Conducting an ISO 37301 Audit
Domain 5 tests evidence collection and judgement during the audit itself. You must show that you can interview, observe, sample, follow an audit trail, and write findings that survive challenge.
Conduct rules
- Hold an opening meeting to confirm objectives, scope, criteria, schedule, and communication channels.
- Collect evidence from at least two sources where possible: interview, observation, and records.
- Ask open questions, then probe for specifics; avoid leading or closed questions that manufacture the answer.
- Sample deliberately, record what was sampled, and follow up exceptions rather than ignoring them.
- Keep daily team meetings to compare evidence, adjust the plan, and agree findings.
- Write findings with three parts: criterion, evidence, and the gap.
Worked example
An auditor interviews the compliance officer, who says the risk assessment is current. The auditor reviews the risk register and sees that bribery via intermediaries is rated high, but no due-diligence control exists for agents. The auditor confirms this with a procurement manager and samples agent contracts. The finding cites Clause 8.1: controls are not proportionate to the assessed risk. The reasoning is that the risk assessment exists, but operation does not follow it, so the issue is implementation, not documentation.
Traps
Do not accept 'we always do it' as evidence. Do not sample only the records the auditee offers; ask how the population was defined. Do not introduce a finding at the closing meeting without prior verification. Do not confuse correction (fixing the instance) with corrective action (removing the cause). Do not argue with the auditee; present evidence and criteria.