How do we prepare our people for auditor interviews?

Start

The certification audit will include interviews

At Stage 1 the auditor talks mainly to the ISMS manager, with a short meeting with top management. At Stage 2 the auditor interviews top management, the ISMS manager, the control owners and a sample of staff. Interviews test whether the ISMS is understood and followed, not whether people can recite it.

• Then: List everyone the audit plan names

Step

List everyone the audit plan names

Start from the certification body's audit plan. Every person it names should have a mock interview before Stage 2. The auditor also interviews a sample of staff, so brief staff across the teams in scope.

• Then: Which group is this person in?

Decision

Which group is this person in?

Each group is asked different questions, so each prepares differently. Some people are in two groups, such as an ISMS manager who also owns controls. Prepare them for both.

• Top management: Top management: rehearse why, objectives and decisions
• ISMS manager: ISMS manager: rehearse the scope, a risk, and audit results
• Control owner: Control owners: rehearse what the control does, and show it
• Other staff: Staff: check they know the basics of their part

Step

Top management: rehearse why, objectives and decisions

They are asked why the organisation decided to certify, what the security objectives are and how they are going, what the last management review decided, and how they know the ISMS has the resources it needs. The answers should match the minutes. An auditor who finds nobody at the top can answer concludes top management is not involved.

• Then: Brief everyone on how to answer

Step

ISMS manager: rehearse the scope, a risk, and audit results

They are asked how the scope was decided, to walk through one risk from assessment to control, how they know controls work, and what the internal audit found and what happened next. Pick a real risk in advance and check every record along its thread exists.

• Then: Brief everyone on how to answer

Step

Control owners: rehearse what the control does, and show it

They are asked what the control does and how they know it works, to show the last three times it ran, what happens when it fails, and who covers when they are away. Let them answer. If every question goes to the ISMS manager, the auditor concludes the ISMS belongs to one person.

• Then: Brief everyone on how to answer

Step

Staff: check they know the basics of their part

Staff are asked where the security policy is, how they would report a security incident, what training they have had, and what they would do with a suspicious email. These are checks that awareness works. Remind people where things are; do not hand out scripted answers.

• Then: Brief everyone on how to answer

Step

Brief everyone on how to answer

Answer the question asked, then stop, and offer the record that shows it. Say 'I don't know, but I know who does' rather than guess. Be straightforward about gaps and say what is planned. Describe what you actually do. Keep to your own area and point the auditor to the right person for anything else.

• Then: Can each owner produce their records for the period quickly?

Decision

Can each owner produce their records for the period quickly?

Interviews lead straight to records: 'show me' is the auditor's usual next question. The auditor asks for a whole population, such as every leaver in the period, and samples from it. A list that takes a day to build, or turns out incomplete, is itself a finding. If you have not tried, treat the answer as no.

• Yes: Run mock interviews with the internal auditor
• No, or not tried: Build the populations and index the evidence room

Step

Build the populations and index the evidence room

Prepare the lists the auditor is likely to sample for the whole operating period: joiners, movers and leavers, changes, incidents, suppliers, access reviews, training, backup tests and scans. Index them by clause and by Statement of Applicability control, and name a runner to fetch what is asked for.

• Then: Is any record missing that should exist?

Decision

Is any record missing that should exist?

Building the populations often shows a gap: a review that did not happen, or a leaver with no record. Find it now rather than in the interview. If you are unsure whether the record should exist, ask the control owner what the procedure says.

• Yes, or not sure: Treat it as a gap: plan the fix, never back-date
• No: Run mock interviews with the internal auditor

Step

Treat it as a gap: plan the fix, never back-date

Give the gap an owner and a date. In the interview, the owner says it is not done yet and what is planned. A record created or back-dated for the audit looks like what it is, and a gap the auditor finds after it was glossed over does more damage than one admitted.

• Then: Run mock interviews with the internal auditor

Step

Run mock interviews with the internal auditor

Hold them in the weeks before each stage, with each control owner the audit plan names. The internal audit is the rehearsal for the certification audit. The first time someone explains their control aloud should not be in front of the certification body.

• Then: Did anyone describe practice that differs from the procedure?

Decision

Did anyone describe practice that differs from the procedure?

This is what mock interviews are best at finding. An answer that contradicts the records makes the auditor widen the sample. Where practice and procedure differ, the procedure may be the thing to change.

• Yes: Fix the procedure or the practice before the audit
• No: Did control owners pass their questions to the ISMS manager?

Step

Fix the procedure or the practice before the audit

Decide which is right. If the practice is better, update the procedure through document control. If the procedure is right, fix the practice and keep the records that show it. Do not coach people to describe a procedure they do not follow.

• Then: Did control owners pass their questions to the ISMS manager?

Decision

Did control owners pass their questions to the ISMS manager?

An owner who defers every question tells the auditor the control is run by someone else. Owners should answer for their own controls and show their own records.

• Yes: Rehearse those owners again, and let them answer
• No: Ready: people answer from their own records

Step

Rehearse those owners again, and let them answer

Walk through their control with them: what it does, the last three times it ran, what happens when it fails. Then run the mock again, with the owner answering on their own.

• Then: Run mock interviews with the internal auditor (back to an earlier step)

Outcome

Ready: people answer from their own records

Every person on the audit plan has had a mock interview, the populations are ready and a runner is named. Keep the completed readiness checklist as evidence of preparation. If any line is still open two weeks before the audit, raise it with the sponsor that week.