Conducting an ISO/IEC 27001 Audit
Collecting and evaluating evidence
The opening meeting confirms plan, scope, criteria, communication channels and logistics. Evidence comes from three sources used in combination: interviews, observation of activities, and review of documents and records. Ask open questions ('walk me through what happens when…'), avoid leading questions, and triangulate - follow the audit trail from policy to procedure to record to actual practice. Record what you saw: who, what, where, when, and against which criterion.
Findings are evaluated against criteria continuously, not saved for the end. Grade consistently: a major nonconformity typically means a requirement is not addressed, or the system fails systemically; a minor nonconformity is an isolated lapse that does not undermine the ISMS's ability to achieve its objectives. Observations and opportunities for improvement are recorded separately and are not certification-blocking.
Communicate throughout: daily team meetings, progress reports to the lead auditor, immediate notification of critical risks found. Manage the human side - late interviewees, defensive auditees, a guide who monopolises answers.
Traps
- Accepting 'we always do it that way' when the claim can be verified elsewhere.
- Writing a nonconformity that describes the solution rather than the requirement not met.
- Raising one nonconformity per department for a single systemic failure, or bundling unrelated failures together.
- Asking 'do you comply with clause 8.1?' - a question that proves nothing.
Rule of thumb
Write each nonconformity as: requirement (quoted) - evidence (observed, with identifiers) - explanation of the gap. The word 'should' never belongs in a finding.