ISO 19011:2018 provides guidelines for auditing management systems, including ISO/IEC 27001 Information Security Management Systems (ISMS). It defines a shared vocabulary so that auditors, auditees and clients understand audit activities in the same way. An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Audit criteria are the set of requirements used as a reference, such as ISO/IEC 27001 clauses, Annex A controls, policies, procedures, legal obligations and contractual requirements. Audit evidence consists of records, statements of fact or other verifiable information relevant to the criteria, gathered through interviews, observation and document review, often by sampling. Audit findings result from evaluating evidence against criteria and may show conformity, nonconformity or opportunities for improvement. A nonconformity is the non-fulfilment of a requirement, often graded by certification bodies as major or minor. The audit conclusion is the outcome of the audit after considering the objectives and all findings. Key planning terms include the audit programme, which covers arrangements for one or more audits over a specific period, and the audit plan, which describes the activities and logistics of a single audit. Audit scope defines the extent and boundaries, such as locations, processes and time period, while audit objectives state what the audit must accomplish. Roles include the audit client, who requests the audit; the auditee, the organization being audited; the audit team, led by an audit team leader; technical experts, who provide specific knowledge; guides; and observers. Audits are classified as first-party (internal), second-party (customers or suppliers) and third-party (independent certification or regulatory bodies). Combined audits cover multiple management systems, and joint audits involve multiple auditing organizations. ISO 19011 also sets out seven principles: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach. Together, these concepts help ensure that ISMS audits are consistent, reliable and valuable for decision-making.

In ISO/IEC 27001 Lead Auditor practice, audit criteria, findings and conclusions form a logical chain defined in ISO 19011:2018 and applied in ISMS audits under ISO/IEC 27006. Audit criteria are the set of requirements used as a reference against which objective evidence is compared. In an ISMS audit, criteria typically include the clauses of ISO/IEC 27001 (4 to 10), the Annex A controls declared applicable in the Statement of Applicability, the organization's own information security policies and procedures, and applicable legal, regulatory and contractual obligations. Criteria must be clearly defined and agreed during audit planning, because without them the auditor has no objective basis for judgement. Audit evidence is verifiable information, such as records, statements of fact or observations, collected through interviews, document review and observation. It is gathered by sampling and must be relevant to the criteria. Audit findings are the results of evaluating the collected evidence against the audit criteria. Findings can indicate conformity or nonconformity. Nonconformities are usually graded as major, meaning an absence or total breakdown of a required process that raises significant doubt about the ISMS achieving its intended outcomes, or minor, meaning an isolated lapse that does not undermine the system. Findings may also identify opportunities for improvement or good practice. A well-written nonconformity states the requirement, the evidence and the gap, so the auditee can understand and address the root cause. Audit conclusions are the outcome of the audit, reached after the audit team considers the audit objectives and all audit findings together. Conclusions address matters such as the extent of conformity with the criteria, the effectiveness of the ISMS in meeting its objectives, and, in certification audits, a recommendation on whether to grant, maintain or withhold certification. Conclusions are agreed by the audit team, presented at the closing meeting and recorded in the audit report. In summary: criteria are the benchmark, evidence is what is found, findings compare the two, and conclusions are the overall judgement based on all findings and the audit objectives.

In ISO/IEC 27001 Lead Auditor training, audits are classified by who performs them and for what purpose, following ISO 19011 (guidelines for auditing management systems) and ISO/IEC 17021-1. First-party audits are internal audits conducted by, or on behalf of, the organization itself. ISO/IEC 27001 Clause 9.2 requires them at planned intervals. They verify that the Information Security Management System (ISMS) conforms to the organization's own requirements and to the standard, and that it is effectively implemented and maintained. Results feed management review (Clause 9.3) and continual improvement (Clause 10). Internal auditors may be employees or contracted consultants, but they must be objective and impartial, which means they should not audit their own work. First-party audits can also support a self-declaration of conformity. Second-party audits are performed by parties with an interest in the organization, typically customers, or by others acting on their behalf. A common example is a company auditing a cloud provider or outsourcing partner to confirm that contractual information security requirements are met. These audits relate to supplier relationship controls in ISO/IEC 27001 Annex A (5.19 to 5.22). The auditor is external to the auditee but not fully independent, because the auditing party has a commercial interest in the outcome. Third-party audits are conducted by independent external organizations, such as accredited certification bodies or regulators. Certification bodies operate under ISO/IEC 17021-1 and ISO/IEC 27006, which set competence and impartiality requirements for ISMS certification. The process includes a Stage 1 audit, which reviews documentation and readiness. It is followed by a Stage 2 audit, which evaluates implementation and effectiveness. If the outcome is successful, a certificate valid for three years is issued, with annual surveillance audits and a recertification audit before expiry. Third-party audits offer the highest level of independence and public assurance. Understanding these distinctions helps a Lead Auditor apply the principles of independence, evidence-based approach and fair presentation appropriately in each audit context.

In the ISO/IEC 27001 Lead Auditor context, auditing is guided by the principles in ISO 19011:2018, Guidelines for auditing management systems. Integrity and Fair Presentation are two of its seven core principles, alongside Due Professional Care, Confidentiality, Independence, Evidence-Based Approach and Risk-Based Approach. Together they make audit results trustworthy and useful. INTEGRITY is the foundation of professionalism. Auditors and audit programme managers should perform their work ethically, with honesty and responsibility. They should only undertake audit activities they are competent to perform, act impartially by remaining fair and unbiased in all dealings, and stay sensitive to any influences that could affect their judgement, such as pressure from auditees, commercial interests or personal relationships. For an ISMS auditor, integrity means not overlooking a missing risk assessment to please a client, not accepting inappropriate gifts, and not claiming expertise in areas like cloud security or cryptography without the needed competence. Integrity also means complying with applicable legal requirements and showing commitment to the organisation and audit programme. FAIR PRESENTATION is the obligation to report truthfully and accurately. Audit findings, audit conclusions and audit reports should truthfully and accurately reflect the audit activities. Significant obstacles encountered during the audit, such as restricted access to records or unavailable personnel, should be reported, as should unresolved, diverging opinions between the audit team and the auditee. Communication should be truthful, accurate, objective, timely, clear and complete. In practice, an ISO/IEC 27001 auditor must describe nonconformities against specific clauses or Annex A controls precisely, without exaggerating minor issues or downplaying major weaknesses, and should acknowledge positive practices as well as gaps. The relationship between the two principles is clear: integrity governs how the auditor behaves, while fair presentation governs how results are communicated. Without integrity, evidence may be biased; without fair presentation, even sound evidence may be misrepresented. Both are essential for certification bodies, auditees and interested parties to rely on audit outcomes when making decisions about information security.

In ISO/IEC 27001 Lead Auditor training, the fundamental audit principles come from ISO 19011, Guidelines for auditing management systems. Two of the seven principles are Due Professional Care and Confidentiality. Both shape how an auditor behaves and how trustworthy the audit results are.

Due Professional Care means auditors apply diligence and sound judgement throughout the audit. Their care should match the importance of the task and the confidence that clients and other interested parties place in them. In practice, this involves:

- Planning the audit carefully.
- Understanding the scope of the Information Security Management System (ISMS) and the organization's context.
- Applying appropriate sampling techniques.
- Gathering sufficient, objective evidence before reaching conclusions.
- Recognizing the limits of their own competence and seeking technical experts when needed.
- Maintaining current knowledge of ISO/IEC 27001, Annex A controls, and relevant legal requirements.

A key part of this principle is professional judgement. Auditors must assess risks, evaluate the significance of findings, and avoid careless or superficial conclusions, recognizing that their reports may influence certification decisions and business operations.

Confidentiality concerns the security of information. Auditors must handle sensitive information with discretion and protect it from unauthorized disclosure. During an ISMS audit, auditors often see highly sensitive material, such as:

- Risk assessments and vulnerability reports.
- Network architectures and security incident records.
- Personal data and intellectual property.

Auditors must not use audit information for personal gain or disclose it inappropriately, and they must not use it in ways that harm the auditee's legitimate interests. Good practice includes:

- Signing non-disclosure agreements.
- Securely storing and transmitting audit documents.
- Limiting access to working papers.
- Returning or destroying information according to agreed procedures.

Auditors may disclose information only when the law requires it or when the auditee gives consent.

Together, these principles build trust. Auditees become more willing to share information openly because they know it will be protected and evaluated competently. This openness improves the quality of audit evidence and helps ensure that audit conclusions are reliable, credible, and consistent with the ethical expectations of the auditing profession.

Independence and impartiality are core audit principles defined in ISO 19011 and reinforced for certification bodies by ISO/IEC 17021-1 and ISO/IEC 27006. Independence is the foundation of the impartiality of the audit and the objectivity of audit conclusions. Auditors should be free from bias and conflicts of interest and, wherever practicable, independent of the activity being audited. For an ISO/IEC 27001 Lead Auditor, this means not auditing an information security management system (ISMS) they helped design, implement or operate, nor processes for which they are responsible. Impartiality means objectivity that is both actual and perceived. Audit decisions must rest on objective evidence gathered during the audit, not on personal, financial, commercial or other pressures. Common threats to impartiality include self-interest (financial dependence on the client), self-review (auditing one's own consultancy work), familiarity (long relationships with auditee personnel) and intimidation (pressure from auditee management or from the certification body's sales targets). ISO/IEC 17021-1 requires certification bodies to identify, analyze and mitigate these risks. Typical safeguards include prohibiting auditors from providing management system consultancy to a client within two years before auditing it, rotating audit team members and maintaining a mechanism for safeguarding impartiality, such as an impartiality committee. In internal audits within small organizations, full independence may be difficult to achieve. In such cases, auditors should still make every effort to remove bias and encourage objectivity, for example by never auditing their own work. Lead Auditors must disclose any potential conflicts before accepting an assignment and maintain professional skepticism throughout. They should record findings based solely on verifiable evidence assessed against audit criteria, such as ISO/IEC 27001 requirements and the Annex A controls. Ultimately, independence and impartiality protect the credibility of audit results. They give top management, customers, regulators and other interested parties confidence that a certification decision or audit conclusion genuinely reflects the conformity and effectiveness of the ISMS.

The evidence-based approach is one of the seven principles of auditing defined in ISO 19011, which underpins ISO/IEC 27001 Lead Auditor practice. It states that audit evidence is the rational method for reaching reliable and reproducible audit conclusions in a systematic audit process. An auditor must never base findings on assumptions, opinions, hearsay, or personal impressions. Every conclusion about the conformity and effectiveness of an Information Security Management System (ISMS) must be traceable to verifiable information. Audit evidence consists of records, statements of fact, or other information that is relevant to the audit criteria and verifiable. These criteria include the requirements of ISO/IEC 27001 clauses 4 to 10, the Annex A controls, the organization's own policies and procedures, and applicable legal, regulatory and contractual requirements. Evidence is typically gathered through three main methods. The first is reviewing documented information, such as the Statement of Applicability, risk assessment and treatment reports, access logs and incident records. The second is interviewing personnel at various levels. The third is observing activities and processes as they occur. Strong evidence is objective, verifiable, relevant and sufficient. Auditors often triangulate, for example by corroborating an interview statement with a record or a direct observation, to increase confidence. Because audits are conducted within limited time and resources, the approach relies on appropriate sampling. The lead auditor must ensure that samples are representative, because the confidence placed in audit conclusions depends directly on the quality and quantity of the evidence examined. Auditors should also acknowledge the residual uncertainty that sampling introduces, since an audit cannot guarantee that every nonconformity has been detected. Collected evidence is evaluated against the audit criteria to produce audit findings, which may indicate conformity, nonconformity or opportunities for improvement. These findings then support the audit conclusions. Nonconformity statements must clearly reference the requirement, the evidence observed and the nature of the gap. Applying this principle ensures fairness, consistency and credibility. It allows different competent auditors to reach similar conclusions from the same evidence, and it enables auditees to accept the results and act on them with confidence.

In ISO/IEC 27001 Lead Auditor training, the risk-based approach is one of the seven principles of auditing defined in ISO 19011:2018. It means the auditor considers risks and opportunities when planning, conducting, and reporting an audit. Effort goes to the matters that are most significant to the audit client and to achieving the audit objectives, rather than giving every area equal attention.

The approach works at two levels. At the audit programme level, the person managing the programme identifies risks that could prevent the programme from meeting its objectives. Examples include insufficient resources, an audit team without enough information security competence, poor communication, limited access to auditee information, unrealistic schedules, and weak control of audit records. The programme manager then puts measures in place to address them, such as choosing qualified auditors, allowing enough audit time, and securing confidentiality agreements.

At the individual audit level, the lead auditor applies risk-based thinking during preparation and on site. This involves reviewing the auditee's context, information security risk assessment, risk treatment plan, and Statement of Applicability. The auditor uses that information to decide which processes, locations, and Annex A controls deserve deeper examination. High-risk areas usually receive more audit time and larger samples. Examples include privileged access management, handling of sensitive data, supplier security, and incident management. Lower-risk areas may be sampled more lightly.

This matters because audits are limited by time and resources and depend on sampling. A risk-based approach increases confidence that audit conclusions are reliable and that significant nonconformities are not missed. It also keeps the audit aligned with ISO/IEC 27001 itself, whose core requirement is that the organization manage information security risks systematically (Clause 6.1).

A competent ISMS auditor therefore evaluates whether the organization's risk methodology is sound and consistently applied. The auditor also checks whether the controls selected actually address the identified risks. Finally, the auditor confirms whether risk owners have accepted residual risks. Throughout, the auditor stays alert to emerging risks that may justify adjusting the audit plan.

In ISO/IEC 27001 Lead Auditor training, professional responsibility and the code of ethics are the behavioral foundation that makes audit results trustworthy. They are drawn mainly from ISO 19011 (Guidelines for auditing management systems), ISO/IEC 17021-1 and ISO/IEC 27006 (requirements for certification bodies), and the codes of conduct of certifying organizations such as PECB or CQI/IRCA.

Professional responsibility means the auditor is accountable for the quality, accuracy and fairness of every audit activity. The auditor must maintain competence in information security, the ISO/IEC 27001 requirements and Annex A controls, audit techniques, and relevant legal and regulatory contexts, and must keep that competence current through continual professional development. Auditors should accept only assignments they are qualified for, plan and perform work diligently, base conclusions on verifiable evidence, and report findings clearly, even when results are unwelcome to the auditee or the client.

ISO 19011 defines seven auditing principles that underpin ethical conduct. Integrity is the foundation of professionalism: being honest, diligent and impartial. Fair presentation is the obligation to report truthfully and accurately, including unresolved diverging opinions. Due professional care means applying diligence and judgment proportionate to the importance of the task. Confidentiality requires protecting the security of information, which is critical because ISMS audits expose sensitive assets, vulnerabilities and personal data. Independence is the basis for impartiality and objective conclusions. An evidence-based approach ensures conclusions are reliable and reproducible, often through sampling. A risk-based approach focuses audit effort on matters significant to the auditee and to the audit objectives.

A code of ethics typically adds specific obligations: avoiding conflicts of interest, such as auditing an ISMS the auditor helped design or consult on; refusing gifts or inducements that could compromise judgment; not misrepresenting qualifications; treating auditees with respect; and reporting unethical behavior. Violations can lead to suspension or withdrawal of certification. Ultimately, ethical conduct protects the credibility of certification and the confidence stakeholders place in it.

In ISO/IEC 27001 lead auditing, ethical obligations are grounded in the principles of ISO 19011 and, for certification audits, ISO/IEC 17021-1. These principles are integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach. Auditors owe distinct but overlapping duties to three parties. To the audit client, the party requesting the audit (often a certification body or the organization itself), the auditor must deliver an honest, competent and impartial service. This means accepting only assignments within their competence, agreeing clearly on audit objectives, scope and criteria, disclosing any conflict of interest, and reporting findings truthfully and accurately even when they are unwelcome. Reports must reflect the evidence and must not be softened or exaggerated to please anyone. To the auditee, the organization whose information security management system is being audited, the auditor must act with fairness, courtesy and respect. Sensitive information such as risk assessments, vulnerabilities, network designs and personal data must be protected and used only for audit purposes. Auditors should not exploit their position for personal gain, accept inappropriate gifts, or offer consultancy on the system they are certifying, since this compromises impartiality. Observations should be communicated openly at closing meetings so the auditee understands and can respond to nonconformities. To authorities, including regulators, law enforcement and accreditation bodies, auditors must respect applicable laws and contractual obligations. Confidentiality is not absolute: where legislation requires disclosure, for example of serious illegal activity or threats to public safety, the auditor may need to report through proper channels, ideally after consulting the client and legal advisors. Auditors must also cooperate honestly with accreditation oversight and never falsify records. Balancing these obligations demands professional judgment. When duties conflict, auditors should be guided by integrity, legal requirements, professional codes of conduct and transparent communication, thereby preserving trust in the audit process and in certification itself.

In ISO/IEC 27001 auditing, irregularities are deviations from expected practice, such as falsified records, manipulated logs, missing evidence or unauthorized activities. They may result from error or from deliberate intent. Illegal acts are violations of laws or regulations, such as fraud, data protection breaches, unlicensed software use, bribery or unauthorized surveillance. Under ISO 19011 and ISO/IEC 17021-1, auditors must handle these situations according to the principles of integrity, fair presentation, due professional care, confidentiality, independence and an evidence-based approach.

An auditor is not a forensic investigator or law enforcement officer. The audit is not designed to detect every fraud or illegal act. However, auditors must apply professional skepticism. When they see warning signs, such as inconsistent records, reluctance to give access, altered documents or contradictory testimony, they should not ignore them. Auditors should first distinguish an honest mistake from a possible intentional act and gather objective, verifiable evidence. They should avoid accusations or legal judgments.

In practice, an auditor who discovers a possible irregularity or illegal act should take the following steps:
1) Record the facts objectively and keep the evidence.
2) Promptly inform the audit team leader, who escalates the matter to the audit programme manager or certification body and, where appropriate, to the auditee's top management.
3) Stay within the audit scope rather than conducting a separate investigation.
4) Seek legal or compliance advice, especially where confidentiality obligations may conflict with legal duties to report certain crimes to authorities.

If the issue relates to ISMS requirements, such as compliance with legal, statutory, regulatory and contractual obligations (Annex A control 5.31), it may be raised as a nonconformity. Serious issues may affect the validity of evidence, the confidence placed in the ISMS or the feasibility of continuing the audit. In such cases, the team leader may modify, suspend or terminate the audit after consulting the client and the certification body. Throughout the process, auditors must protect sensitive information, remain impartial, and ensure their conclusions are accurate, fair and defensible.

In ISO/IEC 27001 auditing, audit evidence is defined by ISO 19011 as records, statements of fact or other information that are relevant to the audit criteria and verifiable. Auditors compare this evidence against the audit criteria to produce audit findings, so it must be sufficient, appropriate and objective. Evidence is usually gathered through sampling, using interviews, observation and document review. The PECB Lead Auditor approach groups evidence into seven types. Physical evidence is obtained through direct observation, such as seeing locked server rooms, badge readers, CCTV cameras or clean desks. It is highly reliable because the auditor witnesses it firsthand. Mathematical evidence results from calculations performed by the auditor, such as recalculating risk scores, checking the percentage of staff who completed awareness training, or verifying incident metrics. Confirmative evidence is obtained from independent or third parties, such as written confirmations from suppliers, cloud providers or external penetration testers, and helps corroborate the auditee's claims. Technical evidence comes from examining systems and technical controls, such as firewall rule sets, access control configurations, encryption settings, system logs and vulnerability scan results. Analytical evidence is produced by analyzing and comparing data, for example trend analysis of security incidents, reconciling user access lists with HR records, or comparing current results with previous periods to detect anomalies. Documentary evidence includes policies, procedures, the Statement of Applicability, risk treatment plans, records, contracts and meeting minutes. Auditors must verify that documents are approved, current and actually implemented. Verbal evidence is gathered through interviews with management and personnel. It is useful for understanding processes but is considered the least reliable on its own, so it should be corroborated by other evidence types. A competent auditor triangulates evidence from multiple sources, evaluates its reliability, independence and relevance, and records it properly in working papers. This ensures that audit conclusions are based on facts, consistent with the evidence-based approach principle of auditing, and reproducible by another auditor.

In ISO/IEC 27001 Lead Auditor practice, grounded in ISO 19011, the evidence-based approach is a core audit principle. Audit conclusions must rest on verifiable records, statements of fact, or other information relevant to the audit criteria. Two qualities determine whether evidence can support findings: reliability and sufficiency. RELIABILITY concerns how trustworthy the evidence is. Evidence the auditor obtains directly, such as observing a clean desk practice or reviewing firewall rule configurations, is generally more reliable than evidence obtained indirectly or only through interviews. Evidence from independent external sources, such as third-party penetration test reports or supplier certificates, is usually more reliable than the auditee's own claims. Documentary and system-generated evidence, such as access logs, change records and incident tickets, is more reliable when the organization's controls over its creation and integrity are effective. Original documents carry more weight than copies. Evidence confirmed by multiple sources, such as an interview, a document and an observation that all agree, is stronger than a single unsupported statement. Auditors must also consider objectivity, timeliness and possible bias or manipulation. SUFFICIENCY concerns the quantity of evidence needed to give reasonable confidence in a conclusion. It depends on the risk associated with the control or process, the significance of the requirement, the size and complexity of the ISMS scope, and the results of previous audits. Because audits have limited time and resources, auditors use judgmental or statistical sampling. Samples must be representative across sites, time periods and asset types. Higher-risk areas, such as privileged access management, warrant larger samples. Reliability and sufficiency work together. Highly reliable evidence may reduce the quantity needed, but a large volume of weak evidence cannot make up for poor quality. Combined with relevance, these qualities make statements of conformity and nonconformity defensible and repeatable, which supports credible certification decisions.

In ISO/IEC 27001 auditing, guided by ISO 19011 and ISO/IEC 27006, determining the type and amount of evidence is a professional judgment the auditor makes to ensure conclusions are reliable, objective and defensible. Audit evidence consists of records, statements of fact or other information that are relevant to the audit criteria and verifiable. Its quality is judged on two dimensions: appropriateness (relevance and reliability) and sufficiency (quantity).

Types of evidence include: documented information such as the ISMS scope, information security policy, risk assessment, Statement of Applicability and procedures; records such as access reviews, incident logs, training records and management review minutes; interviews with top management, process owners and staff; direct observation of activities and physical controls; technical verification such as checking system configurations, firewall rules or backup restorations; and analytical evidence such as trends in metrics and KPIs. Reliability generally increases when evidence is obtained directly by the auditor, comes from independent sources, is documented rather than oral, and is corroborated. Interview statements should therefore be confirmed through records or observation, a practice often called triangulation.

The amount of evidence depends on several factors: the audit objectives, scope and criteria; the risk and criticality of processes and controls; the size and complexity of the organization; the maturity and effectiveness of the ISMS; results of previous audits and known nonconformities; and available time and resources. Because auditors cannot examine everything, they use sampling. Judgment-based sampling relies on auditor expertise to focus on high-risk areas, while statistical sampling provides quantifiable confidence. Samples should be representative across time periods, locations and personnel.

Auditors should gather enough evidence to support each finding and conclusion, recognizing that audit evidence is based on samples and carries inherent uncertainty. If evidence is insufficient, contradictory or unavailable, the auditor should extend sampling, seek alternative sources, or report the limitation. Planning evidence collection through audit plans and checklists helps achieve efficient, consistent and risk-based evaluation of ISMS conformity and effectiveness.

In ISO/IEC 27001 auditing, laws and regulations applicable to the auditee are the legal, statutory, regulatory and contractual obligations that shape how an organization must protect information. ISO 19011, which guides auditing practice, lists knowledge of these requirements as a core auditor competence. An auditor needs enough understanding of the auditee's legal environment to judge whether the Information Security Management System (ISMS) properly addresses it.

ISO/IEC 27001 builds this into several requirements. Clause 4.2 requires the organization to identify the needs and expectations of interested parties, which include legal and regulatory requirements. Clause 6.1.3 requires risk treatment to consider those obligations. Annex A controls address them directly, including:
- 5.31: identifying legal, statutory, regulatory and contractual requirements
- 5.32: intellectual property rights
- 5.33: protection of records
- 5.34: privacy and protection of personally identifiable information (PII)

Typical examples include data protection laws such as the GDPR, sector rules such as HIPAA or financial regulations, cybersecurity directives such as NIS2, and contractual obligations such as PCI DSS.

The auditor's role is not to act as a lawyer or to certify legal compliance. Instead, the auditor checks that the organization:
- has systematically identified its applicable requirements,
- keeps them up to date,
- has assigned responsibilities for them,
- has put appropriate controls in place, and
- evaluates its compliance.

Useful evidence includes legal registers, compliance assessments, contracts, policies and records of regulatory changes. Failing to identify or address a relevant obligation may be raised as a nonconformity.

Auditors must also follow laws that affect the audit itself. These include confidentiality and data protection rules when handling evidence containing personal or sensitive data, as well as restrictions on cross-border data transfers. This links to the audit principles of confidentiality, integrity and due professional care. When legal interpretation is uncertain, auditors should avoid giving legal advice, record the issue objectively, and recommend that the auditee seek qualified legal counsel.

Understanding the legal context ensures that audit conclusions are relevant, risk-based and credible.

In ISO/IEC 27001 Lead Auditor practice, Big Data refers to the very large, fast-changing and varied information sets an organization generates. Examples include security logs, SIEM events, access records, network traffic, configuration data, ticketing systems and cloud telemetry. Data analytics means using tools and techniques to examine these datasets and find patterns, anomalies, trends and exceptions. In audits, these approaches strengthen the evidence-based approach, a core principle of ISO 19011. Auditors can move beyond traditional sampling and test entire populations of records. Instead of checking 25 user accounts, an auditor might analyze every account to find orphaned accounts, excessive privileges, segregation-of-duties conflicts or access that was not removed after termination. Analytics also supports risk-based auditing. It shows the auditor where controls are weak or where incidents cluster, so audit effort can focus on the areas of highest information security risk. Typical uses include checking that patch management meets defined timelines, testing log review and monitoring controls (Annex A 8.15 and 8.16), and verifying backup success rates. Auditors can also correlate change records with actual system changes and assess incident response metrics. Visualization and dashboards help communicate findings clearly to auditees and top management. However, auditors must apply professional skepticism and due professional care. They must evaluate data integrity, completeness, accuracy and source reliability before relying on results, because flawed data produces flawed conclusions. Confidentiality is critical. Access to large datasets, especially those containing personal data, must respect legal, contractual and privacy requirements such as GDPR, and audit data must be protected and securely disposed of. Auditors need adequate competence in analytic tools, scripting or query languages. They must also understand that analytics complements, but does not replace, interviews, observation and document review. Findings derived from analytics must still be traceable, reproducible and supported by objective evidence. That evidence must be documented clearly to justify conformity or nonconformity decisions within the audit report.

Auditing outsourced operations means evaluating how an organization controls the processes, services or functions it has handed to external providers, such as cloud hosting, data centres, managed security services, payroll or software development. In ISO/IEC 27001, outsourcing never transfers accountability. The organization remains responsible for the confidentiality, integrity and availability of its information, even when a third party handles it. Clause 4.3 requires the ISMS scope to consider interfaces and dependencies with other organizations. Clause 8.1 requires externally provided processes, products or services relevant to the ISMS to be controlled. Annex A controls 5.19 to 5.23 cover information security in supplier relationships, supplier agreements, the ICT supply chain, monitoring and review of supplier services, and the use of cloud services. A lead auditor applies ISO 19011 principles, including evidence-based approach, independence, fair presentation and due professional care, to judge whether these controls are effective rather than only documented. Typical audit activities include: reviewing how the organization identified outsourced processes and assessed their risks; examining contracts and service level agreements for security requirements, confidentiality clauses, incident notification duties, subcontracting limits, data return and deletion terms, and right-to-audit provisions; and verifying supplier selection and due diligence. The auditor also checks evidence of ongoing monitoring, such as performance reports, review meetings, supplier audits and handling of supplier-related incidents and nonconformities. The auditor usually does not audit the supplier directly, because the supplier is outside the audit scope and has not consented. Instead, the auditor assesses the client's oversight. Third-party assurance can be useful evidence, such as a supplier's ISO/IEC 27001 certificate or a SOC 2 report. However, the auditor must confirm that the scope, validity period and relevance of such assurance match the outsourced service. Common findings include: outsourced processes missing from the risk assessment; contracts without security clauses; reliance on certificates that do not cover the services used; and no evidence of periodic supplier review. Each finding shows a gap in control over externally provided operations.

Remote auditing is the use of information and communication technology (ICT) to collect audit evidence and interact with auditees when the auditor is not physically on site. ISO 19011:2018 recognizes remote audit methods, such as video conferencing, screen sharing, document review through secure portals and remote interviews, as legitimate alternatives to on-site activities. For certification bodies, IAF MD 4 sets requirements for using ICT in audits. In an ISO/IEC 27001 context, remote auditing must uphold the core audit principles: integrity, fair presentation, due professional care, confidentiality, independence and an evidence-based approach. Before choosing remote methods, the lead auditor should assess the risks. Key questions include whether the auditee's infrastructure is reliable, whether sensitive information can be shared securely, and whether the technology can provide sufficient, objective evidence. Some controls are difficult to verify remotely, such as physical security perimeters, equipment siting and clean desk practices. These may require live video walkthroughs, hybrid audits or later on-site verification. Auditors must also agree on access rights, recording permissions and data retention, and must protect any evidence they collect, because the audit process itself must not create information security risks. Several technology trends are reshaping auditing. Computer-assisted audit techniques (CAATs) and data analytics allow auditors to test entire populations instead of samples, which can reveal anomalies in access logs, change records or incident data. Continuous auditing and monitoring use automated tools and dashboards to provide near real-time assurance. Cloud services, DevOps pipelines and remote workforces require auditors to understand shared responsibility models and supplier controls. Artificial intelligence and machine learning can support risk-based planning and evidence analysis, but they also bring their own risks, such as bias, lack of transparency and data privacy concerns. Collaborative platforms, digital checklists and secure evidence repositories improve efficiency. However, all of these technologies require auditor competence, a validated toolset and professional skepticism, so that conclusions remain reliable, traceable and defensible.