Independence, competence and a client who wants to narrow the interviews
Priya is leading a three-day surveillance audit of a payment processor. Her team includes Tom, who configured the client's SIEM 18 months ago as a consultant, and a trainee auditor who is not yet qualified. The client's COO tells Priya that the network contractor 'is not really part of us' and should not be interviewed, and asks her to keep the audit 'light touch' because a major customer is visiting. The audit plan includes cloud configuration review, but no team member has cloud security competence. Tom has already begun interviewing the SIEM administrator alone and has drafted a finding that the client disputes.
1. What are the independence and competence issues, and what would you do before the audit continues?
Read the worked answer
Independence. Tom configured the SIEM 18 months ago. Auditors must not audit their own work, and certification body personnel who have provided consultancy to a client within the defined cooling-off period cannot be used for that client's audit. Even if the exact period must be checked against the certification body's procedures and ISO/IEC 17021-1 requirements, 18 months is recent enough that I would treat this as a conflict. Tom must be removed from the SIEM and related areas, and probably from the team. I would document the decision and the replacement.
Competence. The trainee must be supervised and cannot count as a qualified auditor for audit time or conclusions. No one has cloud competence, so the cloud part of the plan cannot be reliably audited. Options: add a technical expert or qualified auditor with cloud competence, reschedule that part, or reduce the claimed scope - not bluff it. A technical expert advises; the audit team still owns the findings.
Immediate action. Stop Tom's solo interview, preserve his notes as evidence, and reassign the area. Brief the team on roles and confidentiality.
2. How do you handle the COO's request not to interview the contractor and to keep the audit 'light touch'?
Read the worked answer
I would acknowledge the customer visit and explain that the audit plan is risk-based and cannot be reduced to suit a commercial event. I would not accept a blanket exclusion of the contractor without evidence.
I would ask:
- what the contractor can access, and under what contract and monitoring;
- whether the contractor is a supplier within the ISMS scope;
- who at the client manages that supplier relationship.
If the contractor is in scope, I would interview the client's supplier manager and, where possible, the contractor, or review records if access is refused. A refusal is an audit limitation: I would record it, assess whether it prevents me from reaching a conclusion, and may need to report it to the certification decision function. I would also explain that 'light touch' is not a criterion; sampling is based on risk, and I will explain the sample and the reasons for it. I would keep the tone professional and avoid arguing in front of the customer.
3. Tom's disputed draft finding is now on the table. How do you manage the team and the finding?
Read the worked answer
I would take the finding back to the team before any client discussion. I would check:
- the exact requirement and the objective evidence;
- whether the evidence was gathered independently and recorded;
- whether the client's dispute is about fact, interpretation or severity;
- whether Tom's prior consultancy has influenced the conclusion.
If the evidence is sound, I would keep the finding and have the team present it consistently. If it is not, I would withdraw or reword it. I would not let a single auditor negotiate a finding alone with the client, and I would not overrule the team without documented reasoning. I would also coach the trainee on the difference between an observation and a nonconformity, and record the team's decision. The lead auditor owns the final report but must be able to justify it.