Conducting an ISO 28000 Audit
This domain tests how you gather evidence, follow an audit trail and turn evidence into defensible findings while keeping the audit on schedule.
On site
Open with an opening meeting confirming scope, criteria, schedule, reporting method and confidentiality. Collect evidence through three channels - interviews, observation and document review - and triangulate across them. Ask open questions first, then closed ones to confirm. Trace a process end to end rather than checking clauses in isolation, and verify that what is documented is what actually happens.
From evidence to finding
A well-formed nonconformity states the requirement (criterion), the evidence (what was seen, where, when, from whom) and the consequence. A major nonconformity usually means the system cannot achieve its intended outcome in that area or a requirement is not implemented at all; a minor is an isolated lapse.
Worked example
The auditor selects an incident report about a stolen trailer and traces it: was the incident logged; was it assessed against the risk assessment; was the risk assessment updated; were controls changed; was it reported in management review? The log exists, but the risk assessment was last reviewed eleven months earlier and the incident is not referenced. Finding: Clause 10 corrective action and Clause 6 planning are not linked to operational incidents, evidenced by the incident report, the unchanged risk register with its review date, and the management review minutes.
Traps
Leading questions; relying on one interview; writing 'the procedure is not followed' without naming the procedure; disclosing findings to junior staff before the team agrees them; abandoning the plan when the auditee offers a detour; and failing to record limitations in the evidence.