Conducting an ISO 37001 audit
What the domain tests
Conducting questions test fieldwork: opening meetings, interviews, observation, transaction tracing, evidence collection, team communication and formulating findings. The focus is whether evidence is sufficient, relevant and verifiable.
Core techniques
- Hold an opening meeting to confirm scope, criteria, schedule, confidentiality and reporting.
- Use open questions, then probe; avoid leading questions that suggest the desired answer.
- Trace transactions end to end: request, approval, payment, recording and third-party involvement.
- Observe controls in operation and compare practice with the documented procedure.
- Record evidence with source, date and sample reference; keep findings tied to a specific criterion.
- Hold daily team meetings to share risks, adjust sampling and avoid gaps or duplication.
- Communicate serious issues promptly under the audit plan’s escalation rules.
Worked example
An auditor interviews a procurement manager who says all agents are screened. The auditor selects three high-risk agent files and finds one with no due diligence, one with screening done after contract signing, and one with no evidence of approval. The manager’s assertion is not enough; the sample evidence supports a nonconformity in due diligence and contract approval.
Traps
Accepting management assertions without records; sampling only readily available files; auditing only documents and not implementation; asking “You do approve gifts, don’t you?”; and writing findings without the criterion and evidence.