Preparation of an audit
From programme to plan
Preparation turns the audit programme into a specific audit plan. The programme coordinates audits over time; the plan defines one audit's objectives, scope, criteria, dates, locations, team, resources and expected outputs. Before fieldwork, review the ISMS documentation, previous findings, risk assessment, SoA and relevant legal or contractual requirements. Then design a risk-based sampling approach.
Core rules
- Confirm scope and criteria with the auditee and audit client. Ambiguous criteria produce disputed findings.
- Identify processes, interfaces, sites, shifts and outsourced functions in scope.
- Prepare working documents: audit plan, sampling plan, checklist as an aide-memoire, and forms for findings. A checklist must not replace professional judgement.
- Assess audit risk: complexity, maturity, changes, incidents and previous nonconformities.
- Select competent team members and assign roles. Confirm logistics, security and confidentiality arrangements.
- Hold an opening meeting to confirm the plan and communication channels.
Worked example
You plan a supplier-management audit. The SoA includes A.5.19 to A.5.22. You review the supplier register, contracts, service-level reports and last year's findings. The risk assessment shows two critical cloud suppliers. Your sample includes one critical and one low-risk supplier, not five low-risk suppliers. You plan interviews with the procurement owner and IT service owner, and record checks for contract clauses and monitoring reports. The reasoning: the sample reflects risk, and the criteria are the ISO/IEC 27001 clauses plus Annex A controls, not a generic procurement checklist.
Traps
Do not copy last year's checklist without updating risks and scope. Do not plan to review all documents with no sampling logic. Do not omit the SoA: it links risk treatment to the controls you will test. Do not let the auditee set the scope to exclude a weak area.