Two days, 35,000 credentials and a request to work remotely
You are the lead auditor for a two-day internal audit of physical security, HR security and access control at a 600-bed hospital. The previous audit, 16 months ago, raised three findings: 9 of 40 leavers retained active accounts; visitor badges were not returned; and a server room door was propped open. The audit is scheduled in 3 weeks. You have 1.5 auditor-days of on-site time, 0.5 day remote, and one technical auditor. The hospital has 4,800 staff, 900 volunteers, 12 entrances, and a badge system with 35,000 active credentials. The HR director offers a 30-minute interview and a spreadsheet extract of leavers; facilities offers a walkthrough of 2 of 12 entrances. The CIO asks you to 'do the leaver testing remotely because the VPN logs are easier' and to send the audit plan one day before the opening meeting.
1. Prepare the audit plan. Include scope, criteria, sampling approach, allocation of the 1.5 on-site days and the evidence you will require before the opening meeting.
Read the worked answer
Scope: leaver and mover access, visitor management, and physical access to restricted areas including the server room, across the main site. Criteria: the organisation's access control policy, HR joiner/mover/leaver procedure, visitor policy, and ISO/IEC 27001 Annex A access control and physical security requirements. Exclusions must be stated, for example other hospital sites, with reasons.
Sampling: from the 16-month leaver population, select 40 leavers stratified by department, staff versus volunteer, and exit type, deliberately including any cases already known from incident reports. For each, compare HR exit date, identity system disable date, VPN last logon and badge deactivation. From 35,000 active credentials, select all credentials belonging to known leavers and a random sample of 30 active accounts for owner validation; test 20 visitor records for badge return. For physical security, select entrances by risk, not convenience: main staff entrance, emergency exit near the server room and the server room itself; observe badge tailgating at shift change.
On-site time: 0.5 day for opening meeting and interviews with HR, facilities and IT; 0.5 day for walkthroughs and observation; 0.5 day for evidence testing and closing meeting. Remote time: observe live queries and collect system-generated extracts. Before the opening meeting I need the leaver extract, access policy, visitor procedure, badge system report and server room access list. Sending the plan one day before is too late for the auditee to prepare evidence and undermines the opening meeting; I would issue it at least five working days ahead.
2. How would you respond to the CIO's request to test leavers remotely, and what would you do if the HR interview is reduced to 30 minutes or the facilities walkthrough is limited to two entrances?
Read the worked answer
I would agree to remote testing only where the evidence is system-generated and can be observed live. VPN and identity logs can be extracted remotely with screen sharing, but I need to see the query run, confirm the population and date range, and retain the extract in the working papers. I would not accept screenshots alone. Physical controls cannot be audited remotely: badge readers, tailgating, visitor badge return and the server room door require observation. The previous finding about the propped door makes on-site observation essential, so the 1.5 on-site days stay allocated to physical testing and interviews.
If the HR interview is cut to 30 minutes, I would prioritise the leaver process, ask for the procedure and system reports in advance, and conduct a short follow-up remotely. If only two entrances can be walked, I would select them by risk, document the limitation, and state in the report that the remaining ten entrances were not observed. I would not generalise a conclusion about all entrances from two. A scope limitation is reported as a limitation, not as conformity.