Tools Used by Professional Auditors

Tools Used by Professional Auditors in ISO/IEC 27001 Audits: A Complete Guide for Lead Auditors

Introduction
An ISO/IEC 27001 audit is only as good as the evidence it produces. Evidence must be gathered systematically, recorded accurately and evaluated objectively. Professional auditors therefore rely on a set of tools to plan, perform, record and report audits consistently. In the ISO 27001 Lead Auditor syllabus, this topic sits within Managing an ISO/IEC 27001 Audit Program. The audit programme manager must make sure auditors have the right tools, know how to use them, and use them in line with ISO 19011:2018 and ISO/IEC 17021-1 (for certification audits).

1. Why Audit Tools Are Important
Consistency: Standard tools such as checklists, templates and nonconformity report forms mean different auditors cover the same areas to a comparable standard across the audit programme.
Objectivity and traceability: Tools create a documented trail from audit criteria to evidence to findings. Any conclusion can then be traced back and verified.
Efficiency: Pre-prepared work documents, sampling plans and audit software save time on site. The auditor can spend that time gathering evidence instead of improvising.
Completeness: Tools help confirm that all clauses (4 to 10) and relevant Annex A controls in the Statement of Applicability (SoA) are covered within the defined audit scope.
Defensibility: Certification bodies must be able to justify their decisions to accreditation bodies. Well-maintained audit records produced with standard tools support impartial, evidence-based certification decisions.
Risk management of the audit itself: ISO 19011 requires the audit programme to address its own risks, such as insufficient time, an incompetent audit team or poor evidence. Appropriate tools reduce these risks.

2. What Audit Tools Are
Audit tools are the methods, documents, techniques and technologies an auditor uses to collect, analyse, record and communicate audit evidence. They fall into several groups.

A. Planning tools
- Audit programme records: schedules, objectives, scope and resources for the whole programme.
- Audit plan: describes the activities and arrangements for a single audit, including objectives, scope, criteria, schedule, team roles and locations.
- Stage 1 review records and document review checklists: used to assess ISMS documentation readiness, such as the ISMS scope, information security policy, risk assessment and treatment methodology, SoA and risk treatment plan.
- Audit time calculation tools: based on ISO/IEC 27006-1, which links audit duration to the number of personnel and complexity factors.

B. Evidence-gathering tools and techniques
- Audit checklists and questionnaires: lists of questions or items linked to clauses and controls. They act as an aide-memoire, not a rigid script.
- Interviews: structured or semi-structured conversations with personnel at every level. Open questions (what, how, show me) are preferred.
- Observation: watching activities directly, such as clear desk practices, physical access control, visitor handling or backup procedures.
- Document and record review: examining policies, procedures, logs, records of training, incident reports, management review minutes and internal audit reports.
- Technical verification: reviewing system configurations, access rights lists, firewall rule sets, patch status reports or log extracts. This is normally done by observing the auditee demonstrate them, rather than the auditor running tools independently.
- Sampling: selecting a representative subset of a population, such as user accounts, change tickets or incidents. ISO 19011 Annex A.6 describes judgement-based sampling (relying on auditor knowledge and experience) and statistical sampling (using probability theory, where results can be generalised with a known confidence level).

C. Computer-Assisted Audit Techniques (CAATs) and ICT tools
- Data analytics software: used to analyse large datasets. Examples include comparing an HR leavers list against active user accounts, or identifying segregation-of-duties conflicts.
- Audit management software: used to plan, assign, record evidence, track nonconformities and corrective actions, and generate reports.
- Remote audit tools: video conferencing, screen sharing and secure file sharing. ISO 19011 Annex A.16 guides on the use of ICT in remote audits. The auditor must consider security, confidentiality, connectivity and whether the evidence is reliable.
- Spreadsheets and evidence logs: used to record the samples taken, references and results.

D. Recording and reporting tools
- Audit work documents: also called working papers. These are the auditor's notes of evidence, including what was seen, who was interviewed, document references, dates and versions.
- Nonconformity report (NCR) forms: record the requirement, the evidence and the statement of nonconformity, and grade findings as major or minor.
- Opening and closing meeting agendas and attendance records.
- Audit report templates: make sure the report contains the required content, including objectives, scope, criteria, findings, conclusions and the recommendation on certification.
- Corrective action follow-up trackers.

3. How the Tools Work Throughout the Audit
Step 1: Preparation. The audit team leader uses the audit programme inputs and the Stage 1 document review to build the audit plan. Checklists are tailored to the auditee's scope, SoA, risks and previous findings. Generic checklists copied without thought are a weakness.
Step 2: Opening meeting. An agenda confirms the scope, plan, methods, confidentiality, communication channels and the reporting of findings.
Step 3: Collecting evidence. Auditors combine interviews, observation and document review. They triangulate evidence: for example, a procedure says access is reviewed quarterly, the interviewee describes the review, and the records show it was done. Sampling is applied to the relevant populations. Technical evidence is usually obtained by asking the auditee to demonstrate, for example: Please show me the access rights for the finance application and the last review record.
Step 4: Recording. Every relevant observation is written in the working papers with enough detail to be verifiable. This includes document IDs, version numbers, dates, sample references and names or roles.
Step 5: Evaluating. Evidence is compared with the audit criteria (ISO/IEC 27001 requirements, the organisation's own policies, and legal and contractual requirements) to produce findings. These are conformities, nonconformities or opportunities for improvement.
Step 6: Reporting. NCR forms and the audit report template are completed. Findings are presented at the closing meeting.
Step 7: Follow-up. Corrective action trackers verify that root cause analysis and actions are effective.

Key principles governing the use of tools
- Tools support professional judgement; they never replace it. A checklist cannot decide whether a control is effective. The auditor does.
- Flexibility: Auditors should follow audit trails that emerge during the audit, even if they are not on the checklist.
- Non-intrusiveness and authorisation: Auditors should not run vulnerability scanners, penetration tests or other intrusive tools on the auditee's systems unless this is explicitly agreed, authorised and within scope. An ISMS audit evaluates the management system. It is not a technical security test, although the auditor reviews the results of the organisation's own tests.
- Confidentiality and information security: Evidence gathered (screenshots, extracts, documents) must be protected according to agreements with the auditee. Laptops should be encrypted, file transfer must be secure, and evidence should be retained and disposed of properly. Auditors of an ISMS must practise good security themselves.
- Evidence-based approach: This is one of the seven ISO 19011 principles of auditing. Tools exist to make evidence verifiable and reproducible.
- Competence: The audit programme manager must ensure auditors are competent in the tools they use, especially CAATs and remote audit technologies.
- Sampling awareness: Audits are based on samples, so there is always audit risk. Sample sizes and methods should be justified and recorded.

4. Common Examples Linking Tools to Annex A Controls
- Access control (A.5.15 to A.5.18, A.8.2): Sample user accounts. Compare them with the HR leavers list and check the access review records.
- Change management (A.8.32): Statistically or judgementally sample change tickets. Verify approval, testing and rollback planning.
- Physical security (A.7): Observe entry controls, visitor logs and clear desk practices.
- Awareness and training (A.6.3, Clause 7.2 and 7.3): Interview staff about the security policy and incident reporting. Review training records.
- Logging and monitoring (A.8.15, A.8.16): Ask the auditee to demonstrate their log review process and SIEM alerts.
- Backup (A.8.13): Review backup logs and restoration test records.

5. Exam Tips: Answering Questions on Tools Used by Professional Auditors
Tip 1: Know the three core evidence-gathering methods. These are interview, observation and document or record review. Exam scenarios often ask which method is most appropriate. Observation suits behaviour, such as tailgating or clear desk. Document review suits proof that something happened, such as management review minutes. Interviews suit understanding and awareness.
Tip 2: Checklists are aids, not scripts. If an option says the auditor must strictly follow the checklist and ignore other issues, it is usually wrong. The correct answer normally stresses that the auditor follows audit trails and uses professional judgement.
Tip 3: Intrusive technical tools need authorisation. In a scenario where an auditor wants to run a vulnerability scan or a password-cracking tool, the best answer is usually that this is outside the auditor's role unless explicitly agreed in scope. The auditor should instead review the organisation's own test results or ask for a demonstration.
Tip 4: Distinguish judgement-based and statistical sampling. Statistical sampling allows conclusions with a stated confidence level. Judgement-based sampling depends on auditor expertise and cannot be statistically generalised. Know that sampling introduces audit risk, and that the sample must be documented.
Tip 5: Remember ISO 19011 as the main reference. Audit programme management, methods, sampling (Annex A.6) and remote audits using ICT (Annex A.16) all come from ISO 19011:2018. Certification audit duration and ISMS-specific requirements come from ISO/IEC 27006-1, while general certification body requirements come from ISO/IEC 17021-1.
Tip 6: Highlight confidentiality. Any answer showing that the auditor protects evidence, follows agreed confidentiality arrangements and uses secure tools is generally strong. This is particularly true for remote audits and digital evidence.
Tip 7: Link tools to the audit phase. Exam questions often test sequence. The audit plan comes before on-site activities. Working papers are completed during the audit. NCR forms are drafted when findings are confirmed. The report is issued after the closing meeting. Corrective action follow-up comes last.
Tip 8: Write strong nonconformity statements in essay or scenario answers. Use the structure: requirement (clause or control), evidence (what was seen, with references) and statement of nonconformity (what is missing). Show how your tool, such as a sample of 10 change tickets with 3 lacking approval, produced the objective evidence.
Tip 9: Use open-ended interview questions in answers. When asked how you would audit something, propose questions such as How do you ensure...?, Can you show me...? and What happens when...? Avoid leading or closed questions.
Tip 10: Triangulate. Top-scoring answers combine at least two sources of evidence for important conclusions. For example, say you would interview the IT manager, observe the process and review a sample of records.
Tip 11: Watch for distractors about efficiency over evidence. Options that skip evidence verification to save time, rely only on the auditee's verbal assurance, or accept a policy document as proof of implementation are usually wrong. A policy proves intent. Records and observation prove implementation.
Tip 12: Remote audit questions. Expect to consider whether the ICT tools are reliable and secure, whether the auditee agrees to their use, whether personnel are competent to use them, and whether some activities (such as physical security checks) still need an on-site visit.

6. Quick Revision Summary
- Tools give the audit consistency, traceability, efficiency and defensibility.
- The main categories are planning tools, evidence-gathering techniques, CAATs and ICT tools, and recording and reporting tools.
- Interview, observation and document review are the foundation, and sampling applies to all three.
- Tools support professional judgement and never replace it.
- Intrusive testing requires explicit authorisation and scope agreement.
- Protect the confidentiality of audit evidence at all times.
- ISO 19011:2018, ISO/IEC 17021-1 and ISO/IEC 27006-1 are the key reference standards.

Master these points and you will be able to answer both multiple-choice and scenario-based questions on audit tools with confidence. Always tie your answer back to objective evidence, the audit criteria and the principles of auditing.