So one of these things we need to think about in an audit when we're communicating is what we're we call cultural awareness. Now when you first hear that title you might think of uh you know audits which might be multinational you're working in different countries and territories and that's certainly relevant, but even in working in different industries potentially there can be what we call cultural aspects And what we want to make sure of is that we avoid during an audit any misunderstandings or any particular issues. So it is a good idea for auditors if they're going into a different environment to sort of familiarize themselves with that culture. So putting international stuff to one side, just as a simple example, I went in my previous career from working in a financial organization at one point which had a very you know specific as I say working culture to doing some work for a construction company very very different kind of environment with you know different norms and uh different sort of behaviors almost. And of course indeed if you are doing an audit that might um where you might be liaising with people from different parts of the world there may be you know diff different um cultural things in terms of how to be polite or how to behave and so forth. And my job here isn't to teach you about all the different world cultures and how to adapt to them But it's in put two things are particularly important. One is whatever your particular view or perspective that as auditors we have to mean absolutely Absolutely unbiased in the end an audit is a fact-based exercise. So whatever the work culture, whatever your uh feelings are about that, ultimately we're still looking for evidence and facts. And the second thing is when we're thinking about language, especially if we are working in places where you know the people we speak speaking to are you know dealing with us in their second or non-native language, then we've got to be very careful again again about how we explain things to come across clearly to make sure that we're interpreting things correctly that we're getting back as well. So it's just about being prepared a little bit before you engage. And there is some practical advice on the cultural aspects. Usually when a certification body looks to do an audit, particularly one that might be multinational, then this should be looked at in what we call the feasibility study. So the feasibility study will look at the potential problems, the potential uh issues depending on the environment. So that should be sort of thought about in advance. So none of these things should be a surprise by the time we come to conduct the audit. And therefore, of course, it might sound like common sense, but often a certification body will of course try and select an auditor that's familiar with local language or customs and perhaps have a local auditor. And maybe a good example I can give of that. So I work as what we call a co-auditor, so not a lead auditor for a particular organisation. So this organisation is headquartered in the US It has a UK operation and an operation in India. And in this case, what happens is the lead auditor is based in the US because that's where the headquarters of this organization are is. I'm involved to look at the UK division and then there's a local auditor in India who looks at the the division there. And that's quite a deliberate strategic decision, of course, both from a cost point of view, less travel, but also from that familiarity point of view. Not all of us are operating places Where we're quite familiar with the local language, the customs, and it just makes the whole process a lot more smooth if that's possible. Um now, of course, that's not always possible, and if you are in an environment where you're uh you know in a different culture, a different place. Of course it's a good idea for the auditor to try and adapt, you know, learn about that culture, as long as it's not in any way whatsoever interfering with your objective. and your ultimate audit conclusions. And whilst this comment I'm about to make probably comes across as common sense, you know, avoiding as much as you can discussions about topics like religion and politics is highly advisable. Those two topics of course are very easy ways of causing potential divisions. So we always try and steer clear of those at all costs Now one particular important aspect of communication in an audit is dealing with top management. So we've already identified that in the standard there's a number of requirements for top management management to do various things. So this means at some point in the audit you as an auditor are going to engage with top management. Now before we talk about engaging with top management The fact of the matter is there are many different types of senior management and leaders in organization. And the psychologist Kurt Lewin refers to three of them here. Just to mention those, so you get some kind of leaders in organizations who you might call the autocratic leaders. So that is to say uh a leader that pretty much makes the decisions, is very authoritative, is very clearly in charge, you know, you you you're either with that leader or you're not kind of a leadership style. You have those who are much more laid back or at least say the laissez-faire approach where they will kind of uh take a less uh direct role and sort of trust their employees if you like to um you know deliver good value and so forth and those that you might call visionary leaders or democratic leaders those who will still lead but look to bring people with them on the journey a great example remember of that long time ago when I worked with a a bank and we had a new manager come into this particular bank and he sort of set forth his vision about the the future but he was really quite um inspiring if you like and he he would be a prime example in my book of one those democratic leaders. Now you might be wondering why are we talking about this in a lead auditor course? And the answer to that is I'm not here to teach you management styles. Ultimately, in real life, you learn these by working with people in these positions. You get to see the different styles and attitudes. But the point is the more familiar you are with the way in which different senior management operate, the easier it becomes as an auditor to be able to sort of interact and communicate with them. Those senior leaders. So let's think about an actual audit where you would be interviewing top management. We'll get into what you're going to interview them about in just a moment, but first of all, there are some basic principles. We are going to spend time with top management in order to validate commitment. Ultimately, we look at clause five. That's what talks about leadership. and commitment. We're going to see whether top management are fulfilling their various responsibilities according to ISO 27001. Now we use this term that the auditors should use use appropriate business language. What we mean by appropriate business language is phrasing questions and interacting with top management in a manner that they can understand. So I'm not going to go into an interview with top management and start quoting clauses from the standard or using your technical jargon. I'm going to make sure I frame the questions in the right way. And I'll get into some good questions to ask of top management in just a second. But there are a few things to say before I do that When you interact with top management, you might have a limited time frame to do so because top management often are very busy. And the other thing is the credibility of the audit essentially depends on your impression. There's often a saying that you can basically blow credibility very quickly. People make judgments very quickly about uh uh individuals. So what does this mean? If I want to come across as credible, to have a good interaction, I've got to be as prepared as possible. Being prepared in terms of being clear about the kind of questions I want to ask kind of things I want to focus on. Being prepared in terms of understanding things about the organization structure, maybe doing a bit of research about the organization so you know you come across again as credibly in that meeting. Using as we've just said a moment appropriate language. So for example, let's say I want to ask about or gauge whether the top management understand risk. So rather than talking technical risk language, I could just say, so in general in your position, what do you see as the most significant security risk or what what gives you the most cause for concern. Or let's say I was interested in gauging whether they understood objectives, I could say, what value do you think having this management system brings to your business? How is it helping you fulfill your business objective? objectives. There's very straightforward questions like that tied to their objectives and what they're aiming to do. Now where we say keeping a professional distance, what we mean by that is not that we need to be robots or run-friendly, but remember that this is an audit and therefore you know we've just got to be professional. We've got to make sure top management are aware of the amount of time that we need need. Now that should be factored into the audit plan so it shouldn't be a surprise but usually when I start the discussion you know I'll kind of say according to our schedule we've got 30 minutes here these are the things I'll like to cover does that work for you because you know top management are very busy people they won't be too happy with you if you kind of keep them there beyond the time slot um you know so you don't want to do that. And it is a good idea to summarize and confirm the answers. So in other words, let's say your top management have told you about their strategic objectives of Okay, so if I understand you correctly, the key issues of concern are A, B, C, and D. And the reason I want to do that is I don't want to misquote anybody. There'd be nothing worse than reporting back and then especially top management level people Saying, well, that's not what I meant, or you've misunderstood me. I'd rather clarify that during the meeting. So what are the main topics that you're going to discuss with top management in such a meeting. And we've got sort of eight points that are mentioned here. But again, I wouldn't ask them necessarily in this order or use the language that's here. I'd ask various questions around it. So if we talk about leadership and commitment, rather than saying, please can you tell me how you're committed to an ISMS, I might say, can you tell me a little bit about your role in supporting the ISMS? of things do you do? How do you support those people who are running the ISMS? You could ask, you know If the organization needs to fund its security efforts, can you tell me a little bit about how that works? Does that need to come to you? Do you have any oversight on things like spending or investment, for example If we're talking about objectives, point number two, rather than saying tell me what your security objectives are, what I would say is so as I understand it, you've got the following business objective objectives, how does these how does the information security management system help you fulfill those objectives? I wouldn't ask them directly about how they fulfill their requirements under 27001 because they might not know, but I could go on to ask, well what involvement do they have in the security strategy? Do they take part in things like management reviews? What sort of decisions would need to come to them for sign-off? How do they, one of the big questions I like to ask is, so how do you, in your position, have an assurance That the right security controls and processes are in place. You know, do you get briefed on that? Do you have any information? Um, you know, uh, and those kind of things. Uh, you could ask them about roles and responsibilities, so you could say, okay. So who do you see as being responsible for security in your organization? So those kind of areas, if we cover those off well, and we ask the right kind of questions, you can soon gauge in a meeting like this whether there is real sort of top management commitment and buy-in. Now in the end, depending on the the attitude and views of senior management you might get better quality or less quality answers depending on who you talk to but in the end what I'm looking for can I see that top management are providing adequate resources are supporting policy and are taking part in things like management reviews and risk reviews. I'm not testing top management security expertise or technical knowledge It's much more about their buy-in and involvement and are they providing the right sort of tone and direction? And that's what we hope to gain from that kind of meeting. So in summary then, what we've talked about is basically verbal communication in an audit. What we've said is that for any audit we will prepare properly, we will ensure we do our research so that we come up across as professional at all times. We'll always follow the idea of being open and transparent with communication, that in the event of conflicts, whilst not intervening in conflicts, we'll do our best to manage those situations. Obviously report concerns if we have them, remember the principle of fair presentation. We'll always take the effort to understand the culture of the organisation to avoid any misunderstandings make sure we're using language that is non-technical, appropriate for the audience, again so we have a good experience. What we want to make sure of is both us as auditors and the auditees have a positive experience and that what we can extract from these interactions is information to make fair, you know, unbiased judgments on the conformity with ISO 27001