Conducting the audit: evidence, interviewing, sampling and technique
Objective evidence
Evidence is objective when it is verifiable and traceable to records, observations or statements of fact. Hearsay and unsupported assertion are not objective evidence. Triangulate: a claim made in interview should be corroborated by a record and, where possible, by observation of the activity itself.
Interviewing
Use open questions to open topics ('walk me through how a new starter gets access'), probing questions to follow the thread, and closed questions to confirm. Avoid leading questions that suggest the expected answer. Listen actively, summarise back what you heard, and let the auditee show you artefacts. Talk to the people who actually do the work, not only managers; cross-check that staff awareness matches their role (clause 7.3).
Sampling
Samples may be judgemental (selected on risk, complexity, change or prior findings) or statistical. Whatever the method, be able to explain why the sample is representative, record what was sampled, and be prepared to enlarge the sample when a defect is found - a single lapse may be isolated or systemic, and only further sampling distinguishes them.
Technique
Audit the process end to end rather than the document. Follow the trail: risk assessment entry → SoA justification → control operation → monitoring/metric → management review. 'Show me' beats 'tell me'. Take notes as you go and confirm factual accuracy rather than agreement at the time.
Traps
- Recording an opinion as a finding ('access control is weak' is not evidence).
- Sampling only from cooperative, well-organised areas.
- Accepting a system screenshot without checking the population it came from.
Rule of thumb
For every claim, ask: what record would exist if this were true, and can I see it? If nothing could exist, ask whether the requirement actually demands documented information - not everything must be recorded.