Managing the ISMS audit program: follow-up, surveillance and recertification audits, changes to certification, PDCA in the audit program, audit resources and records, combined audits, auditor competence and performance, and professional auditor behavior.
5 minutes
5 Questions
Managing an ISO/IEC 27001 audit program means planning, coordinating and controlling a set of audits over a defined period, usually a three-year certification cycle, rather than running a single audit. The guidance comes mainly from ISO 19011 (clause 5), ISO/IEC 27007 for ISMS-specific auditing, and ISO/IEC 17021-1 and ISO/IEC 27006 for certification bodies. The process follows the Plan-Do-Check-Act cycle. First, the program objectives are set and aligned with the auditee's strategic direction, information security policy, legal and contractual requirements, and stakeholder needs. Typical objectives include confirming conformity with ISO/IEC 27001, checking how well the controls in Annex A work, and supporting certification or continual improvement. Second, the program manager identifies and evaluates the risks and opportunities affecting the program. Examples are inadequate planning, too few resources, auditor incompetence, poor communication, limited access to sensitive information and ineffective sampling. Third, the program is established. This involves defining roles and responsibilities, ensuring the program manager is competent, and setting the extent of the program: its scope, frequency, sites, audit methods (on-site or remote) and audit criteria. The manager also allocates resources such as time, budget, technical experts and tools. Fourth, the program is implemented. For each audit, the manager defines objectives, scope and criteria, selects methods, and appoints an audit team leader and team based on competence, impartiality and independence. The manager also oversees communication, the handling of confidential information and the management of records. Fifth, the program is monitored to check whether schedules and objectives are being met. This draws on auditor performance evaluations, auditee feedback, complaints and changes in the ISMS context. Finally, the program is reviewed and improved. Lessons learned, nonconformity trends, new threats and technological change feed into updates of the program. For a Lead Auditor, understanding program management ensures that each individual audit fits a coherent, risk-based and value-adding framework that provides reliable assurance about the organization's ISMS.Managing an ISO/IEC 27001 audit program means planning, coordinating and controlling a set of audits over a defined period, usually a three-year certification cycle, rather than running a single audit. The guidance comes mainly from ISO 19011 (clause 5), ISO/IEC 27007 for ISMS-specific auditing, an…
