Everything you need to know ahead of your internal audit

The most important thing is to ensure your Management System is compliant - although we’re sure you’ll have been thinking about that in advance! Depending on which audit (e.g. Stage 1, Stage 2, Surveillance or Recert) - you may also want to check our guidance on what to expect for it. See the various questions relating to those on the right.

Aside from this (which is a big job in itself!) there is little you need to prepare in advance - other than:

1. making sure that you and the correct people in your team are available during the audit days (see the “Which Team Members are required for our ISO 27001 audit?” section), and that they’re ready to chat to the auditor, and provide evidence as necessary.

2. Ensuring that you’ve given access to the auditor for whatever GRC platform you’re using (if you want to give them access). (see the “Granting Auditor access to any GRC platform you use” section)

An Audit Day typically spans 8 hours. At Tempo, this normally runs from 9am to 5pm UK time - although there may be flexibility to move the start and end times earlier or later by circa 1 hour (if this is something you want, please ask the auditor directly - or another Tempo contact if you’re yet in touch with the auditor). Lunch and morning / afternoon breaks are also scheduled.

The auditor manages the audit and schedule - they’ll share an audit plan with you in advance (preferably at least 1 week in advance of the audit), providing more detail on the schedule. This will break down what will be covered (e.g. what clauses, controls, topics), at what timeslots. It may also cover “Interviews” - for which other team members will be required.

Often the auditor will schedule some time at the end of the day (from 3pm-ish) in which they’ll gather evidence and review/collate their notes - so you might not be required after this point.

The Audit Plan will give some guidance on who needs to attend. Further information on this is covered in the "Which Team Members are required for our ISO 27001 audit?” section.

Tempo and its auditor(s) need to gather sufficient evidence of conformity that we can issue you with your certificate. We cannot issue a certificate until our auditor has gathered evidence of conformity against every clause and applicable control of ISO 27001.

With that in mind, generally speaking, the audit (particularly a Stage 2, or Recertification Audit, which are full-system audits) involves the auditor going through the standard clause-by-clause and control-by-control, looking for evidence of conformity. This means the auditor will specifically explore and ask for evidence from you to exemplify how your ISMS meets the requirements of each clause and control - and your job is to help them find this evidence (although sometimes the auditor can gather this in asynchronous parts of the audit (see the “Asynchronous vs Sychronous ISO 27001 Audits” section).  As the auditor gathers this evidence (perhaps taking screenshots, perhaps taking notes, perhaps asking further questions), they will record this in their report/notes. They may need some time to document and gather evidence as they go - so please be patient as they do so (it’s in your best interest to let them gather more evidence, since this helps to paint a picture of conformity, which we will show to UKAS, our accreditation body!)

________

TOP TIP: As good preparation for an audit, put yourself in the auditor’s shoes - and go through the standard clause-by-clause, and control-by-control, and consider what evidence you’d show the auditor to evidence conformity, and whether this is sufficient? Effectively this is how the auditor will be thinking!

_________

Where there is evidence of non-conformity (or insufficient evidence of conformity), this will result in a non-conformity being recorded (either Major or Minor). There’s no need to worry about getting non-conformities - the auditor will notify you when this happens, and you will be able to resolve them after the audit in your Corrective Action Plan, so that Tempo can proceed to issue your certificate).   See the “Closing Non-Conformities raised at an ISO 27001” section below for more details about this.

It’s also worth noting that nearly every certification audit results in at least some major or minor non-conformities, so do not be concerned if you have these (perhaps even well over 10). It’s not a big concern - and it’s most important that you focus on learning from them and resolving them quickly.

Tempo’s primary goal is to deliver a thorough and effective audit. Sometimes, we can review your documentation asynchronously, using an agile methodology. This means that, for a few hours at a time, you may be able to get on with other things, whilst you auditor reviews evidence on whatever compliance platform / GRC tool you use. However, you will need to be on hand for if/when they want to reconvene to discuss any points raised, ask questions, or request additional evidence as necessary.

If you feel strongly about having more Agile / Asynchronous sections of your audit, or have a preference for working-through the audit alongside your auditor - then please express this to the auditor. We encourage our auditors to be flexible to your requirements.

Agile/asynchronous aspects of an audit are only feasible if you have prepared your evidence in a format that allows the auditor to review on their own. Most commonly this works when you’re using a GRC tool, which stores the evidence for you, and grants the auditor access to review separately - although it could also work if you have downloaded evidence to Google Drive or Dropbox. If this is not the case, then the auditor will need to audit the old-school way - i.e. working through each clause and control with a Guide from your company showing them evidence.

Please also note that fully asynchronous audits are not possible under the requirements of ISO 27006 (which provides guidelines on audit processes for ISO 27001 ) - so even if we incorporate asynchronous elements, we will need your participation in the audit (see the “Which team members are required for our ISO 27001 audit?” section).

If you want your auditor to make use of whatever GRC platform / tool you’re using, you’ll need to make sure you grant access to them in advance of the audit.

We’ve put some guidance for specific platforms below, but if those don’t apply, please speak to your customer success or project manager from your GRC platform / tool to support you with providing this access.

You should have been introduced to your Tempo auditor (and be included on a calendar invite with them), so you will have their email address to give them access.

Should you not want to give the auditor access to a platform or folder, or you are not using a GRC platform / tool, that is not a problem - but it means you will need to work with the auditor to provide evidence throughout the audit day(s) (and no agile / asynchronous elements will be feasible).

DRATA:

Step 1: create Audit
1. Go to "Audit Hub" on left hand menu of Drata platform > click "Create Audit" at top right" > click "Conduct audit in Drata" > add Framework (ISO/IEC 27001:2022 - make sure you select 2022!) > select Audit Period. 
[Please note, the Audit Period 'Start Date' must be when you first set up your ISMS in Drata and the 'End Date' should be a few weeks after your schedule Stage 2/Surveillance/Recertification Audit] •

Step 2: Add Auditor(s)
1. Click "Add new auditor"
2. Add your auditor’s name and email ◦ [N.b. Tempo may request additional auditors or auditors-in-training to have access as well]

VANTA:

[Please note that there are 2 steps to adding an audit on Vanta]

Step 1: Add Tempo
1. Navigate to settings (top right corner)
2. Click on user permissions (hand left side bar)
3. Click on auditors (top center bar)
4. Click on Grant access to your auditor and type in tempo audits

Step 2: Add an audit
1. Go to compliance (left hand side bar) and click on audits
2. Click on add audit and fill out the information requested

The Audit Plan will set out a schedule which will include a lunch break and a shorter morning and afternoon break.

But don’t worry if you need to take additional breaks, or adapt the schedule - our auditors are flexible. If the audit needs to change based on how it's progressing or your circumstances, then it can do. Feel free to ask for breaks whenever needed. We understand that remote audits, , might come with occasional interruptions (whether you need to get the door for a delivery, or make another cup of tea) – that's no problem at all! Just let the auditor know and you can take 5/10 minutes!

As standard, we schedule 8 hour audit days and share calendar invites to block out the dates in advance. The calendar invites typically start at 9am UK time and finishing at 5pm UK time. 

Often the auditor schedules some time at the end of the day (from 3pm-ish) to gather evidence and review the notes, which means that your day might end a bit earlier.

If you have a preference to change the audit times (e.g. move the start time to 8am or 10am UK time - and finish one hour earlier or later accordingly), let us know and we will aim to update. A 1 hour or 30 minute earlier or later start time should rarely be a problem - but ultimately, it will be for the Auditor to confirm this works for their schedule, since they are responsible for managing the audit.

If your audit is remote, make sure you have a strong WiFi connection. Log in beforehand and choose a quiet location with good audio. Check your headphones and equipment in advance. If you foresee any problems, please let Tempo know as soon as possible. 

Tempo usually uses Google Meets, but we’re happy to switch to Zoom or Microsoft Teams if that's better for you. Just let Rob or someone else in the team know your preference.

Tempo has calculated the audit length based on your company's size and circumstances, according to the “audit length” requirements of ISO 27006 - and we fully expect to deliver the audit completely within this time, so it's safe to assume that, by the end of the closing meeting, you'll be fully done (save for closing out any non-conformities highlighted, which happens afterwards - see the “Closing Non-Conformities raised at an ISO 27001 audit” and “When will we get our ISO 27001 certificate” sections).

Your auditor will be responsible for managing the speed of the audit to ensure that everything is delivered within the allotted audit time, and it is highly unlikely that any extra time will be required. (Although if time is running short towards the end of the audit, that might mean slightly shorter breaks!).

In limited circumstances (typically where there has been some unforeseen circumstance that has delayed the auditor's availability to review evidence, such as: inaccessibility of evidence, the GRC platform you're using not working, unavailability of auditees, or auditees repeatedly struggling to find evidence promptly) then extra time might be required. In this instance, the auditor will communicate this with you, and arrange additional time with you before the end of the audit. Tempo will need to invoice for such extra time.

Tempo tries to be as understanding as possible to accommodate your needs to vary your audit dates.

Make sure you notify the Tempo team (including your auditor, who ultimately will be the person who needs to arrange the new dates) as soon as possible, so that they can start looking into rearranging the dates.

However, it’s also worth noting the contractual position set out in Tempo’s Terms & Conditions (Clause 9 - Postponement and Cancellation”). This states that, if notification of the postponement/cancellation happens between 28 days and 13 days before the days in question, you will be charged half the agreed fee for the cancelled/postponed days (in addition to the cost of the re-arranged days). If the cancellation comes less than 14 days before the day(s) in question, you will be charged the full fee for the cancelled days (in addition to the cost of the re-arranged days).

Whilst this is Tempo’s contractual position, we will do our best to avoid charging you for the rearrangement where possible. The term in the contract is included because our auditors (who are typically contractors themselves) may not be able to find additional work at the last moment to replaced the cancelled days, and will therefore suffer loss of long-pre-scheduled earnings. They have similar terms in their contract with Tempo, so if they hold us to the terms, we will pass that on to you (and please do not be offended if that is the case).

Equally, if your auditor is happy to rearrange (as they normally are), then Tempo will proceed without holding you to the terms in the contract.

The only other thing to note - often your auditor’s diary is very booked up in advance. If you postpone your audit, you will need to work to your auditor’s next upcoming availability - so please do not be surprised if the rearranged audit ends up being later than you ideally would have wanted.