Quality Review of Audit Documentation (ISO/IEC 27001 Lead Auditor)
Introduction
The quality review of audit documentation is the step that confirms the audit record is accurate, complete, consistent, objective and traceable before an audit report is issued or a certification decision is made. In an ISO/IEC 27001 audit, documentation includes:
• The audit plan and checklists (work documents)
• Evidence records, interview notes and sampling records
• Nonconformity reports
• The audit conclusion and the audit report
Quality review makes sure all of this forms a defensible and reliable basis for the audit conclusion. For the Lead Auditor exam, you need to understand the purpose of the review, who does it, what it checks, when it happens and how it supports the certification body's impartiality and competence.
Why Quality Review of Audit Documentation Is Important
1. Credibility of certification: A certificate is only as trustworthy as the evidence behind it. ISO/IEC 17021-1 requires certification bodies to make decisions based on adequate, verified information. Poor documentation undermines confidence in the certificate and in accredited certification as a whole.
2. Evidence-based approach: ISO 19011 names the evidence-based approach as a principle of auditing. Conclusions must be verifiable. Quality review checks that every finding traces to objective evidence.
3. Independence of the certification decision: Under ISO/IEC 17021-1, the certification decision must be made by competent people who were not part of the audit team. They rely mainly on the audit documentation. If the file is incomplete or unclear, they cannot decide properly.
4. Consistency and fairness: Review ensures nonconformities are graded consistently (major vs. minor) and worded the same way across auditors and clients. This protects the auditee from unfair findings.
5. Risk management and liability: Clear, accurate records protect the certification body and auditors in appeals, complaints or accreditation assessments.
6. Continual improvement of the audit programme: Reviewing documentation reveals weaknesses in auditor competence, checklists, sampling or time allocation. This feeds back into the audit programme and auditor evaluation.
7. Confidentiality and information security: In ISMS audits, records often contain sensitive information. Review checks that records are handled, stored and labelled correctly and that confidential details are not exposed unnecessarily.
What Quality Review of Audit Documentation Is
It is a systematic check of all audit records to verify that they:
• Meet the requirements of the audit criteria (ISO/IEC 27001, the auditee's ISMS documentation, legal and contractual requirements)
• Meet the certification body's procedures
• Support the audit objectives, scope and conclusions
It takes place at two levels:
• Within the audit team: The audit team leader reviews team members' work documents, findings and nonconformity statements. This happens during the audit (for example, at daily team meetings) and before the closing meeting.
• Within the certification body: A technical reviewer and/or certification decision-maker independent of the audit team reviews the full audit package before granting, maintaining, extending, reducing, suspending or withdrawing certification.
Key documents subject to review
• Audit plan: scope, objectives, criteria, dates, sites, team assignments, time allocation
• Stage 1 report: readiness, documented ISMS, Statement of Applicability, risk assessment, areas of concern
• Checklists and work documents: completed, legible, linked to clauses and Annex A controls
• Evidence records: documents sampled, records reviewed, observations, interview notes (with roles, not necessarily names), dates and locations
• Sampling records: what was sampled, sample size, method and justification
• Nonconformity reports: requirement, evidence, statement of nonconformity, grading, auditee acknowledgement
• Opening and closing meeting records: attendance, confirmation of scope, conclusions, disagreements
• Audit report: conclusions, recommendation, conformity status, effectiveness of the ISMS, unresolved issues
• Corrective action plans and verification evidence: for follow-up and closure of nonconformities
Quality attributes the reviewer checks
• Completeness: All clauses 4 to 10 and applicable Annex A controls in the plan were covered. All sites, processes and shifts in scope were audited as planned.
• Accuracy: Facts, references, dates, document versions and clause numbers are correct.
• Traceability: Each finding links to a specific requirement and specific objective evidence.
• Objectivity: Statements are factual and free from opinion, assumption or bias.
• Clarity: Wording is clear, concise and understandable to someone who was not present.
• Consistency: Findings are graded consistently, and the report's conclusion matches the findings. For example, a recommendation for certification should not be made while major nonconformities remain open.
• Conformity with procedures: Templates are used correctly, required signatures and approvals are present, and timelines are met.
• Confidentiality: Records are classified, protected and distributed appropriately.
• Adequacy of audit time and team competence: Audit duration and team competence fit the scope and complexity.
How Quality Review Works (Step by Step)
Step 1: Review during the audit (team leader)
• At daily review meetings, the team leader checks that evidence is recorded properly.
• The team leader confirms that potential nonconformities are well supported.
• Gaps in coverage are identified and audit activities are reallocated if needed.
Step 2: Pre-closing meeting review
Before the closing meeting, the audit team meets privately to:
• Review all findings against the audit objectives
• Agree on grading of nonconformities
• Consider uncertainty inherent in sampling
• Agree on the audit conclusion and recommendation
Step 3: Writing nonconformity statements
A good nonconformity report contains three elements:
• The requirement: the clause or control and what it requires
• The evidence: what was seen or heard, where and when
• The statement of nonconformity: why the evidence does not meet the requirement
The team leader verifies these elements before the report is presented.
Step 4: Preparing the audit report
The team leader compiles the report and checks that:
• It covers scope, objectives, criteria, team, dates, sites, findings and conclusions
• It states the degree of conformity and ISMS effectiveness
• It records any unresolved diverging opinions
• It states the recommendation
Step 5: Independent technical review (certification body)
A competent reviewer, not involved in the audit, examines the full audit file. If issues are found (missing evidence, unclear nonconformities, inconsistent grading, scope errors), the file goes back to the team leader for clarification or correction. Facts may be clarified, but the reviewer must not alter evidence or invent findings.
Step 6: Certification decision
The decision-maker considers:
• The reviewed documentation
• Acceptance of corrections and corrective action plans for minor nonconformities
• Verification of corrections and corrective actions for major nonconformities
Only then is the decision made.
Step 7: Retention and feedback
• Records are retained securely for the defined period, which usually covers at least the certification cycle.
• Lessons learned feed into auditor performance evaluation, calibration and improvement of the audit programme.
Common Documentation Deficiencies Found During Review
• Nonconformities written as opinions or recommendations, such as 'should consider', instead of factual statements
• Missing objective evidence or vague references like 'some records were missing'
• Wrong clause or control references
• Grading inconsistent with impact (for example, a total breakdown of risk assessment graded as minor)
• Audit plan coverage not met, with no explanation
• Report conclusions contradicting the findings
• Consulting advice given in the report, which breaches impartiality
• Personal names unnecessarily attached to failures
• Confidential client data copied into records without protection
• Missing signatures, dates or auditee acknowledgement of nonconformities
Roles and Responsibilities
• Auditor: records evidence accurately and objectively; completes work documents.
• Audit team leader: reviews the team's work, ensures quality and consistency of findings, prepares and owns the report.
• Technical reviewer / certification decision-maker: independently reviews the package; never a member of the audit team.
• Audit programme manager: ensures procedures for documentation and review exist, monitors performance and maintains records.
• Auditee: acknowledges nonconformities, provides corrective action plans and may challenge factual errors.
Link to Standards
• ISO 19011: covers the principles of auditing (integrity, fair presentation, due professional care, confidentiality, independence, evidence-based and risk-based approaches), preparing and distributing the audit report, completing the audit and retaining documented information.
• ISO/IEC 17021-1: requires reports to be prepared, reviewed and used in independent certification decisions, and requires records to be maintained.
• ISO/IEC 27006: sets requirements specific to ISMS certification bodies, including auditor competence and audit time.
• ISO/IEC 27001 clause 7.5: covers the auditee's own documented information, which the auditor reviews and which must be controlled.
Exam Tips: Answering Questions on Quality Review of Audit Documentation
1. Know who reviews what. The audit team leader is responsible for the quality of the audit report and team findings. The certification decision must be made by someone independent of the audit team. If an option says the team leader makes the final certification decision, it is usually wrong.
2. Remember the three elements of a nonconformity. These are requirement, evidence and statement. When asked to evaluate a poorly written nonconformity, identify which element is missing. Opinions, assumptions or recommendations make a statement defective.
3. Watch for objectivity and impartiality traps. Answers suggesting the auditor include advice, solutions or consulting recommendations in the report are wrong, because auditors must remain impartial. Opportunities for improvement are allowed by some certification bodies but must not prescribe specific solutions.
4. Link conclusions to evidence. In scenario questions, check whether the conclusion is supported by the recorded evidence. A recommendation for certification with open major nonconformities is a classic inconsistency to spot.
5. Use ISO 19011 principles as keywords. Phrases like 'fair presentation', 'evidence-based approach', 'due professional care' and 'confidentiality' often signal the correct answer in documentation questions.
6. Know the difference between correction and corrective action. Reviewers check that corrective action addresses the root cause. Questions may ask what evidence is needed before closing a major nonconformity: implementation and verification of effectiveness, often through a follow-up audit.
7. Recognise sampling limitations. Good documentation records the sample and acknowledges audit uncertainty. An answer claiming the audit 'proves full compliance' is overstated and wrong.
8. Confidentiality matters in ISMS audits. If a scenario describes an auditor photographing sensitive data or leaving notes unsecured, the best answer emphasises protecting audit records according to the certification body's and client's agreements.
9. Handling a reviewer's query. If the independent reviewer finds a gap, the correct action is to return the file to the team leader for clarification or additional evidence. The reviewer should not simply rewrite findings, and no decision should be made on an incomplete file.
10. Essay and scenario questions: use a structure. For longer answers:
• Define the purpose of quality review.
• Identify the specific deficiencies in the scenario.
• Explain the risk of each deficiency (for example, invalid certification decision or unfair treatment of the auditee).
• Propose the correct action, citing roles and standards.
• Conclude with the impact on audit credibility.
11. Diverging opinions. If the auditee disagrees with findings and the disagreement cannot be resolved, it must be recorded in the report. Never choose an answer that hides disagreements.
12. Timing questions. The report is usually issued within an agreed timeframe after the closing meeting. Quality review happens before final issue and before the certification decision, not after the certificate is granted.
13. Eliminate extreme or absolute answers. Options with 'always', 'never' or 'guarantee' are often wrong, unless they reflect firm rules such as 'the decision-maker must not be a member of the audit team'.
Worked Example
Scenario: An auditor writes: 'The organisation's access control seems weak and they should buy a better identity management tool.' The team leader includes this in the report as a minor nonconformity.
Analysis: The statement has these defects:
• No requirement is cited (for example, Annex A 5.15 Access control or 5.18 Access rights).
• No objective evidence is given (which system, which accounts, what was observed).
• It uses subjective language ('seems weak').
• It gives consulting advice ('buy a better tool'), which breaches impartiality.
Correct answer: The team leader should reject it in quality review and ask the auditor either to rewrite it with requirement, evidence and statement, or to remove it if no evidence exists. The independent reviewer would also flag it if it were not corrected.
Summary
Quality review of audit documentation ensures that audit records and reports are:
• Complete, accurate, objective and traceable
• Consistent with the audit criteria and certification body procedures
• Sufficient for an independent, defensible certification decision
For the exam, focus on roles (team leader vs. independent reviewer), the three elements of a nonconformity, consistency between findings and conclusions, impartiality, confidentiality and the ISO 19011 principles. These themes appear repeatedly in both multiple-choice and scenario-based questions.
