Impartiality, Objectivity and an Unrealistic Surveillance Budget
During planning for the first surveillance audit of Vantage Analytics (90 staff, combined ISO/IEC 27001 and ISO/IEC 27701 certification), the certification body assigns Ms Okafor as lead auditor. Fourteen months earlier she had been contracted to perform the gap analysis and draft the PIMS risk assessment and Statement of Applicability. The CB argues she is the only auditor in the region with ISO/IEC 27701 competence and proposes that a colleague audit the risk assessment while she audits everything else. Separately, the internal audit of the PIMS was performed by the DPO, who also owns the PIA process and the records of processing. The audit programme allocates 1.5 days to the surveillance audit; the initial Stage 2 took 8 days.
1. Evaluate the impartiality threat posed by Ms Okafor's assignment. What must the certification body do, and does the proposed workaround cure the threat?
Read the worked answer
Threat She produced the gap analysis, the PIMS risk assessment and the Statement of Applicability. Those artefacts are the spine of the management system: every subsequent control selection, audit trail and management review decision rests on them. An auditor cannot objectively evaluate work she authored. The threat is self-review, compounded by familiarity and by the commercial interest in defending her own design.
Requirement Certification body personnel who have provided consultancy to a client - including preparing documentation or performing gap analyses - shall not be used to audit that client until a defined cooling-off period (two years under ISO/IEC 17021-1) has elapsed. This is a hard rule, not a matter for judgement.
The workaround fails Carving out the risk assessment does not help. The risk assessment feeds control selection, the SoA, internal audit scope and management review; auditing "everything else" still means auditing her own design decisions. It also creates a visible independence problem for interested parties.
What must happen The CB must record the impartiality analysis, assign a different team, and if it lacks regional competence, source an auditor or technical expert with ISO/IEC 27701 competence from elsewhere, or defer the surveillance. Lack of competence is a management problem for the CB, never a justification for accepting an independence breach. If the CB proceeds, escalate within the CB and consider whether the certification decision itself is defensible.
2. Is the internal audit arrangement acceptable? Cite what ISO/IEC 27701 and ISO/IEC 27001 require and state your conclusion.
Read the worked answer
Requirement The ISMS internal audit clause applies to the PIMS through ISO/IEC 27701, and requires audits at planned intervals and, critically, that auditors be objective and impartial. Objectivity means not auditing your own work.
Analysis The DPO owns the PIA process and the records of processing, and audited them. That is self-review. Two further points to test:
- Was anyone else in the team independent of the processes audited, or did the DPO audit all of them?
- Did the internal auditor have demonstrated privacy competence, or was this an IT auditor running a checklist?
Conclusion Nonconformity. If this is the only internal audit performed and the whole PIMS audit was self-reviewed, treat it as major, because the management system has no functioning independent check. If only the privacy portions were self-audited and the remainder was objective, a minor is defensible.
Acceptable remedies to test in corrective action Reassign to another competent auditor, use peer/cross-audit with a different function, or engage an external resource; update the competence criteria and the audit programme so the conflict is designed out rather than corrected each cycle.
3. What should the lead auditor do about the 1.5-day allocation for a combined surveillance audit that follows an 8-day Stage 2?
Read the worked answer
Duration is determined by the client's effective size, complexity, sites, the number and nature of PII processing activities, the controller/processor roles, and the scope - not by the label "surveillance". A surveillance audit still has to cover the internal audit, management review, corrective actions from the previous audit, complaints, changes, and a representative sample of the PIMS and Annex A/B controls.
Actions, in order
- Recalculate the required duration using the applicable certification body rules and IAF mandatory documents, and document the calculation.
- Raise it with the CB's resource planner before the audit starts, not in the report. Reductions require documented justification; 1.5 days against an 8-day initial audit has none.
- If the CB will not adjust it, record the constraint in the audit plan and report, and consider whether the audit can meet its objectives. Where it clearly cannot, escalate - an under-resourced audit that produces a positive conclusion undermines the certification.
Programme-level point Plan surveillance as a cycle: sample different clauses and sites across the three-year period so the whole PIMS is covered, and use the previous audit's findings to drive where the time goes. Fitting the whole sample into 1.5 days guarantees a shallow audit and a weak certification decision.