Generating Audit Findings and Working Paper Documentation

Generating Audit Findings and Working Paper Documentation

The culmination of evidence collection in an ISO/IEC 27001 audit is the synthesis of raw data into objective audit findings. According to ISO 19011:2018 (Clause 6.4.8), audit findings are the results of the evaluation of the collected audit evidence against specified audit criteria. Audit criteria comprise the policies, procedures, standards, and requirements against which the auditor compares evidence—specifically ISO/IEC 27001:2022 Clauses 4–10, selected Annex A controls, legal/regulatory mandates, and the organization's internal ISMS documentation.

To ensure findings withstand peer review, accreditation oversight, and auditee scrutiny, Lead Auditors must document their work in standardized working papers and articulate findings using clear, evidence-based finding statements.

---

1. Categorization of Audit Findings

Audit findings are classified into three distinct categories under third-party certification rules (ISO/IEC 17021-1 Clause 9.4.5):

                          [ AUDIT EVIDENCE ]
                                  |
                      Evaluated Against Criteria
                                  |
           +----------------------+----------------------+
           |                      |                      |
    [ CONFORMITY ]        [ NONCONFORMITY ]            [ OFI ]
   (Meets Criteria)       (Fails Criteria)     (Opportunity for
                                  |              Improvement)
                       +----------+----------+
                       |                     |
               [ MAJOR NC ]          [ MINOR NC ]
             (Absence/Total         (Single Lapse/
               Breakdown)            Partial Gap)

Definitions and Thresholds

1. Conformity: Fulfillment of an ISO/IEC 27001 requirement, internal policy, or control objective. Supported by verifiable evidence.
2. Major Nonconformity: A nonconformity that affects the capability of the management system to achieve intended outcomes. Occurs when:
   • There is a total absence or complete breakdown of a mandatory ISO/IEC 27001 requirement (e.g., no risk assessment performed, no internal audit).
   • A combination of multiple minor nonconformities indicates a systemic system breakdown.
   • A nonconformity directly results in a severe information security breach or unmitigated catastrophic risk.
   • Impact: Prevents certification or recertification until corrective action is verified on-site.
3. Minor Nonconformity: A single operational lapse or partial failure that does not undermine the overall capability of the ISMS to achieve its security objectives (e.g., one missing approval signature on a patch ticket, or an outdated contact list in an emergency procedure).
   • Impact: Does not block certification issuance, provided a satisfactory Corrective Action Plan (CAP) is submitted within agreed timeframes.
4. Opportunity for Improvement (OFI): A statement of fact observing a situation that is currently compliant, but where efficiency, robustness, or best practice could be enhanced.
   • Constraint: Auditors must NEVER provide specific consulting solutions or advice when documenting an OFI, as this violates auditor independence under ISO/IEC 17021-1.

---

2. Structure of an Objective Audit Finding Statement (The 4-C Model)

To prevent ambiguity and ensure auditee understanding, every nonconformity statement must follow the 4-C Model:

---

3. Working Paper Standards and Traceability Matrix

Working papers are the confidential files created and maintained by auditors during an audit engagement. They constitute the legal and professional record supporting the final audit report.

Key Requirements for Working Papers (ISO 19011 Clause 6.4.7)

• Traceability: Any third-party auditor reading the working paper must be able to trace the finding back to the exact evidence, sample item, interviewee, and criteria.
• Clarity and Objectivity: Facts must be recorded dispassionately without emotional or speculative language.
• Confidentiality and Security: Working papers contain sensitive client data and must be encrypted at rest and in transit.

Standardized Working Paper Indexing Structure

---

4. Conducting Interim Review Meetings with Auditee Management

Prior to drafting the final audit report and holding the formal Closing Meeting, the Lead Auditor conducts interim review meetings (daily debriefings) with auditee management.

Objectives of Interim Meetings

1. Present Draft Findings: Share preliminary nonconformities while evidence is fresh.
2. Verify Facts: Allow the auditee to review the sample evidence and confirm factual accuracy. If the auditee produces additional verifiable evidence that was previously overlooked, the Lead Auditor adjusts the finding accordingly.
3. Resolve Disagreements: Address any differences of opinion regarding criteria interpretation before the formal Closing Meeting.

---

5. Worked Scenario: Resolving Major vs. Minor Nonconformity Disagreements

Background

During an interim review meeting at DataVault Inc., Lead Auditor Elena presented draft finding NC-01 against Annex A 8.24 (Use of cryptography). Elena documented that during her audit of the backup storage environment, DataVault was storing database backup tapes containing unencrypted personal healthcare information (PHI) at an off-site facility.

DataVault's CISO strongly disputed the classification of the finding as a Major Nonconformity, arguing: "This should be a Minor Nonconformity or an OFI. All our live production databases are encrypted at rest using AES-256. The off-site unencrypted tapes are legacy backups from two years ago that are rarely accessed, and the physical warehouse is guarded 24/7."

Auditor Analysis & Decision

Elena reviewed the audit criteria and evidence:

1. Criteria Review: ISO/IEC 27001:2022 Annex A 8.24 requires that rules for the effective use of cryptography, including key management, be defined and implemented for sensitive data across its lifecycle.
2. Policy Review: DataVault’s internal Encryption Policy explicitly stated: "All electronic media containing PHI at rest, in transit, or in off-site storage MUST be encrypted using AES-256."
3. Risk Analysis: The unencrypted tapes contained over 500,000 unencrypted patient records. Physical security at a third-party warehouse does not eliminate the risk of media theft, insider threat, or loss during transit.
4. Systemic Absence: Cryptography was completely absent for off-site backup storage, representing a total control failure for that environment.

Outcome & Resolution

Elena explained the 4-C rationale to executive management during the interim meeting:

• Condition: 500,000 PHI records stored off-site without encryption.
• Criteria: Annex A 8.24 and DataVault Encryption Policy v2.0.
• Cause: Backup procedures omitted encryption controls during legacy archiving.
• Consequence: Severe breach exposure and catastrophic regulatory fines under health data protection laws.

Elena maintained the classification as a Major Nonconformity. Because Elena presented fully corroborated evidence and explained the 4-C framework dispassionately during the interim meeting, the CISO accepted the finding, signed the working paper acknowledgment, and initiated immediate remedial encryption prior to the Closing Meeting.