The Internal Auditor Who Used to Run the Helpdesk
During an internal audit of the access-management process at a 180-person software company, the auditor - who managed the IT helpdesk she is now auditing until four months ago - interviews two service-desk agents. She pulls 15 of the 2,400 quarterly access-review records, all from Q1, and finds 3 in which the reviewer and the approver are the same individual. The access-review procedure requires "independent review by a person other than the account holder's line manager". She also notices agents leaving screens unlocked when they walk away, which she considers poor practice although no policy, procedure or legal requirement addresses it. Her draft report raises one major nonconformity for the three records, one minor nonconformity for the unlocked screens, and concludes that access management is "partially effective".
1. Critique the sampling and the evidence, and state what the auditor must do before finalising the finding.
Read the worked answer
Three problems:
- Representativeness. 15 records from a single quarter out of 2,400, with no stated selection method, cannot support a conclusion about the process. A sample must be justified (random, risk-based, or targeted) and large enough to say something. The audit conclusion is bounded by the sample - that limitation belongs in the report.
- Criterion mismatch. The procedure requires review by someone other than the account holder's line manager. "Reviewer = approver" may breach the independence intent, or may breach different wording entirely. Before writing anything she must quote the exact requirement that failed, otherwise the auditee cannot respond.
- Error rate. 3 of 15 is 20%. That is a signal of a possible systemic failure, not an isolated lapse. She should expand the sample across quarters and teams, check whether the three cases share a team, system or template, and test any compensating control.
She should also drop "partially effective": conformity audits conclude on conformity with criteria, with the basis stated. Degrees of effectiveness belong to the auditee's own performance evaluation, or to a maturity model, not to a conformity statement.
2. How should the unlocked-screen observation and the auditor's own history be handled?
Read the worked answer
Unlocked screens: there is no criterion. Audit criteria are the set of requirements used as a reference - policies, procedures, the standard, contracts, legislation. An auditor's personal sense of good practice is not a criterion, so this cannot be a nonconformity, major or minor. It can be recorded as an opportunity for improvement or a recommendation to the risk owner, clearly labelled as outside the audit criteria.
Independence: she managed the very helpdesk she is auditing, four months ago. That is a self-review threat: her former team's practices, her own prior decisions on staffing and templates, and possibly the procedures she wrote are all inside the sample. Even with goodwill, objectivity is compromised and auditees will perceive it.
Actions: the audit programme manager should reassign the audit, or at least remove the access-management area from her scope. The finding itself may stand if another auditor verifies the same records - but it must be re-evidenced by someone independent. This is a programme-level lesson: competence is not enough, assignment must protect objectivity.
3. The auditor wants a rule for when a finding is major and when it is minor. What is the correct answer, and how would you classify the three records?
Read the worked answer
There is no universal definition in ISO 19011 or ISO/IEC 27001. Major/minor grading is defined by the audit programme or, for certification, by the certification body's procedures. The auditor must therefore work from the applicable grading rule, not from intuition.
Typical grading logic, which she should apply explicitly:
- Major: the requirement is not fulfilled, the failure is systemic or affects a process's ability to deliver its intended outcome, and no effective compensating control exists.
- Minor: an isolated lapse, or a single requirement missed, that does not by itself defeat the process and where the organization can show it detects and corrects such lapses.
For the three records: on a 20% error rate from a small single-quarter sample, the defensible step is to expand the sample. If the pattern holds across quarters and teams, the control is not operating and the grading is major. If the three cases trace to one team's misreading of the procedure while other teams are correct, a minor grading with an accompanying observation is more defensible. Either way she must record the reasoning, because the classification is a judgement that will be challenged.