Audit follow-up and verification of corrective actions is the final stage of the audit process, described in ISO 19011 clause 6.6. It ensures that identified nonconformities are actually resolved, not merely documented. Under ISO/IEC 27001 clause 10.2, the auditee organization must react to each nonconformity by controlling and correcting it and dealing with its consequences. It must then evaluate the need to eliminate root causes, implement corrective actions, review their effectiveness and update the ISMS where necessary. The auditor does not prescribe solutions, which preserves independence and objectivity.

After the closing meeting, the auditee typically submits a corrective action plan within an agreed timeframe. A robust plan distinguishes correction, which is the immediate fix of the symptom, from corrective action, which eliminates the root cause. It should include root cause analysis using techniques such as the five whys or fishbone diagrams, together with assigned responsibilities, resources and target dates.

The Lead Auditor or audit team first evaluates the plan for adequacy, then verifies its implementation and effectiveness. The verification method depends on the severity of the finding. Minor nonconformities may be verified through documentary evidence, such as updated procedures, training records or system logs, or at the next scheduled audit. Major nonconformities usually require an on-site or remote follow-up audit before certification can be granted or maintained, in line with ISO/IEC 27006 requirements for certification bodies. Effectiveness is confirmed when evidence shows that the issue has not recurred and the related control operates as intended.

From an audit programme management perspective, the programme manager tracks the status of all findings, monitors deadlines and escalates overdue actions. Trends in recurring nonconformities are used to adjust audit scope, frequency and risk focus. Results feed into management review under clause 9.3 and drive continual improvement under clause 10.1. A finding is formally closed only when objective evidence demonstrates both implementation and effectiveness. This completes the audit cycle and strengthens the organization's information security posture.

In ISO/IEC 27001 certification, a surveillance audit is a periodic, partial audit carried out by the certification body between the initial certification (or recertification) audit and the next recertification audit. Its purpose is to confirm that the certified Information Security Management System (ISMS) continues to meet ISO/IEC 27001 requirements and is effectively implemented and maintained. Under ISO/IEC 17021-1 and ISO/IEC 27006, certification follows a three-year cycle, and surveillance audits must be conducted at least once each calendar year. The first surveillance audit must take place within 12 months of the certification decision date. Surveillance audits are not full system audits. They are typically shorter, often about one-third of the initial audit duration, and examine a planned sample of clauses and Annex A controls. The audit programme must be designed so that all ISMS requirements and relevant controls in the Statement of Applicability are covered across the cycle. Certain elements must be reviewed at every surveillance: internal audits and management review; corrective actions on nonconformities from previous audits; complaint handling; changes to scope, context, risks, or the organization; progress on information security objectives and continual improvement; the risk assessment and treatment process; and correct use of certification marks. For a Lead Auditor managing the audit programme, surveillance planning should be risk-based, as described in ISO 19011. Planning should take into account previous findings, significant changes, security incidents, new technologies, outsourcing, and areas of higher risk. The Lead Auditor defines the objectives, scope, criteria, team competence, and sampling approach, and then reports findings as major or minor nonconformities, opportunities for improvement, or positive practices. Outcomes affect certification status. If the ISMS remains effective, certification is maintained. If major nonconformities are not corrected in time, the certification may be suspended or withdrawn. Surveillance audits therefore support ongoing assurance, accountability, and continual improvement, so the ISMS does not become a one-time compliance exercise.

In ISO/IEC 27001 certification, a recertification audit is the formal audit a certification body conducts near the end of the three-year certification cycle to decide whether to renew the certificate. It is governed by ISO/IEC 17021-1 and ISO/IEC 27006-1. Its purpose is to confirm the continued conformity and effectiveness of the Information Security Management System (ISMS) as a whole, and its continued relevance and applicability to the certified scope. Unlike surveillance audits, which sample parts of the ISMS each year, the recertification audit covers all clauses 4 to 10 and the applicable Annex A controls. From an audit programme perspective, the certification body must plan the recertification early enough that the audit, any corrective actions and the certification decision are completed before the current certificate expires. Planning considers the ISMS performance over the whole cycle, including previous surveillance reports, complaints, open nonconformities, and significant changes to the organization, its scope, technology, legal requirements or threat landscape. Where major changes have occurred, a Stage 1 type activity may be needed. Audit duration is calculated using ISO/IEC 27006-1 and is typically about two thirds of the initial certification audit time, adjusted for complexity and risk. The audit team, led by the lead auditor, evaluates the effectiveness of the entire ISMS in light of internal and external changes, top management's demonstrated commitment to maintaining and improving it, and whether its operation achieves the information security policy and objectives. Key evidence includes the updated risk assessment and treatment plan, Statement of Applicability, internal audit results, management reviews and corrective actions. Major nonconformities require correction and corrective action, verified by the certification body before expiry. If recertification is completed successfully, the new certificate is valid for a further three years. If it is not completed in time, the certificate expires, although it may be restored within six months if the outstanding recertification activities are completed.

In an ISO/IEC 27001 audit programme, special and short-notice audits are unscheduled audits carried out in addition to the planned cycle of initial certification, surveillance and recertification audits. ISO/IEC 17021-1 (clause 9.6.4) and ISO/IEC 27006-1 govern them for certification bodies, and ISO 19011 guides their place in the audit programme. Special audits are usually triggered by a request to extend the certification scope, such as adding sites, processes or information assets. They may also follow significant changes to the client's ISMS, ownership, organizational structure, technology or risk profile, or be needed to verify corrective actions after major nonconformities. Short-notice audits are conducted with little advance warning. Typical reasons include investigating complaints, responding to serious information security incidents or data breaches, following up on suspended certificates, and acting on credible information that the ISMS no longer meets ISO/IEC 27001 requirements. Their value lies in seeing the organization's actual, unprepared state of control implementation. Several requirements apply. The certification body must describe the conditions for such audits to the client in advance, typically in the certification agreement, so the client knows they may occur. Extra care is needed when appointing the audit team, because the client has limited opportunity to object to team members. The team must be competent, impartial and free from conflicts of interest. For the audit programme manager or lead auditor, these audits must be integrated into risk-based programme management. That means defining clear objectives, scope, criteria and duration, allocating suitable resources, and coordinating logistics such as access to sites, personnel and confidential information. Their outcomes must be evaluated and recorded. Findings may lead to scope changes, corrective action requirements, or decisions to suspend, reduce or withdraw certification, and may prompt adjustments to future audit frequency. Within internal audit programmes, organizations similarly use ad hoc audits after incidents or major changes. This reinforces continual improvement and keeps the ISMS effective between scheduled audits.

In ISO/IEC 27001 certification, governed by ISO/IEC 17021-1 and ISO/IEC 27006, the certification body (CB) can change the scope or status of a client's certificate. Lead auditors and audit programme managers must understand these mechanisms because they protect the credibility of certification.

Extension of certification happens when the client asks to enlarge its scope, for example by adding sites, processes, services or business units to the ISMS. The CB reviews the application and decides what audit activity is needed. This may be a special extension audit, or it may be combined with a surveillance or recertification audit. The CB also adjusts audit time and team competence. An independent decision-maker grants the extension only after reviewing positive audit results. The certificate and the referenced Statement of Applicability version are then updated.

Reduction of certification narrows the scope. It applies when the client has persistently or seriously failed to meet requirements in certain parts of the scope, or when the client voluntarily drops activities or locations. The CB excludes the affected parts, confirms that the remaining scope still meets ISO/IEC 27001, and updates the certificate and public records.

Suspension temporarily invalidates the certification. Typical triggers include:
- persistent or serious failure of the ISMS, including its effectiveness;
- refusal to allow surveillance or recertification audits at the required frequency;
- a voluntary request from the client.

During suspension, the client must stop promoting its certification, and the CB makes the suspended status publicly accessible. Suspension usually lasts no longer than six months. The client must resolve the issues within the agreed timeframe.

Withdrawal permanently cancels the certification. It occurs when the causes of suspension are not resolved in time, when severe breaches such as misuse of certificates are found, or when the client requests it. The client must stop using all certificates and marks, and the CB updates its directory.

Across all four actions, the CB needs objective evidence, documented decisions, enforceable certification agreements and timely communication with the client.

Establishing an audit program is the foundational step in managing ISO/IEC 27001 audits. It follows the guidance of ISO 19011 (Clause 5), supplemented by ISO/IEC 27007 for information security management system (ISMS) auditing. An audit program is the set of one or more audits planned for a specific time frame and directed toward a specific purpose. It ensures that audits are systematic, consistent and aligned with organizational goals rather than conducted ad hoc.

The process begins with defining audit program objectives. These should be consistent with the organization's strategic direction, information security policy and objectives, and ISMS requirements. Typical objectives include verifying conformity with ISO/IEC 27001, evaluating the effectiveness of controls selected through the risk treatment process, and identifying opportunities for improvement. Objectives should consider stakeholder needs, legal, regulatory and contractual obligations, and the organization's risk appetite.

Next, the individuals managing the program must determine and evaluate risks and opportunities that could affect it. Risks may include insufficient resources, poor planning, inadequate auditor competence, ineffective communication, or limited access to information. Opportunities might include combining audits or using remote auditing techniques.

The program is then established by defining roles and responsibilities, particularly for the audit program manager, who must possess competence in audit principles, ISMS concepts, risk management and relevant legal requirements. The extent of the program is determined by factors such as the size, complexity and maturity of the ISMS, the number and criticality of processes and sites, previous audit results, significant changes, and information security risk levels.

Resources must then be identified, including competent auditors and technical experts, budget, time, travel, and tools such as information and communication technologies. Confidentiality and information security requirements for handling audit evidence must also be addressed.

Finally, the program is documented, including audit scope, criteria, methods, frequency and schedules. A well-established audit program supports continual improvement by following the Plan-Do-Check-Act cycle, enabling implementation, monitoring, review and enhancement of auditing activities over time.

In ISO/IEC 27001 audit program management, the Plan-Do-Check-Act (PDCA) cycle gives the audit program a continual improvement structure. It mirrors the improvement logic of the ISMS itself. ISO 19011, supported by ISO/IEC 27007 for ISMS-specific guidance, organizes audit program management around this cycle.

PLAN: The individual managing the audit program sets objectives aligned with the organization's strategic direction, information security policy, legal and contractual requirements, and stakeholder needs. Risks and opportunities affecting the program are identified and evaluated, such as insufficient resources, auditor competence gaps, scheduling conflicts, or confidentiality of sensitive information. The program is then established. This means defining its extent, number, types, duration, locations, and schedule of audits, as well as roles and responsibilities, auditor competence requirements, audit methods, and needed resources. For an ISMS, planning also considers the scope of the ISMS, the results of the information security risk assessment, the Statement of Applicability, and previous audit findings.

DO: The program is implemented. Activities include communicating the program to relevant parties, defining objectives, scope, and criteria for each individual audit, and selecting audit methods. Competent audit teams are assigned, with attention to technical security expertise, and audit team leaders are made responsible for conducting audits. Records such as plans, reports, nonconformities, and corrective actions are managed and protected.

CHECK: The program is monitored to evaluate whether schedules and objectives are being met. This involves assessing audit team performance, auditee feedback, the effectiveness of risk treatment within the program, and the adequacy of records. Trends and deviations are analyzed to see whether the program is delivering value.

ACT: The program is reviewed and improved. Results feed into management review, and changes are made to objectives, resources, methods, or auditor competence development. Lessons learned are incorporated. Examples include adjusting audit frequency for high-risk controls or responding to emerging threats.

Applying PDCA keeps the audit program dynamic, risk-based, and continually improving, rather than a static annual checklist.

In ISO/IEC 27001 auditing, the audit program is the set of audits planned for a specific timeframe and purpose. ISO 19011 Clause 5 guides how it is managed, and ISO/IEC 27006 adds requirements for certification bodies. Resources, procedures and policies together keep the program effective, consistent and credible. AUDIT PROGRAM RESOURCES: The audit program manager must identify and provide what each audit needs. Key resources include competent auditors and technical experts with knowledge of information security, ISMS requirements, Annex A controls, legal and regulatory obligations and the auditee's sector. Other resources include enough audit time, based on organization size, complexity, number of sites and risk; financial resources for travel, accommodation and training; and tools such as audit management software, secure communication channels and remote audit technology. Access to auditee information and facilities is also needed. Ongoing auditor development, through training, calibration and performance evaluation, keeps competence current. PROCEDURES: Documented procedures define how the program works in practice. They cover setting program objectives and scope, assessing program risks and opportunities, scheduling audits, selecting and assigning audit teams, and appointing team leaders. They also cover choosing audit methods, either on-site or remote, managing audit results, nonconformities and corrective action follow-up, and controlling records. Finally, they include monitoring, reviewing and improving the program itself. Consistent procedures help ensure repeatable and comparable audits across auditors and sites. POLICIES: Policies set the principles that govern the program. Common examples are impartiality and conflict-of-interest management, so that auditors do not audit their own work, and confidentiality and protection of sensitive audit information, which is critical when evidence reveals security weaknesses. Other policies address a risk-based approach to planning, evidence-based decision making, ethical conduct, and handling of complaints and appeals. A Lead Auditor must understand and apply these elements. When resources match audit demands, procedures guide execution, and policies protect integrity, the program delivers reliable assurance of ISMS conformity and effectiveness.

In an ISO/IEC 27001 audit programme, managing and protecting audit records means keeping reliable evidence that the programme was planned, carried out and followed up correctly, while protecting the sensitive information those records contain. Clause 9.2 of ISO/IEC 27001 requires the organization to retain documented information as evidence of the audit programme and its results. ISO 19011 (clause 5.5.7) and ISO/IEC 27007 give further guidance. Typical records fall into three groups. Programme-level records include objectives, scope, the risk and opportunity assessment, schedules, resources, and reviews of programme effectiveness. Audit-specific records include audit plans, checklists, sampling decisions, evidence, findings, nonconformity reports, audit reports, and follow-up of corrections and corrective actions. Auditor-related records include competence evaluations, team selection, training, and confidentiality and impartiality declarations. The audit programme manager must ensure these records are identified, complete, accurate, retrievable and kept for a defined period, as required by clause 7.5.3 on control of documented information. Audit records often contain highly sensitive data, such as vulnerability details, network diagrams, risk treatment gaps, personal data and incident histories. They must therefore be protected using the same principles the ISMS promotes. Confidentiality is achieved through role-based access, encryption, need-to-know distribution and non-disclosure agreements. Integrity depends on version control, change logging and tamper-evident storage, so that evidence remains trustworthy. Availability requires secure backups and reliable retrieval for management reviews, certification bodies or legal inquiries. Retention periods should reflect legal, regulatory, contractual and certification-cycle requirements. When that period ends, records must be disposed of securely, for example by shredding or cryptographic erasure. Records that auditors handle off-site or on portable devices need extra safeguards. A Lead Auditor should check that these controls exist and work in practice, because well-managed records show accountability, support continual improvement and preserve the credibility of the whole audit process.

In an ISO/IEC 27001 audit program, quality and complaint management ensure that audits are consistent, credible and continually improved. Guidance comes mainly from ISO 19011 (Clause 5, managing an audit programme) and, for certification bodies, from ISO/IEC 17021-1 and ISO/IEC 27006. Quality management starts with clear program objectives, defined responsibilities, documented procedures and competent auditors. The audit program manager sets quality criteria such as adherence to audit plans, accuracy of findings, timely reports, correct nonconformity grading and evidence-based conclusions. Quality is assured through technical review of audit reports, peer review, witnessed audits, auditor performance evaluation, calibration sessions and ongoing competence development in information security topics like Annex A controls and risk assessment. Monitoring uses performance indicators, including audit completion against schedule, auditee feedback scores, number of report corrections, recurring findings and complaint rates. Results feed the review and improvement of the program, consistent with the Plan-Do-Check-Act cycle, and are recorded to show conformity and support management review. Complaint management provides a structured, impartial way to handle dissatisfaction from auditees, clients or other interested parties. A documented process should cover receiving and acknowledging the complaint, confirming whether it relates to audit activities, gathering and verifying information, investigating the root cause, deciding on actions and communicating the outcome formally to the complainant. To protect impartiality, those investigating and deciding must not have been involved in the audited activity. Confidentiality of complainant and auditee information must be maintained throughout. Typical complaints involve auditor behaviour, conflicts of interest, perceived bias, incorrect findings, scheduling problems or report delays. Valid complaints should trigger correction and corrective action, such as auditor retraining, procedure updates or reassignment, and their effectiveness must be verified. Appeals against audit decisions should follow a separate, equally impartial route. Records of all complaints, analyses and actions must be retained and trends reviewed periodically. Together, quality and complaint management build trust, reduce risk to the audit function and demonstrate a commitment to continual improvement.

In ISO/IEC 27001 auditing, audit programs are classified by the relationship between the auditor and the auditee. Guidance for managing all three types comes from ISO 19011 and ISO/IEC 27007. These standards describe how to set program objectives, assess program risks and opportunities, assign resources, implement audits, and monitor, review and improve the program.

First-party audits are internal audits conducted by, or on behalf of, the organization itself. Clause 9.2 of ISO/IEC 27001 requires the organization to plan, establish, implement and maintain an audit program that defines frequency, methods, responsibilities, planning requirements and reporting. Audits must occur at planned intervals. They determine whether the ISMS conforms to the organization's own requirements and to the standard, and whether it is effectively implemented and maintained. Auditors must be objective and impartial, which typically means they do not audit their own work. Results feed into management review and corrective action.

Second-party audits are performed by parties with an interest in the organization, most commonly customers auditing their suppliers, or by others acting on their behalf. They verify that contractual, regulatory or information security requirements are being met. They support the supplier relationship controls in Annex A, such as controls 5.19 to 5.22 in the 2022 edition. The program is driven by supplier risk, the criticality of outsourced services and contract terms. Results may influence supplier selection, retention or improvement plans.

Third-party audits are conducted by independent external organizations, typically accredited certification bodies, to grant certification. They follow ISO/IEC 17021-1 and ISO/IEC 27006-1, which define auditor competence, impartiality and audit duration. The certification cycle includes a Stage 1 audit that reviews documentation and readiness, and a Stage 2 audit that evaluates implementation and effectiveness. Certification is then maintained through annual surveillance audits and a recertification audit every three years.

For a Lead Auditor, understanding these distinctions clarifies audit objectives, independence expectations, audit criteria, reporting obligations and how findings will be used. This ensures each program adds value while remaining credible to stakeholders.

A combined audit, as defined in ISO 19011, is an audit of two or more management systems of different disciplines carried out together at a single auditee. In the ISO/IEC 27001 context, this usually means auditing an Information Security Management System (ISMS) alongside other systems such as ISO 9001 (quality), ISO 14001 (environment), ISO 22301 (business continuity), or ISO/IEC 20000-1 (IT service management). It differs from a joint audit, in which two or more auditing organizations audit a single auditee together.

For the audit program manager, combined audits require careful planning. Because most ISO management system standards follow the Harmonized Structure (formerly Annex SL), common clauses such as context of the organization, leadership, planning, support, performance evaluation, and improvement can be audited together. This reduces duplication and lowers the burden on the auditee. However, discipline-specific requirements, such as the ISO/IEC 27001 information security risk assessment, risk treatment, the Statement of Applicability, and the Annex A controls, must still be fully evaluated. Merging audits must never weaken the depth of coverage for any standard.

Key program considerations include defining clear objectives, scope, and criteria for each standard; assembling an audit team whose collective competence covers every discipline, as ISO 19011 and ISO/IEC 27006 require; and calculating audit duration appropriately, since certification bodies may apply reductions based on the degree of integration according to IAF MD 11 but must justify them. The audit plan should show which clauses and processes will be examined for each system, and responsibilities should be allocated among team members, with the audit team leader coordinating overall.

Benefits include efficiency, reduced cost and disruption, and a holistic view of how integrated the organization's management systems really are. Risks include insufficient auditor expertise, superficial sampling, and unclear reporting. The audit report should therefore record findings traceable to each specific standard, so that conformity, nonconformities, and certification decisions remain distinct and defensible.

Auditor competence is the demonstrated ability to apply knowledge and skills to achieve intended audit results. Within an ISO/IEC 27001 audit programme, it is the basis for credible, consistent and impartial conclusions about an Information Security Management System (ISMS). ISO 19011:2018, Clause 7, provides the main guidance. Certification bodies must also meet the competence requirements of ISO/IEC 17021-1 and ISO/IEC 27006-1.

Competence has three dimensions. The first is personal behaviour. Auditors should be ethical, open-minded, diplomatic, observant, perceptive, versatile, tenacious, decisive, self-reliant, culturally sensitive and able to act with fortitude.

The second is generic audit knowledge and skills. These include audit principles, processes and methods, sampling, risk-based auditing, evidence evaluation, and familiarity with management system standards, the auditee's organizational context and applicable legal, regulatory and contractual requirements.

The third is discipline-specific knowledge. ISMS auditors must understand information security risk assessment and treatment, the Statement of Applicability, Annex A controls and ISO/IEC 27002 guidance, and security technologies such as access control, cryptography, network security and incident management. They must also understand relevant sector risks and privacy obligations.

Audit team leaders need additional competence. This includes planning audits, using resources effectively, leading and mentoring the team, managing conflict, communicating with top management, and preventing and resolving problems.

The audit programme manager must define competence criteria based on audit objectives, scope, complexity and risk. Competence is acquired through education, work experience, auditor training and audit experience. It should be evaluated with a combination of methods: reviewing records, gathering positive and negative feedback, interviews, observation during witnessed audits, testing, and post-audit review.

When assigning teams, the manager ensures that the team collectively has the required competence. Technical experts may be added where gaps exist, but they work under an auditor's direction.

Finally, competence must be maintained and improved through continual professional development, regular audit participation, and staying current with evolving threats, technologies and revisions to standards such as ISO/IEC 27001:2022. Without demonstrated competence, audit findings lack reliability and the programme cannot fulfil its objectives.

In an ISO/IEC 27001 audit program, monitoring auditor and program performance confirms that audits are delivered competently, consistently and in line with program objectives. The main guidance comes from ISO 19011:2018 (clauses 5.6, 5.7 and 7). Certification bodies must also meet ISO/IEC 27006-1 and ISO/IEC 17021-1.

Monitoring the audit program: The audit program manager checks whether schedules are met and whether objectives are achieved, such as covering all ISMS processes, Annex A controls and sites within the certification cycle. Typical performance indicators include: (1) audits completed on time versus planned; (2) the quality and timeliness of audit reports; (3) how effectively nonconformities and corrective actions are followed up; (4) feedback from auditees, audit teams and top management; (5) whether resources, audit duration and team composition were adequate; and (6) how well the program responds to changes such as new threats, organizational restructuring, incidents or revisions to ISO/IEC 27001. Monitoring also covers risk management of the program itself, including confidentiality of information, auditor availability and the feasibility of remote audits.

Monitoring auditor performance: Auditors are evaluated against the competence criteria defined for the program. These criteria combine personal behavior, generic auditing skills and discipline-specific information security knowledge, such as risk assessment, the Statement of Applicability and technical controls. Evaluation methods include reviewing records, observing auditors during witnessed audits, gathering feedback, testing knowledge, interviews and post-audit reviews of work papers. Results identify training needs, guide team selection and support continual professional development (ISO 19011 clause 7.6).

Reviewing and improving: Monitoring results feed a periodic audit program review (clause 5.7). The review assesses trends, conformity with procedures, emerging needs and stakeholder expectations. Outputs may include changes to audit criteria, methods, frequency, resources or auditor competence requirements. Findings are reported to top management, and records are retained as evidence. This closes the PDCA loop and ensures the audit program itself improves continually, which in turn strengthens assurance over the organization's ISMS.

In ISO/IEC 27001 auditing, professional auditors use a range of tools to plan, conduct, and report audits in line with ISO/IEC 19011 and ISO/IEC 27007 guidance. These tools help keep audits consistent, objective, evidence-based, and efficient across an audit program. First, planning and program management tools support the audit program manager. They include audit program schedules, risk-based prioritization matrices, resource allocation spreadsheets, and audit management software that tracks auditor competence, audit cycles, findings, and corrective actions. These tools help the program cover all ISMS scope areas, clauses 4 to 10, and relevant Annex A controls over the certification cycle. Second, audit working documents guide fieldwork. Common examples are audit plans, checklists, questionnaires, and audit trails mapped to ISO/IEC 27001 requirements and the Statement of Applicability. Checklists aid completeness, but competent auditors use them flexibly and avoid treating them as rigid scripts. Third, evidence-gathering techniques are central. Auditors interview personnel at different levels, observe activities such as physical access control or change management, and review documents and records such as risk assessments, risk treatment plans, policies, logs, and management review minutes. Sampling methods, both judgmental and statistical, let auditors draw reliable conclusions from a manageable volume of evidence. Fourth, technology-assisted tools are increasingly important. Computer-assisted audit techniques and data analytics can analyze access rights, user accounts, or incident logs. Auditors may review outputs from vulnerability scans or configuration reports, but they generally avoid intrusive testing unless it is explicitly agreed. Remote audit tools, such as video conferencing, screen sharing, and secure file exchange, support virtual audits while protecting information confidentiality. Finally, reporting tools include nonconformity report forms, findings registers, audit report templates, and follow-up trackers for corrective action verification. Together, these tools strengthen audit reliability, traceability, and continual improvement of both the ISMS and the audit program. Auditors must also protect any sensitive evidence they collect, in line with confidentiality principles.

In ISO/IEC 27001 auditing, technical knowledge alone does not make an effective auditor. ISO 19011:2018, clause 7.2.2, which guides ISO/IEC 27001 audit programs, states that auditors should have personal attributes that let them act in line with the principles of auditing: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach. An audit program manager uses these attributes to select, evaluate and develop auditors.

The key behaviors are:

1. Ethical: fair, truthful, sincere, honest and discreet, especially when handling sensitive information security data.
2. Open-minded: willing to consider alternative ideas or points of view, such as different ways an organization might implement Annex A controls.
3. Diplomatic: tactful when dealing with auditees, including when reporting nonconformities.
4. Observant: actively aware of the physical surroundings and activities, for example noticing unlocked server rooms or unattended screens.
5. Perceptive: aware of and able to understand situations, including the organizational context and risk culture.
6. Versatile: able to adapt readily to different situations, such as remote audits or changing schedules.
7. Tenacious: persistent and focused on achieving the audit objectives.
8. Decisive: reaching timely conclusions based on logical reasoning and analysis.
9. Self-reliant: acting and functioning independently while interacting effectively with others.
10. Acting with fortitude: willing to act responsibly and ethically even when this may be unpopular or lead to confrontation.
11. Open to improvement: willing to learn from situations.
12. Culturally sensitive: observant and respectful of the auditee's culture.
13. Collaborative: interacting effectively with others, including audit team members and auditee personnel.

These behaviors build trust, make sure findings are objective and evidence-based, and protect the credibility of certification. A Lead Auditor must also show leadership by guiding the team, resolving conflicts, managing time and communicating results clearly. Program managers often assess these attributes through observation, feedback, interviews and performance reviews, and they support continual professional development.