Preparing an ISO/IEC 27001 Audit
Sequence of preparation
Preparation begins with audit initiation: confirming objectives, scope and criteria with the audit client, checking feasibility, and agreeing duration, locations and timing. Scope covers organisational units, locations, processes, interfaces and outsourced functions - this is the audit scope, which is not simply a copy of the ISMS scope.
Next, contact the auditee and carry out a document review: policy, risk assessment and treatment, Statement of Applicability, internal audit and management review outputs, previous findings. Reviewing documents is preparation, not evidence collection; it tells you where to look.
Then produce the audit plan: objectives, criteria, scope, dates and locations, team members and work assignments, schedule of activities and meetings, and a risk-based allocation of time. The plan is agreed with the client, communicated to the auditee and revised if circumstances change. Finally prepare work documents: checklists, sampling plans and forms for recording evidence.
Traps
- Mixing up the audit plan with the audit programme.
- Writing a checklist so rigid it prevents following the audit trail.
- Sampling conveniently (the first record in the folder) instead of risk-based and documented.
- Treating a missing document as an automatic major nonconformity before checking whether the process is implemented.
Rule of thumb
Roughly one third of the effort belongs to preparation, and scheduled time should be proportional to risk and process complexity - the highest-risk processes get the most minutes.