ISO 27001 Lead Auditor cheat sheet

ISO/IEC 27000 defines information security as the preservation of confidentiality, integrity and availability (CIA) of information; other properties such as authenticity, accountability, non-repudiation and reliability may also be involved.

Confidentiality = information is not made available or disclosed to unauthorized individuals, entities or processes; integrity = accuracy and completeness; availability = accessible and usable on demand by an authorized entity.

ISO 31000 defines risk as the 'effect of uncertainty on objectives'; information security risk is expressed as a combination of the consequences of an event and its likelihood of occurrence.

Risk assessment comprises risk identification, risk analysis and risk evaluation; risk treatment selects and applies controls, after which residual risk is compared with risk acceptance criteria.

Four generic risk treatment options: avoid the risk, modify/reduce the risk by controls, share or transfer the risk (insurance, outsourcing), or retain the risk by informed decision.

ISO/IEC 27001 follows Plan-Do-Check-Act: Plan = clause 6 (risk assessment, risk treatment, objectives); Do = clauses 7-8 (support and operation); Check = clause 9 (performance evaluation); Act = clause 10 (improvement).

The ISMS is that part of the overall management system used to establish information security policy and objectives and to achieve those objectives through interrelated processes.

Controls are safeguards drawn from organizational, people, physical and technological categories; they are not limited to the reference set listed in ISO/IEC 27001 Annex A.

Risk appetite and risk acceptance criteria are defined by top management; they are the decision rule used to judge whether a residual risk is tolerable.

ISO/IEC 27001 mandates clauses 4-10; Annex A provides 93 reference controls in four themes: organizational (37), people (8), physical (14) and technological (34).

Clause 4: 4.1 issues of external and internal context, 4.2 interested parties and their requirements, 4.3 ISMS scope, 4.4 ISMS and its processes.

Clause 5: 5.1 leadership and commitment, 5.2 information security policy (documented, communicated, available to interested parties), 5.3 roles, responsibilities and authorities.

Clause 6: 6.1.1 general, 6.1.2 risk assessment, 6.1.3 risk treatment and Statement of Applicability, 6.2 objectives and planning to achieve them, 6.3 planning of changes.

The Statement of Applicability (6.1.3 d) must list the controls considered necessary, justify inclusions and exclusions, and record whether each control is implemented.

Clause 7: 7.1 resources, 7.2 competence, 7.3 awareness, 7.4 communication, 7.5 documented information (7.5.2 creating and updating, 7.5.3 control).

Clause 8: 8.1 operational planning and control, 8.2 risk assessment at planned intervals or on significant change, 8.3 implementation of the risk treatment plan.

Clause 9: 9.1 monitoring, measurement, analysis and evaluation; 9.2 internal audit at planned intervals; 9.3 management review with defined inputs and outputs.

Clause 10: 10.1 continual improvement; 10.2 nonconformity and corrective action, including dealing with causes and reviewing effectiveness.

ISO 19011:2018 defines an audit as a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled.

Seven audit principles (ISO 19011:2018): integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach.

Audit criteria = set of policies, procedures or requirements used as a reference; audit evidence = records, statements of fact or other information relevant to the criteria and verifiable.

Audit findings = results of evaluating collected audit evidence against the audit criteria; they show conformity or nonconformity and are recorded in the audit report.

By relationship: first-party (internal), second-party (performed by an interested party such as a customer or supplier), third-party (independent certification body).

By object: system audit, process audit, product audit; combined, joint and integrated audits differ by the number of auditees and the number of standards covered.

Independence: auditors do not audit their own work; internal auditors cannot audit activity for which they are directly responsible.

Risk-based approach: audit activities are planned and prioritized according to the significance of the audited matter and the risks associated with it.

ISO/IEC 27007 provides ISMS-specific auditing guidance for ISO/IEC 27001; ISO/IEC 17021-1 states requirements for bodies providing certification of management systems.

An audit programme covers a set of audits planned for a time frame; an audit plan describes activities and arrangements for one specific audit.

Audit objectives, scope and criteria are defined by the audit client; the scope identifies organizational units, locations, processes, activities and the time period covered.

A review of documented information is completed before on-site activity to check existence of policy, risk assessment and treatment records, Statement of Applicability, internal audit and management review evidence.

A Stage 1 audit is a readiness assessment: documentation, ISMS scope, Statement of Applicability, site-specific conditions, resources, and evidence that internal audit and management review have been performed.

A Stage 2 audit evaluates implementation and effectiveness, including operation of controls, performance against objectives and conformity with all requirements of ISO/IEC 27001.

Auditor competence comprises knowledge of ISO/IEC 27001 and audit principles, information security and sector knowledge, and skills such as interviewing, sampling and reporting (ISO 19011 clause 7).

The audit plan normally includes objectives, scope, criteria, dates and locations, audit team and roles, schedule, methods, and confidentiality and reporting arrangements.

Working documents (checklists, sampling plans, forms) support the audit but do not replace corroboration of evidence and following the audit trail.

Audit time allocation considers ISMS complexity, number of sites and personnel, scope breadth, technology diversity and the significance of identified risks.

Evidence is collected by interviews, observation of activities and conditions, and review of documents and records; findings must rest on verifiable evidence, not opinion.

An audit examines a sample of available information; sampling is weighted by risk, and a nonconformity found in a sample normally requires the sample to be expanded.

Nonconformity = non-fulfilment of a requirement; it is documented with the requirement, the objective evidence and the location or process where it was found.

Major nonconformity: the ISMS is not capable of achieving intended results, a systemic failure exists, or effectiveness is in doubt (e.g. no risk assessment, no internal audit, no management review).

Minor nonconformity: an isolated lapse or single observed departure that does not indicate a systemic breakdown of the management system.

Observations and opportunities for improvement are not nonconformities; they are not a basis for an adverse certification decision.

The opening meeting confirms audit plan, scope, criteria, team, communication channels, availability of evidence, confidentiality and safety arrangements.

Trace samples vertically (from policy or requirement down to records and practice) and horizontally (across processes and functions) to test implementation and consistency.

Objectivity requires confirming interview statements against records; any interference with independence or pressure on the audit team is escalated to the audit client or programme manager.

The closing meeting is chaired by the lead auditor and presents audit conclusions, nonconformities, report distribution, the corrective action process and agreed deadlines.

The audit report records objectives, scope, criteria, dates and sites, audit team, findings, conclusions and identifies the auditee, responsible management and distribution list.

A corrective action request states the nonconformity, the evidence, the requirement not fulfilled and a deadline for the auditee's response.

Corrective action submissions typically distinguish correction (containment), root cause analysis, corrective action taken, and evidence of implementation.

Verification of effectiveness is performed after implementation; a nonconformity is closed only when objective evidence shows the cause has been addressed and the action is effective.

In certification, the certification decision is taken by a competent person of the certification body who is independent of the audit team and may grant, refuse, maintain, suspend or withdraw certification.

Special audits may be triggered by complaints, significant changes or serious incidents, and may lead to suspension or withdrawal of the certificate.

Audit records are retained and handled according to the confidentiality and records-retention arrangements agreed with the audit client.

ISO 19011 clause 5 applies PDCA to the audit programme: establish objectives and processes (Plan), implement (Do), monitor and review (Check), improve (Act).

The programme defines its extent: number, duration, frequency and scope of audits, considering risk, complexity, changes to the organization and previous audit results.

Programme risks and opportunities, resources (auditor time and competence) and the audit methods used are determined when the programme is established.

The programme manager monitors the programme using indicators such as delivery against plan, trends in findings, auditee feedback and auditor performance, and reviews it at defined intervals.

Auditor competence must be maintained through continuing professional development, and auditor performance should be evaluated after audits.

ISO/IEC 17021-1 certification cycle: initial certification (Stage 1 and Stage 2), surveillance audits at least once a calendar year (except in the recertification year), and recertification before the three-year cycle expires.

Records of the programme and of each audit (plans, reports, findings, corrective action evidence, competence and evaluation records) are retained as documented information.