A surveillance audit with too little time and a late cloud change
You manage the audit programme for Meridian Financial, certified for three years. The programme provides a stage 1, stage 2 and two surveillance audits, with recertification in month 36. The current surveillance audit is planned for two days with one auditor. The scope covers head office, a primary data centre and a disaster recovery site; the programme has sampled head office each time and visited the data centre once. Meridian has just added a new cloud payment service, two weeks before the audit, and the risk assessment has not been updated. Its last internal audit was 16 months ago and covered only clauses 4–6. Management review last met 14 months ago.
1. Assess the adequacy of the audit programme and identify what you would change before the audit.
Read the worked answer
The programme is not clearly risk-based. Three years with only one data centre visit and no disaster recovery visit may be inadequate if the sites are materially different or if the DR capability is critical to the service. Sampling must be justified, not habitual; if the organisation claims multi-site certification, the applicable multi-site rules and eligibility criteria need to be checked, and if they are not met, each site needs coverage.
I would review:
- the audit time against the applicable duration guidance and the scope, including the new cloud service;
- the competence mix needed for cloud and DR;
- whether the internal audit and management review gaps undermine reliance on the ISMS;
- whether the new service changes the risk profile enough to require a special audit or additional time.
Two days with one auditor for this scope looks insufficient. I would request more time or a second auditor, or formally reduce the audit scope with a clear rationale. I would not simply compress the sample.
2. The client says the cloud service is 'just a pilot' and asks you to leave it out. How do you plan the audit?
Read the worked answer
A pilot that processes payment data is in scope if it falls within the certified scope. I would ask for the service description, data flows, contract, risk assessment and go-live decision. If the risk assessment has not been updated, that is a potential nonconformity against clause 6.1.2 and the change-management expectations of the ISMS, not something to defer because the service is new.
I would include in the plan:
- interviews with the service owner and supplier manager;
- review of access control, logging, encryption and supplier monitoring for the cloud service;
- confirmation of whether the service is inside the scope statement and SoA;
- sampling of live accounts and data flows.
If the client insists on exclusion, I would record the limitation and assess whether the certificate scope is still accurate. I would explain the rationale to the client in writing before the audit, so the plan is not a surprise.
3. What do the overdue internal audit and management review mean for your conclusions?
Read the worked answer
Clause 9.2 requires internal audits at planned intervals, and clause 9.3 requires management review at planned intervals. The question is not simply lateness but whether the ISMS is being monitored and improved effectively.
I would check:
- the audit programme and whether the 16-month gap was planned and justified;
- whether the internal audit covered the full scope over time, not just clauses 4–6;
- whether management review considered security performance, risks, incidents and audit results;
- whether top management was aware of the gaps.
A single late review might be a minor nonconformity if rescheduled and effective. A 16-month internal audit gap that omits most of the ISMS suggests the monitoring process is not effective and could be a major nonconformity, because the certification body's confidence in the system's self-checking is reduced. I would record the evidence and let the severity follow the effect, not the calendar alone.