CQI/IRCA ISMS Lead Auditor cheat sheet

ISO/IEC 27001 is a requirements standard for establishing, implementing, maintaining and continually improving an ISMS; certification assesses conformity with its clauses and Annex A.

Core purpose: preserve confidentiality, integrity and availability of information while managing information security risk in a systematic, risk-based way.

Clause structure: 4 Context, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement.

Annex A in ISO/IEC 27001:2022 contains 93 controls in four themes: organizational 37, people 8, physical 14, technological 34.

The Statement of Applicability records applicable controls, justification for inclusion or exclusion and implementation status; it is mandatory documented information.

Benefits cited in the ISO/IEC 27000 family include consistent risk management, demonstrable conformity, stakeholder confidence, legal and regulatory awareness and competitive advantage.

ISO/IEC 27001 certification is issued by an accredited third-party certification body; the standard itself is a requirements specification, not a certificate.

ISO/IEC 27002 provides implementation guidance for Annex A controls and is not certification criteria unless adopted in the audit criteria.

Continual improvement is required by clause 10; the PDCA cycle is a common model, but ISO/IEC 27001:2022 uses the harmonized management system clause structure.

Audit: a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled.

ISO 19011:2018 principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach.

First-party audit is internal; second-party audit is performed by a customer or contracting party; third-party audit is performed by a certification body or regulator.

Audit objective is what the audit is intended to achieve; scope defines boundaries; criteria are the requirements used as reference; evidence is verifiable fact.

An audit programme covers arrangements for a set of audits over time; an audit plan describes activities and arrangements for one specific audit.

The evidence-based approach requires findings and conclusions to be traceable to verifiable objective evidence rather than opinion.

Risk-based auditing allocates more attention and sampling to higher-risk processes, controls, changes and previous problem areas.

Independence requires that auditors do not audit their own work; impartiality is a precondition for credible conclusions.

ISO 19011 provides guidance, not requirements; certification body requirements come from ISO/IEC 17021-1 and ISO/IEC 27006.

Audit scope defines locations, functions, processes, activities and time period; audit criteria define requirements such as ISO/IEC 27001, policies, contracts or legislation.

Documentation review before the audit includes ISMS scope, Statement of Applicability, risk assessment and treatment, internal audit and management review records and previous findings.

A documented audit plan includes objectives, scope, criteria, dates, locations, team roles, sampling approach, schedule and resource needs.

Audit programme design considers process importance, risk, previous audit results, changes and complaints; ISO/IEC 27001 clause 9.2 requires an internal audit programme.

Initial certification audit: Stage 1 reviews readiness and documented information; Stage 2 evaluates implementation and effectiveness.

Stage 1 findings may identify areas of concern; Stage 2 does not proceed if issues prevent an effective audit.

A sampling plan states population, sample size, selection basis and rationale; risk-based sampling increases coverage for high-risk areas.

The opening meeting confirms scope, criteria, schedule, communication channels, confidentiality and safety arrangements.

Changes to the audit plan are communicated to the auditee and team; the plan remains flexible as evidence emerges.

Evidence sources include interviews, observation of activities, document and record review, system outputs, logs and reports.

Open questions gather narrative; probing questions test depth; closed questions confirm facts; leading questions should be avoided.

Sampling selects representative items from a defined population; sample size and rationale are documented and findings relate to the sample examined.

An audit trail links each finding to the criterion, objective evidence, location or process and the auditor's conclusion.

Observation of actual practice is stronger evidence of implementation than policy statements alone; documents are cross-checked against practice.

Interviews are conducted with competent persons; the auditor summarizes and confirms understanding with the interviewee.

Checklists support consistency but must not restrict follow-up on unexpected evidence or risk signals.

Sampling risk is the risk that a sample does not reveal a nonconformity; audit risk also includes evidence-interpretation risk.

Remote or hybrid auditing requires verified communication channels, remote access to records and confirmation of identity and location.

Nonconformity is non-fulfilment of a requirement; it is reported with criterion, evidence, location, classification and auditee acknowledgement.

Major versus minor classification is defined by the certification body's scheme; a systemic failure or high-risk gap is typically major.

An observation or opportunity for improvement is not a nonconformity; it suggests improvement without evidence of requirement failure.

Correction fixes the detected problem; corrective action addresses root cause and its effectiveness is verified.

The audit conclusion states overall conformity and effectiveness against criteria and may recommend certification, continuation or suspension.

The closing meeting presents findings and conclusions, agrees corrective action responsibilities and timelines and records disagreements.

Follow-up verifies corrective action implementation and effectiveness; it may be a desk review or an on-site activity.

A major nonconformity normally prevents certification until correction and corrective action are verified.

Root cause analysis distinguishes immediate cause, systemic cause and management-system cause.

The team leader plans and assigns work, leads team meetings, manages auditee communication, resolves conflicts and ensures delivery of the audit report.

Audit team competence is collective: ISMS knowledge, sector and legal knowledge, audit techniques, communication and language skills.

Technical experts advise but do not audit unless also competent and assigned as auditors; interpreters must not add or omit content.

Independence and conflict-of-interest checks occur before assignment; auditors declare any relationships with the auditee.

Communication with top management covers audit objectives, significant findings and conclusions; confidentiality applies to all information obtained.

Conflict resolution: address at the lowest level promptly; if unresolved, escalate to the audit programme manager or certification body.

Team briefings align sampling, assignments and evidence standards; debriefs reconcile findings before the closing meeting.

Auditor ethics include integrity, fair presentation, due professional care, confidentiality, independence and evidence-based judgement.

Competence evaluation considers education, training, experience, audit performance and continuing professional development.

Clause 4: determine context, interested parties, ISMS scope and processes; clause 5: leadership, policy, roles and responsibilities.

Clause 6: risk assessment, risk treatment, Statement of Applicability, information security objectives and planning of changes.

Clause 7: resources, competence, awareness, communication and documented information; clause 8: operational planning and control and risk assessment at planned intervals.

Clause 9: monitoring and measurement, internal audit and management review; clause 10: nonconformity, corrective action and continual improvement.

Annex A 2022 themes: organizational 37, people 8, physical 14, technological 34; ISO/IEC 27002 gives implementation guidance.

Risk assessment process: establish risk criteria, identify risks, analyse likelihood and consequence, evaluate against criteria and select treatment.

Risk treatment options: modify, retain, avoid and share; selected controls and justifications are recorded in the Statement of Applicability.

Internal audit clause 9.2 requires audit criteria, scope, frequency, methods, auditor objectivity and reporting of results to management.

Management review clause 9.3 requires inputs on ISMS performance, risks, audits, changes and feedback, and outputs decisions on improvement.

ISO/IEC 27000: overview and vocabulary; 27002: control guidance; 27003: implementation guidance; 27004: monitoring and measurement; 27005: risk management.

ISO/IEC 27006 supplements ISO/IEC 17021-1 with requirements for ISMS certification bodies; accreditation is granted by national accreditation bodies.

Certification cycle: initial Stage 1 and Stage 2, surveillance at least annually and recertification before three years.

Risk is the combination of the likelihood of an event and its consequence; residual risk remains after treatment and is accepted by the risk owner.

Legal and regulatory context includes GDPR, NIS2, sector regulators and contractual obligations such as PCI DSS; audit criteria must state which apply.

Privacy extensions: ISO/IEC 27701; cloud controls: ISO/IEC 27017; cloud PII: ISO/IEC 27018.

Certification is evidence of conformity at the time of audit, not a guarantee that no breaches will occur.

Auditors maintain confidentiality and handle personal or sensitive evidence in line with legal and contractual requirements.

Risk acceptance criteria and risk owners are established by the organization; auditors evaluate whether the process meets ISO/IEC 27001 requirements.