Stage 2 readiness, competence and a site the client wants to drop
A certification body plans a stage 2 audit of FinBank's IT shared services, which provides 14 services to 9,000 staff from three sites. The audit team has six auditors and 10 audit days. The lead auditor receives the stage 1 report: internal audit covered only the head office site; capacity management records exist for four of the last twelve months; two of the six auditors have never audited cloud services, although six services run on a public cloud; one auditor speaks only English and the key service managers at the Madrid site speak only Spanish. The client insists the Madrid site is 'low risk' and asks that it be sampled out. The audit programme requires all three sites to be considered at initial certification. The stage 2 audit starts in five days.
1. What actions should the lead auditor take before stage 2?
Read the worked answer
Before stage 2 the lead auditor should reconcile the stage 1 evidence with the audit programme. The internal audit gap at two sites is a nonconformity against Clause 9.2 and raises doubt about whether the SMS is ready for certification; the lead auditor should raise it at stage 1 and require correction before stage 2, or at least plan to verify it at stage 2 and consider deferral. The capacity records gap is an objective finding on monitoring. The team needs a cloud-competent auditor or technical expert for the six cloud services; an interpreter is required for Madrid. The lead auditor should revise the audit plan: allocate more time to the two sites with no internal audit coverage and to capacity management, stratify samples, and confirm the Madrid site is audited. Competence and language are not optional; if not resolved, the audit cannot provide reliable conclusions.
2. How should the lead auditor handle the client's request to exclude the Madrid site from the sample?
Read the worked answer
The client does not decide the sample. For initial certification the certification body determines the multi-site sample using risk; the programme requires all three sites to be considered, and the Madrid site delivers services to staff, so it is within scope unless the scope is formally reduced and the certificate limited. Sampling out a site because the client calls it 'low risk' is not acceptable without evidence. The lead auditor should explain the criteria, record the client's request, and include Madrid. If the client refuses access, the CB cannot certify the excluded activity; it may reduce scope but must not imply coverage. The auditor should also consider whether the 'low risk' claim is supported by incident, availability and complaint data, and document the rationale.
3. Could the audit proceed if the cloud competence gap is not filled? Justify your answer.
Read the worked answer
No. Competence is a requirement for audit team members; an auditor who has never audited cloud services cannot reliably evaluate cloud-related controls, and a technical expert must advise rather than audit independently. The options are to add a competent auditor or technical expert, reduce the cloud scope of the audit only if the certification scope is correspondingly reduced (not appropriate here), or postpone. Using an inexperienced auditor with a checklist would produce unreliable evidence and is a risk to the certification decision. The lead auditor should document the gap, escalate to the programme manager and not allow schedule pressure to override competence.