Three Sites, Ten Days, and a Client Who Wants Two Hours
Cygnus Health runs a 24/7 patient-booking platform from a Frankfurt data centre, a development office in Kraków (180 of 900 staff), and a support office in Manila. You are planning the Stage 2 certification audit. The certification body allocated 10 audit days for two auditors based on 900 staff. The Stage 1 report notes that: Kraków developers deploy code directly into production; Manila handles all first-line incident response; the risk assessment covers only the Frankfurt data centre; and internal audit has never covered Kraków. The client asks you to audit Frankfurt on site and "do the other sites remotely, two hours each, to save cost", pointing out that Kraków is "just developers, no customer data".
1. How do you settle scope, site coverage and audit duration, and what do you tell the client?
Read the worked answer
The scope of an ISMS must reflect actual interfaces and dependencies. A site is not peripheral merely because it holds no customer data: Kraków changes production code and Manila determines how incidents are handled. Both are inside the risk surface of the in-scope service, and "no customer data" describes the site, not the effect of its activities.
Site sampling is not available here. Multisite sampling presupposes similar activities performed under a central function that demonstrably controls them. Development and first-line support are not similar to data-centre operations, so all three sites must be covered by evidence.
On method: remote techniques are legitimate where they yield sufficient, verifiable evidence - interviews, document and log review, screen-sharing walkthroughs. Observing a production deployment, or judging the working environment and separation of duties, is materially weaker remotely. I would accept remote coverage for defined parts of Manila, and require on-site coverage where change management is actually performed.
If coverage of three non-homogeneous sites cannot be achieved in the allocated days, I request an increase in audit time rather than quietly shrink what I look at. The duration adjustment and its justification are recorded.
2. What do the two Stage 1 observations about the risk assessment and internal audit mean for your Stage 2 plan?
Read the worked answer
They become planned focus areas, not passing remarks.
- Risk assessment covering only Frankfurt: if the ISMS scope includes development and support, the risk assessment must cover the risks those activities create - unauthorised or defective changes to production, exposure through support access to patient data. A risk assessment blind to the processes delivering the service is a 6.1.2/4.3 issue. In Stage 2 I would trace whether Kraków and Manila activities appear in the risk register and in the SoA, and take a sample of risks to test ownership and treatment.
- Internal audit never covering Kraków: the audit programme must reflect the importance of processes (9.2). Never auditing the unit that writes production code is a prioritisation failure. I would test the programme, the criteria, and the previous audit results, and I would not accept "it is scheduled for next year" as satisfying the requirement for the period under review.
There is also a readiness decision to make. If Stage 1 shows the risk assessment and internal audit are incomplete for material parts of scope, the correct answer may be to postpone Stage 2 rather than to audit around the gap.
3. The client repeats the cost argument and asks you to confirm 10 days will be enough. How do you respond, and what do you document?
Read the worked answer
The answer is that audit duration follows evidence needs, not budget. I would be direct but non-negotiable: the plan must allow coverage of the significant processes at all three sites, and if that takes more than 10 days, the plan changes and so does the price. A cheaper audit that samples nothing meaningful produces a certificate that misrepresents the system - a commercial and professional risk for the certification body, not just a technical one.
What I document:
- Site and process coverage per day, with the rationale for each site's inclusion.
- Where remote methods are used, which processes and why the method is sufficient.
- Justification for any change to calculated duration.
- Sampling approach for records, changes, incidents and suppliers.
I also put the client's request and my response in writing to the certification body's programme manager. If the client insists, that is a commercial decision for the CB's management - but it is a decision to reduce coverage, and the record must say so.