As with ISO/IEC 27006-1, this standard primarily concerns conformity or compliance auditing, a particular form of auditing with a specific goal: to determine whether the audited organisation’s ISMS conforms with (i.e. fulfills all the mandatory requirements specified formally by) ISO/IEC 27001. Such audits are primarily performed for certification purposes.

Other types of audits have different assurance goals. Please don’t make the mistake of assuming that all auditors are so-called “tick-and-bash” compliance/conformity auditors, or that all audits are compliance/conformity audits! Specifically in relation to information risk and security management, competent technology auditors might for instance:

• Evaluate the organisation’s strategies and policies relating to information and privacy risk management, incident management, fraud etc. for aspects such as strategic fit, currency, relevance, readability, coverage, suitability and quality (fitness for purpose);

• Audit workers’ conformity with organisational policies, procedures, directives, guidelines, employment contracts etc., in the general area of information risk, information security and privacy;

• Delve into the root causes of ongoing issues and repetitive incidents, including near-misses and lesser events;

• Examine the governance arrangements in this area e.g. organisational structure, internal and external reporting relationships, information flows within and between management layers, accountabilities, roles and responsibilities ...;

• Audit the organisation’s compliance/conformity with other relevant obligations and expectations, apart from ISO/IEC 27001 e.g. privacy and data protection, intellectual property protection, health and safety, and employment laws and regulations; fire codes and building standards; technical security standards and protocols; supplier, partner and customer agreements and contracts; industry guidelines; ethical codes ... including the associated arrangements such as enforcement actions, and how the organisation stays up-to-date with changes in the requirements;

• Audit the effectiveness and efficiency of the ISMS, including aspects such as the net value (benefits less costs) it generates for the business, and releasing any unrealised potential;

• Examine ‘assurance’, ‘integrity’, ‘confidentiality’, ‘availability’, ‘risk’, ‘information risk management’, ‘compliance’, ‘privacy’ etc. in the broad, deliberately interpreting such words and phrases very widely to take in related aspects that are not usually considered in any depth;

• Review improvements made and explore further opportunities to improve the ISMS;

• Examine the organisation’s potential and actual exploitation of other standards, methods and frameworks relating to information risk and security management;

• Survey, compare and contrast various stakeholders’ opinions, comments and suggestions on the ISMS, teasing-out and addressing deeper, longstanding concerns and points of common interest that might otherwise remain hidden;

• Follow-up on previous ISMS audits, reviews, penetration tests, security assessments, post incident reports etc., delving deeper into areas of concern, extending the scope and picking up on recurrent or widespread issues;

• Examining assurance management e.g. the manner in which various audits or assessments are scoped, approved, resourced, conducted, reported, actioned and closed off, treating ISMS or technology audits as important examples;

• Explore the management aspects of business continuity and resilience;

• Look into the integration and interoperability of various management systems such as the ISMS;

• Audit the organisation’s information management as a whole, such as the integration of risk and security aspects with other business imperatives, and the proactive exploitation of information despite various risks;

• Benchmark the ISMS against comparable organisations or business units, or against other operational management systems e.g. quality assurance, environmental protection;

• Measure and comment on the organisation’s maturity in this general area;

• Review the organisation’s use of security metrics, reports and other management information.

Although that is not even a complete list, there are clearly plenty of creative possibilities here, in addition to the basic conformity-assessment tick-n-bash approach.

One of the best things about auditing is the chance to do something different for a change. Exploit the auditors’ independence, competence, experience, skills, focus, information access, rigorous methods, trustworthiness, access to senior management etc. to delve into aspects that are rarely if ever addressed as part of routine management and operations - potentially including those awkward politically-charged issues that are studiously avoided, and longstanding problems that seem destined to remain, forever.

Some pessimists see audits as information threats to be avoided or minimised: speaking as a former (lapsed? Reformed!) IT auditor and optimist (realist!), I see audits as valuable business opportunities to be exploited to the max. Make the best of them. Milk the value.