When looking at an audit, you need to define the audit criteria. So in management systems, the audit criteria are really the requirements of the standard against which the auditee wishes to obtain certification. coupled with other requirements that the audit T has determined. So in an ISMS conformity assessment audit, the following audit criteria are used as a reference against which conformity is determined. So, first of all the requirements of ISO 27000 as defined in clauses 4 until 10 And then on top of that, the relevant ISMS requirements that the organization has set for itself. So that can be expressed in processes, procedures, controls, relevant policies, and so forth. So that will be used of course with whatever is being audited. So the audit criteria is really an essential part of the auditor because that is the checkbox or the reference check that the auditor will do to determine the conformity. If a non-conformity is being declared, it is always based on specific audit criteria So sp all any other additional criteria, audit criteria may come out of internal policies that you put, any laws of regulations, contracts that you've put. But mainly clauses 4 and 10 and then every other control that the organization has deemed part of the ISMS. Now when you perform audits in small organizations that sometimes poses a challenge. Um so That also means that um sometimes uh auditors um are used to auditing big organizations, so uh we tend to be used to very sophisticated management system or um very sophisticated record management systems. While in small organizations that is often not the case and it's not even preferable or desirable because it will overc um uh complicate uh things So in small organizations it's also d often the case that one person at the segregation of duties is a little bit more difficult in those small organizations. So it might be that um owners or managers uh control all the decision making processes but also intervene personally from time of time So what we also see happen a lot is that all the or that at least in small organizations the owners or the managers are not fully aware of their responsibilities and those of auditors. So it it it's very important to have that clearly state. Stated before the audit, the only thing that you also need to consider there is that if you're working with an audit team that might pose a challenge because you cannot um yeah you're you're talking to the same people and people cannot duplicate um so you need to take into consideration that um yeah you have a limited set of people you can talk to Documentation can be less sophisticated and of course the manager takes a very uh prominent uh role in that. The certification body will agree in the end on the terms and conditions of the audit. It will be agreed upon in a formalized certification agreement. It's in best interest that both parties sign this to understand or to avoid possible misunderstandings And the certification agreement documents and confirms the acceptance of the audit, also the audit dates, audit objectives, criteria, and scope. So it's a very important um document because it really has that objective uh of the certification agreement that is the clear communication of responsibilities also to the top management How is that usually done? It's usually just a contract like everything else, which states very clearly what will be done. Sometimes I see it also for the three-year cycle, so it's dependent from certification body to certification So, what is included in the certification agreement? The certification agreement generally includes the audit objectives, the audit scope, the audit criteria, but also the responsibilities of the audit stop management, ensuring that they are present when the audit happens. It also stipulates the unrestricted access to information and other resources. It also has usually an agreement concerning the planning and the conduct of the audit and of course the basis of the fees and other types of invoicing, how it is calculated, what is included in audit time, what is not included in audit time. So a certification body should only accept the audit, of course, um if they've also done a check um to the auditee um to check if um the audit has is uh the check of the integrity, the reputation, and those kind of things. You might also think about including Um for example, uh if you have any technical experts that need to attend um the audit, you might also uh think About that, you can also think about reference to other agreements. But usually the certification body has like a template for that where everything is included Now looking at the audit mandate, so there are a couple of steps that need to be undertaken in accepting an audit mandate So first of all, the certification body looks at all information regarding previous annual reports. Of course, you're going to check as a certification body Is the Odity able to pay all their fees? Will it be uh is it a financial strong organization? Secondly, you will ask information about the integrity of the potential Auditee You, if possible, want to check with previous auditors if there are any inconsistencies in audit procedures and you would also check if there would be any violation of um applicable regulatory uh requirements if you would accept uh the audit. So those are uh the things that you uh need to do Now the audite usually contacts the certification body uh themselves because they're looking uh for an auditor. But prior to the initial contact with the Audite, the audit team leader will prepare an engagement letter and send it to the Auditee. So the engagement letter um is basically um a a letter that states hey I'm your uh lead auditor I'll be coming uh to visit you um these are the dates um perhaps he can he or she can ask to have uh um a call to just get acquainted before you um end up on their doorstep on the day of the audit. So that might be uh the thing. So uh the really that initial contact is really to get a better understanding about um the oddity about the customer to understand how um do they want to communicate You want to introduce the team members as well. You want to check that the audit schedule is still okay, that they don't have any wrong dates in their calendar. Potentially you can also ask access to the documented information. Um you also want to check depending how the organization is set up, uh where do you need to park your car, how do I need to access the building, those kind of things. And if there are any observers or any other, for example, auditors in training, if you bring them along You might introduce that as well. So it's really a first contact with the auditee to get acquainted and to inform them about everything that will happen in that audit The audit schedule is of course important both for the audit team as for the audit tee because there need to be people available. So the audit schedule is basically the list of actions that will be done during the audit and link to that uh when it will be happening. So what usually happens I usually uh make an Excel spreadsheet, I divide it in the hours and I tell them um Yeah, what process or what team that I want to talk and which controls or uh clauses I will be discussing about. So um the audit schedule needs to reflect basically the importance of the activities. It's crucial uh to prepare that time uh that schedule based on the time that you have available while of course optimizing the effectiveness and efficiency um of the audit. So to be to have an efficient audit you need to provide the audit schedule uh before you start with uh the audit and before you arrive on the um audit. Usually certification bodies have like internal processes as well that uh state that you need to provide the internal audit schedule or the audit scheduled to the customer six weeks in advance, for example, in order to give the auditee enough time to indicate which resources should be available if people are on holiday that they can be uh backed up by somebody else, but also indicate if something wouldn't be possible so that you still have enough time to change the audit schedule. So again, a pretty um long section. Um so before let me summarize a little bit um before accepting the audit mandate, the auditor receives an offer from the certification body The process of accepting the audit mandate helps in avoiding any misunderstanding that may arise during the audit. An audit offer generally includes the audit objective, the scope, the criteria and the duration of the audit, but also the team members if they're already known and the responsibility of each team member, but also the limits of the audit engagement and the auditors' payment. For each audit, and also in the case of joint audits, the certification body appoints one audit team leader. There can only be one audit team leader who is responsible for conducting the audit until its completion. In management system audits, the audit criteria are comprised of the requirements of the standard against which the Auditee wishes to obtain certification and any other requirements that the Auditee might determine. The certification body and the auditee must agree on the terms and conditions of the audit, and the audit objectives must be defined and the audit scope must be validated before the audit starts.