A helpful guide, a suspected systemic gap and a propped door
You are auditing the incident management process of a 300-person SaaS provider against ISO/IEC 27001. The audit plan allows 90 minutes for the process, and you have 30 minutes left when you find that three of the eight sampled P1 incidents (INC-1042, INC-1077 and INC-1103) have no post-incident review record, although the procedure requires one within five working days. The IT operations manager, acting as your guide, answers each question before the service desk engineer can speak, saying 'we always do the lessons-learned verbally in the stand-up, the tool just doesn't capture it'. He then offers to 'pull a few examples' from his own notes. On the way to the meeting room you noticed the server room door propped open and unattended - physical security is not in this cycle's audit plan. Your next interview, with the change manager, starts in 25 minutes and the closing meeting is at 16:00.
1. How should you manage the guide and the interview to obtain reliable evidence, and what would you accept as evidence that the post-incident reviews happen?
Read the worked answer
The guide's role is to facilitate - arrange access, identify people, produce documents - not to answer on the auditee's behalf. Take control politely: 'I'd like to hear it from the engineer first; you can add context afterwards.' Use open questions ('walk me through what happens after a P1 is closed'), then probe, then confirm. If guide and engineer disagree, interview them separately and record the difference.
On 'verbal lessons learned': the criterion is the organisation's own procedure, which requires a review within five working days. Verbal discussion can be evidence of activity only if it is traceable. Acceptable: dated stand-up notes or chat threads naming the incident and the agreed actions; an action tracker entry with owner and due date; contemporaneous notes made at the time. Not acceptable: notes reconstructed after you raised the question (check timestamps) or a general assurance that 'we always do it'.
Ask for the evidence there and then, take copies, and record in the work documents what was and was not available. If the reviews genuinely happen but are not recorded, that is still a nonconformity against the procedure's record requirement - conformity and effectiveness are different questions and the report should be explicit about which one fails.
2. Should you extend the sample of P1 incidents? Explain how you decide, and how you would record the sampling in the work documents.
Read the worked answer
Extend it. A 37.5% deviation rate in a sample of eight is unlikely to be random, and the question is no longer 'did three tickets miss a review' but 'is the review process operating at all'.
How to decide: first define the population - all P1 incidents in the audit period, say 46. Then select additional items using a mix of random selection and targeted selection: most recent incidents, other support teams, incidents handled out of hours. ISO 19011:2018 clause 7.5.1 expects sample size and selection to reflect the confidence needed and the risk of the process; a suspected systemic failure justifies a larger sample and a documented method.
How to record it: population size, sample size, selection method, items selected and results, in the work documents. That trail is what allows the finding to be defended later.
If the extended sample shows a similar rate, the finding is systemic and graded accordingly under the programme's rules. If time runs out, stop and state the coverage honestly - 'sample extended to 20 of 46, seven without review' is defensible; extrapolating from eight is not.
3. What do you do about the propped server room door and the remaining 25 minutes before the next interview?
Read the worked answer
Out of scope does not mean out of mind, but it does change what you are entitled to conclude.
- Record it factually in the work documents: date, time, location, what was seen, who was present. That is a note, not a finding.
- Tell the guide or the responsible manager immediately. Due professional care means not walking past a live security exposure; letting them act is not the same as auditing the area.
- Report it as an observation, and feed physical security into the risk assessment for the next programme cycle. Turning it into a nonconformity would be unjustified - you have one passing observation and no criteria tested. A scope change now would need the audit client's agreement and a revised plan, which 25 minutes does not permit.
Time management: prioritise the incident process, which is squarely in scope and where the evidence gap is material. Ask the change manager for a short extension or agree a follow-up call, and inform the team leader. Anything left uncovered must be stated at the closing meeting and recorded as a limitation in the report - the report must never imply coverage that did not happen.