workplace surveillance, regardless of the environment that you're in, the one place you absolutely can never have surveillance in would be restrooms, latrines, lavatories. things like that. You cannot record people using the bathroom. But in some other countries, uh the very second you walk through the door, you you could be expected to be surveilled The United States, for example, cameras everywhere. The U United Kingdom, cameras everywhere. And it's expected. You'll see signs that say you have no expectation of privacy. uh things like that in relation to surveillance. The other areas of workplace surveillance that could come into play could be electronic surveillance of basically What people are doing on their computers, what emails they're sending and receiving. That could be a form of surveillance. So understanding the regulatory requirements around workplace surveillance Also goes into what country you're in. Some forms of workplace surveillance in the United States would actually be illegal in the United Kingdom or European Union. Telecommunications interception and monitoring of data like email. In most places, if it's a company email system, You have all sorts of rights to monitor whatever you want and intercept and do whatever you have to in order to protect the company, not for surveillance reasons because you're trying to intrude upon people's privacies. Computer abuse. So what are the hacking laws in the country that you're in? In the United States, we have the Computer Fraud and Abruce Abuse Act. We have the Interstate Commerce and Communications Act. Uh there's all sorts of different things. Different countries have different laws around this. Electronic evidence collections or forensics You know, again, if you're gonna investigate somebody and you don't know how to do that, then uh get a forensics person to do that job for you. And also understand the concept of chain of custody Penetration testing. This is a big one. I'm a hands-on penetration tester in addition to being an auditor. But penetration testing is something that you want to make sure that you are doing legally Uh in some companies or some countries penetration testing is not as strict as other countries In the United States, if you perform penetration testing without a contract that allows you to do it, then it's a felony. You could be arrested for it. And so you don't want to get caught doing unauthorized penetration testing. In some other countries, simply having the ability penetration testing tools on your laptop is could be viewed as a crime. So make sure you understand that. International and national sector specific requirements, for example, banking. uh the SWIFT concept is comes to mind, uh but how uh national and international sector specific uh environments interact with each other. So there banking is an example, but it could be something else.