Key Ceremony, No Competence
You are the sole auditor for a stage 2 ISO/IEC 27001 audit of a 300-person SaaS provider. The approved audit plan allocates 1.5 days to 'cryptography and key management'. Three working days before the audit, the client's CTO explains that the company has moved to a multi-tenant architecture, uses a hardware security module with bring-your-own-key, and performs its own key ceremony using split-knowledge custodian cards. The supporting documentation runs to 90 pages. Your competence record shows ISMS lead auditor training and 20 ISMS audits, but no formal cryptography or HSM qualification. The CB has no technical expert available on the scheduled dates. The client has a contractual deadline and asks you to 'do your best'. The audit plan is approved and the client has paid.
1. What are your options, and what should you do?
Read the worked answer
Say so first - to the CB and to the client, before the audit begins. Competence is a precondition, not something to discover mid-audit and paper over. Realistic options:
- Reschedule with a technical expert or an auditor who has cryptography and HSM competence. This is the best option if the contract allows it.
- Narrow the scope explicitly: audit what you can genuinely judge - key management policy, HSM access control, logging, role separation, supplier attestations - and record that cryptographic implementation and the key ceremony were not audited. That is honest, but it leaves a gap in a stage 2 ISMS audit.
- Use a remote technical expert for the key-management sessions, with client agreement and a confidentiality undertaking.
'Do your best' is not an option. An auditor who cannot evaluate a key ceremony will accept the CTO's explanation as evidence, which turns the audit into a demonstration of the client's confidence rather than an assessment of control. The deadline and the paid fee are commercial pressure, not technical justification. A postponed audit is recoverable; a certificate built on unfounded assurance is not.
2. If the audit proceeds without an expert, what must the report and the CB's records say, and why is 'we sampled and saw no issue' inadequate?
Read the worked answer
The report must state the limitation and its effect on the conclusion: which areas were audited, which were not, why, and what assurance the audit therefore does not provide. The CB's file must show the competence review and the decision taken by someone with the authority to take it.
'We sampled and saw no issue' is inadequate because sampling only supports a conclusion within the auditor's ability to recognise a problem. Not spotting a weakness in a key ceremony you cannot interpret is absence of evidence, not evidence of control - and the two are routinely confused in audit reports. The certification decision-maker needs to know which conclusions rest on competence and which rest on a limited sample.
If the gap covers a clause the certification depends on, the defensible outcome is a deferral or a documented scope limitation, not an unqualified recommendation. Sending an auditor to look at something they cannot evaluate is not a sampling decision; it is a decision to leave that area unaudited while telling the client otherwise.
3. The CTO offers to brief you for two hours and sign a confidentiality undertaking. Is that sufficient?
Read the worked answer
Not sufficient. A two-hour briefing transfers the client's narrative, not your ability to test it - and the CTO is the person whose controls you are assessing, so his explanation is evidence to be evaluated, not training to be absorbed. Confidentiality undertakings are necessary for handling the HSM documentation and observing a ceremony, but they do not create competence.
The defensible use of the briefing is as orientation ahead of an expert-led session: it tells you what to look at, not what to conclude. Accepting it and proceeding alone would give both the client and the CB a false sense of coverage. If a key-management failure later surfaced, the audit file would show that you knew you lacked competence and continued anyway - which is a due-care problem, not merely a technical one.
The right response is to accept the confidentiality arrangement, use the briefing to prepare, and still insist on an expert or a documented limitation.