Management and Protection of Audit Records

Management and Protection of Audit Records in an ISO/IEC 27001 Audit Programme: A Complete Guide for Lead Auditors

Introduction
Audit records are the documented evidence that an audit programme exists, that individual audits were planned and performed, and that their results were reported and acted upon. In an ISO/IEC 27001 context, these records often contain highly sensitive information about an organization's security weaknesses, network architecture, risk assessments and incidents. Managing and protecting them is therefore both a programme management requirement and an information security obligation. For the ISO/IEC 27001 Lead Auditor exam, expect this topic to be tested through ISO 19011:2018 (guidelines for auditing management systems), ISO/IEC 27007 (guidance for ISMS auditing), ISO/IEC 17021-1 and ISO/IEC 27006 (certification bodies), and clause 9.2 of ISO/IEC 27001 itself.

1. Why Management and Protection of Audit Records Is Important
Evidence of conformity: ISO/IEC 27001 clause 9.2.2 requires that documented information be retained as evidence of the implementation of the audit programme(s) and the audit results. Without records, an organization cannot demonstrate that internal audits took place.
Traceability and accountability: Records allow anyone, such as a certification body, regulator, accreditation body or top management, to trace audit conclusions back to verifiable evidence. This supports the ISO 19011 principle of the evidence-based approach.
Confidentiality: ISO 19011 lists confidentiality (security of information) as one of the seven principles of auditing. Auditors must exercise discretion in the use and protection of information acquired during their duties. A leaked audit report describing unpatched systems or weak access controls is effectively a map for attackers.
Continual improvement of the programme: ISO 19011 clause 5.7 (monitoring) and 5.8 (reviewing and improving the audit programme) depend on accurate historical records, including trends in nonconformities, auditor performance and auditee feedback.
Legal, contractual and regulatory compliance: Records may be subject to retention laws, privacy legislation (for example, where personal data appears in evidence), contractual obligations and accreditation rules.
Credibility and impartiality: For certification bodies, complete and protected records underpin certification decisions and defend them in appeals and complaints.
Risk management: ISO 19011 clause 5.3 identifies risks to the audit programme, including risks related to the security and confidentiality of information. Poor record handling is a programme risk.

2. What Audit Records Are
ISO 19011:2018 clause 5.5.7 (Managing and maintaining audit programme records) states that the individual(s) managing the audit programme should ensure that audit records are created, managed and maintained to demonstrate the implementation of the audit programme. Records typically fall into three groups:

a) Records related to the audit programme:
- Schedule of audits
- Audit programme objectives and extent
- Records addressing audit programme risks and opportunities, and relevant external and internal issues
- Reviews of the effectiveness of the audit programme

b) Records related to each audit:
- Audit plans and audit reports
- Objective audit evidence and findings
- Nonconformity reports
- Correction and corrective action reports
- Audit follow-up reports

c) Records related to audit personnel:
- Competence and performance evaluation of audit team members
- Selection of audit teams and team members
- Maintenance and improvement of competence (training, CPD)

Other relevant records include auditee feedback, records of communications with the auditee, confidentiality agreements, conflict-of-interest declarations, audit checklists and working papers, sampling plans, attendance sheets of opening and closing meetings, and for certification bodies, certification decisions, certificates issued, suspensions, withdrawals, complaints and appeals (ISO/IEC 17021-1 clause 9.9 on client records).

Important distinction: Documents (such as an audit procedure or checklist template) can be revised; records (such as a completed audit report or signed nonconformity report) capture what happened and should not be altered. In ISO/IEC 27001 terminology, both are 'documented information', with records being documented information that is retained.

3. How It Works: The Life Cycle of Audit Records
Step 1 - Define requirements in the audit programme: The audit programme manager determines which records are needed, their format, who is responsible, retention periods, and security classification. This is often written into an audit procedure.

Step 2 - Creation and identification: Records should be clearly identified (audit reference number, date, auditee, scope, auditor names, version). Evidence should be recorded accurately, legibly and promptly, ideally on site or immediately after.

Step 3 - Classification: Records are classified according to the organization's (or certification body's) information classification scheme. ISMS audit reports and evidence are commonly classified as confidential or restricted.

Step 4 - Protection during the audit: ISO/IEC 27007 highlights that ISMS auditors may access sensitive information. Good practice includes:
- Collecting only the evidence necessary to support findings (data minimization)
- Not removing copies of sensitive documents unless agreed with the auditee
- Using encrypted laptops and storage, and secure communication channels for remote audits
- Respecting the auditee's rules on photography, recording and screen captures
- Protecting personal data in accordance with privacy laws
- Agreeing in advance which information the auditee will not disclose (for example, highly classified data), and how evidence will be examined instead (such as viewing on site)

Step 5 - Storage and access control: Records should be stored in a controlled repository with role-based access, backups, integrity protection (version control, digital signatures, audit logs) and availability safeguards. Access is limited to those with a legitimate need, such as the audit programme manager, audit team, certification decision makers and authorized auditee representatives.

Step 6 - Distribution: ISO 19011 clause 6.5.2 states that the audit report should be distributed to relevant interested parties as defined in the audit plan or audit programme. The audit team leader and client agree distribution; the report remains the property of the audit client unless otherwise agreed. Unauthorized disclosure to third parties requires consent unless required by law.

Step 7 - Retention: ISO 19011 clause 6.6 (Completing the audit) states that documented information pertaining to the audit should be retained or disposed of by agreement between the participating parties and in accordance with audit programme procedures and applicable requirements. Certification bodies under ISO/IEC 17021-1 typically retain records for at least the current certification cycle plus the previous full cycle. Retention periods should balance legal requirements, contractual needs and the risk of holding sensitive data longer than necessary.

Step 8 - Secure disposal: When retention ends, records must be disposed of securely (shredding, secure deletion, media sanitization) in line with ISO/IEC 27001 Annex A controls such as 7.14 (secure disposal or re-use of equipment) and 8.10 (information deletion).

Step 9 - Use for monitoring and improvement: Records feed into programme monitoring (5.7) and review (5.8): analysis of recurring nonconformities, auditor evaluation, achievement of programme objectives and improvement actions.

Relevant ISO/IEC 27001:2022 Annex A controls that apply to protecting audit records include 5.12 (classification of information), 5.13 (labelling), 5.14 (information transfer), 5.15 (access control), 5.33 (protection of records), 5.34 (privacy and protection of PII), 6.6 (confidentiality or non-disclosure agreements), 8.13 (information backup) and 8.24 (use of cryptography). Note also control 8.34 (protection of information systems during audit testing), which concerns protecting systems during technical audit activities.

Roles and responsibilities:
- Audit programme manager: ensures records are created, managed and maintained; defines retention and security rules.
- Audit team leader: ensures the team records evidence and findings properly, prepares the report, and handles distribution as agreed.
- Auditors: record accurate evidence, protect working papers, respect confidentiality.
- Auditee: provides access to information and may impose security conditions; retains its own copies of reports and corrective actions.
- Certification body (third-party): maintains client records per ISO/IEC 17021-1 and ISO/IEC 27006, and must keep client information confidential through legally enforceable agreements.

4. Common Pitfalls
- Auditors keeping copies of sensitive evidence on personal or unencrypted devices
- Emailing audit reports in plaintext to wide distribution lists
- No defined retention period, leading to indefinite storage or premature destruction
- Altering records after the fact instead of issuing a controlled revision
- Failing to record competence evaluations of auditors
- Recording findings without traceable objective evidence
- Including unnecessary personal data in audit notes

5. Exam Tips: Answering Questions on Management and Protection of Audit Records
Tip 1 - Know the anchor clauses. Link answers to ISO 19011 clause 5.5.7 (managing and maintaining audit programme records), clause 6.6 (completing the audit and retention/disposal), clause 6.5.2 (report distribution), the confidentiality principle in clause 4, and ISO/IEC 27001 clause 9.2.2 (documented information as evidence of the audit programme and results). Citing the right clause adds credibility in essay-style answers.

Tip 2 - Remember the three categories. If asked which records should be kept, structure your answer as programme records, individual audit records and audit personnel records. This shows a complete understanding.

Tip 3 - Think CIA. For protection questions, frame your answer around confidentiality (access control, NDAs, encryption, classification), integrity (version control, no alteration, signatures, logs) and availability (backups, retrievability for certification decisions, appeals and follow-ups).

Tip 4 - Who decides retention and distribution? Look for answers involving agreement between participating parties (audit client, auditee, audit team) in accordance with audit programme procedures and legal, regulatory and contractual requirements. Avoid options suggesting the auditor decides alone or keeps records indefinitely.

Tip 5 - Scenario questions on sensitive information. If a scenario describes an auditor copying confidential files, taking photos of server rooms without permission, or leaving notes unattended, the correct response usually identifies a breach of the confidentiality principle and recommends secure handling, minimization and returning or destroying copies. If the auditee refuses access to highly sensitive information, the appropriate response is to seek alternative evidence (on-site viewing, interviews, redacted copies) and, if evidence is insufficient, report this as a limitation or obstacle in the audit report rather than ignoring it.

Tip 6 - Watch for the 'records are unchangeable' trap. If a question asks whether a finalized audit report may be edited to remove an inconvenient finding, the answer is no. Changes require a controlled, traceable revision with justification, and findings must remain evidence-based.

Tip 7 - Differentiate first, second and third-party contexts. Internal audits are governed by the organization's own procedures and ISO/IEC 27001 clause 9.2; certification audits also follow ISO/IEC 17021-1 and ISO/IEC 27006, including stricter rules on client confidentiality and record retention.

Tip 8 - Connect records to improvement. Strong answers explain that records are not just for compliance; they enable monitoring of programme objectives, auditor evaluation, trend analysis and continual improvement of the audit programme.

Tip 9 - Use action-oriented language in essay answers. For example: 'As audit programme manager, I would define a records register listing each record type, owner, classification, storage location, access rights, retention period and disposal method, and verify its application during programme reviews.'

Tip 10 - Eliminate extreme options. In multiple-choice questions, options such as 'destroy all evidence immediately after the closing meeting' or 'publish audit reports to all employees' are almost always wrong. The correct option typically reflects controlled, agreed and risk-based handling.

Summary
Management and protection of audit records ensures that an ISO/IEC 27001 audit programme is demonstrable, traceable, confidential and continually improving. Records cover the programme, each audit and the auditors. They must be identified, classified, protected for confidentiality, integrity and availability, distributed only as agreed, retained according to procedures and legal requirements, and securely disposed of. In the exam, ground your answers in ISO 19011 clauses 5.5.7 and 6.6, the confidentiality principle and ISO/IEC 27001 clause 9.2, and always favour controlled, agreed, evidence-based and risk-based record handling.