PECB Webinar: ISO Internal Audits - A signpost to ISO compliance

www.digitaljewels.net
ISO Internal Audits-
A signpost to ISO compliance.
-OladapoOgundeji

Profile : Oladapo Ogundeji.
 Professional career extends over 18 years of experience focused on enhancing the strategic
value of ICT in organisations through process re-engineering, strategic planning and project
management for corporate objective & strategy that address business opportunities and
issues.
 A highly trained ICT Management Specialist & Consultant.
 Masters In Information Technology ( M.I.T )
 B. Sc. Electronics & Electrical Engineering.
Past roles/positions
 Head of User Support & Service Desk
 IT Manager
 Project Manager – Technical Services
 Deputy Head – Network Systems
 Project Leader
 Project / System Engineer
CTO/CISO - Digital Jewels Limited.
A specialised Information Value Chain Consulting
Firm offering specialised IT & PM Consulting &
Capacity Building Services
Contact: +2348099930209 ; dapoo@digitaljewels.net

Qualifications...
 COBIT 4.1/5.0 Foundation & Certified Trainer
 Business Continuity Management : ISO22301/ BS25999 Certified MASTER & Accredited Trainer
 ISO 27001 Certified Lead Implementer Certified & Trainer
 Certified IT Business Manager (ITBMC)
 PRINCE2 Foundation Certificate (Project Management Methodology).
 ISACA : C I S A // C I S M // C G E I T (Exams Passed )
 IT Service Management Foundation (I T I L)
 RAD Datacommunication Specialist & Engineer.
 HP (COMPAQ) : Accredited Compaq Technician (A C T) // Accredited Platform Specialist (A P S)
 Microsoft Certified Professional: ( M C P) // Microsoft Certified Professional + Internet: ( M C P + I) //
Microsoft Certified Professional + Internet: ( M C P + I) // Microsoft Certified System Engineer : ( M C S E)
// Microsoft Sales Specialist : ( M S S)
 Cisco Certified Network Associate ( C C N A ) // Cisco Certified Network Professional ( C C N P ) // Cisco
Certified Design Associate ( C C D A ) // Cisco Certified Design Professional ( C C D P ) // Cisco Sales Expert
(CSE )
 BICC Brand-Rex (Structured Cabling) Certified Installer.
 TOGAF 9.1 Certified [+ Foundation]
 MoR (Management of Risk) Certified & Accredited Trainer

WHY you should do ISO
Internal Auditing?
WHO should do ISO Internal
Auditing?
HOW you should do ISO
Internal Auditing?
WHEN you should do ISO
Internal Auditing?
AGENDA

ISO International Standards ensure that
products and services are safe, reliable
and of good quality. For business, they
are strategic tools that reduce costs by
minimizing waste and errors and
increasing productivity.
Over 19000
ISO
Standards….

Quality system audit
• An overall measurement of an
organisation’s capability to
meet the requirements of a
standard
Management audit
• Checks to see if a business‘s
strategic plan reflects its
business objectives and has
met the requirements of the
intended market
Process audit:
• Focuses specifically on single
processes to verify that they
are capable of delivering the
necessary outputs
Procedural audit
• Verification that documented
practices are sufficient to
ensure the implementation of
approved policies and can
control operations
System audit
• Ensures a business
management system is
sufficiently comprehensive to
control all of the activities
within that business
Types of Audit

Internal Audit
• Performed within an organization to measure its
strengths and weaknesses against its own
procedures or methods and/or against external
standards adopted by (voluntary) or imposed on
(mandatory) the organization.
• Conducted by auditors who are employed by
the organization being audited.

Why ISO ?

Cost savings
Access to new markets

Increased market share

WHY you should do ISO
Internal Auditing?

Benefits of ISO Internal Audit
To prepare the organization for ISO
Certification
Increased Performance- Allows the
organization to continually improve
their ISO certification
Compliance- Conformity to the
requirement of ISO Standard

Preparedness For Certification
One of the requirements of ISO
"Auditable" standards is that you
‘shall conduct internal audits at
planned intervals to determine
whether the xxxxx management
system conforms to the
requirements of ISO xxxxx and to
the requirements established by
the organisation; and is effectively
implemented and maintained.’

Increased
Performance

ISO Certification Process
1. ISO
implementation
2. Internal audit and
review of ISO x
(by the auditee)
3. Selection of
a certification body
5. Stage 1 audit
4. Pre-assessment
audit (optional)
7. Follow-up audit
(if applicable)
8. Confirmation
of registration
6. Stage 2 audit
(on-site audit)
BeforetheauditInitialaudit
Followingthe
audit
9. Continual
improvement and
surveillance audit

Key Auditing Roles
• ISO 19011, Clause 3.6 to 3.10
Organization or person requesting the audit
Auditee
Auditor
Expert
Audit team
Audited organization
Competent person conducting the audit
Person who provides specific knowledge or
expertise to the audit team
One or more auditors conducting an audit,
supported if needed by technical experts
Client
(Sponsor)

• Certified ISO Auditors
• Risk Managers
• Compliance officers
• An auditor should be objective and impartial. You cannot audit
processes that you manage / control yourself. This means the
organisations will need to have at least two internal auditors trained
and available. However, due to lack of resources, or sometimes with
the crossover of responsibilities that is common in small businesses,
having two impartial auditors may not be possible. In this case, you
may need to consider using an external resource.
• Large organisations may use a team of auditors.

Competences of Internal Auditors
• ISO 19011, Clause 7
Personal behaviours
Initial
training
Professional
experience
Auditor
training
Audit
experience
Knowledge and
aptitudes for all
management
systems (7.2.2.1)
Knowledge and
aptitudes of each
management
system (7.2.2.3)
(7.2.1)
(7.2.3)

Personal Behaviours
• ISO 19011, Clause 7.2.1
5. Perceptive
9. Self reliant4. Observant
8. Decisive3. Diplomatic
7. Tenacious2. Open minded
10. Acting with fortitude
14. Team player
13. Culturally sensitive
12. Open to
improvement
6. Adaptable1. Ethical 11. Well organized
Personal behaviours

Generic Knowledge and Competencies
• ISO 19011, Clause 7.2.2.1
Evaluation and
management of audit
risks and those related
to the operation of a
management system
Main processes present
in all organizations (HR,
Finance, Production,
etc.)
Prepare, conduct and close an
audit, written and oral
communication of audit
conclusions
Operation of a
management system
and interaction
between systems
Main laws and
regulations, contract
clauses
Audit
principles
Audit
risk
Management
system
Organiza-
tional
process
Legal
aspects

Responsibility of Auditors

How you should do
ISO Internal Auditing ?

What Is an Audit?
• Systematic, independent and documented process for obtaining
audit evidence and evaluating it objectively to determine the extent
to which the audit criteria are fulfilled
• ISO 19011, Clause 3.1
Auditing means asking the auditee
what he/she does, and checking
to see if he/she does it

Audit Best Practices
Generally accepted
audit standards
International Federation
of Accountants
Information Systems Audit
and Control Association
ISO 19011:2010
Institute of internal
auditors

Audit Standard - Management System
ISO 10011
Quality
ISO 14010 series
Environment
ISO 19011:2002
ISO 19011:2010
Environment and Quality
Management system
Any management system

ISO xxxx Internal Audits
• The organization shall conduct ISMS internal audits at
regular intervals
• An audit program must be
planned taking into account the
importance of processes and
scopes to audit, as well as
previous audit results

ISO 19011 - Audit guide for management systems
1. Scope
2. References to standards
3. Terms and definitions
4. Audit principles
5. Managing an audit program
6. Audit Activities
7. Competence and evaluation of
auditors

Audit Criteria
Note: Audit criteria are used as a reference against which audit evidence is
compared

Types of Audits
Second Party Audit
Our organization audits
our supplier
Second Party Audit
Our customer audits
our organization
Third Party Audit
Our organization
is audited by an
independent
organization
Customer Supplier
External
Internal
Organization
First Party Audit
Our organization audits
its own systems

Audit Principles
• ISO 19011, Clause 4
Ethical
conduct
4A
Fair
presentation
4B
Due Professional
care
4C
Confidentiality
4D
Independence
4E
Evidence based
approach
4F

Evidence Based Approach
• ISO 19011, Clause 4f
Evaluated
objectively
Obtained
objectively
Information Evidence

Type of Evidence
1. Physical
2. Mathematical
3. Confirmative
4. Technical
5. Analytical
6. Documentary
7. Verbal

Sampling
Why
What
How
Because an auditor cannot
verify everything
Selection of a sample
(probabilistic or
non-probabilistic)
Random sampling or
judgement based

Balance Between Evidence and Criteria
Evidence Criteria

Auditing Perspectives
• Every audit situation should be examined from three perspectives:
1. Intent: “Have you said what you do?”
Do the defined or documented processes adequately express
your approach?
2. Implementation: “Have you done what you said?”
Do the observed and recorded practices show conformance
with the stated intent? Auditors often struggle with, or
overlook, assessing how well the system has performed.
3. Effectiveness: “Have you done it well?”
Do the results of the process indicate the desired outcomes
have been achieved? ISO 9000 defines “effectiveness” as the
extent to which planned activities are realized and planned
results are achieved. In other words, to judge effectiveness
you look not only at the conformance of a process, but also at
its results compared to its objectives.

When you should do
ISO Internal Audit?

• Internal quality audits are usually planned and
initiated by the Audit unit or department. They
will relate to the status and importance of the
activities involved in a section or deliverable
from your business. For large organizations, it
would be quite normal for each department
and section to be subject to at least three
complete quality audits a year.
• Internal Audits need to be scheduled at
planned intervals to check that the quality
system conforms to requirements and that the
system is effective. ‘Requirements’ include the
standard itself, as well as the company’s own
requirements (i.e., its own procedures and
policies).
Audit Schedule

• You don’t need to audit every process all at
one time. The External Audit may be like
this, but internal audits can be spread out
with different processes audited at different
times – a series of ‘mini-audits’.
• The ISO standard does not set out a required
audit frequency. Instead, it recommends
that you consider how important the
processes are, their risks, their prior history
of problems, and also your quality
objectives. With a series of ‘mini-audits’ you
can set different audit frequencies for
different processes.
• If you are implementing a new management
system, it is recommended that you should
have audited all the processes identified in
your management system at least once prior
to the initial Certification Audit.
Audit schedule...

Plan:
Define the
audit
programme
Do:
Implement
the audit
programme
Check:
Review the
audit
programme
Act:
Improve
the audit
programme
Audit Program
The Plan-Do-Check-Act model can be applied to the management of internal
audits:

Audit Critical Success Factors
• Executive or Top Management commitment & buy-in: active &
sustained
• Early Audit Team, Programme and Charter setup
• Appropriate Audit training for the Auditors and Awareness for
other staffs
• Prompt approval and implementation of recommendations from
the Audit closeout plans.
• Resource sufficiency & availability
– Auditors
– Auditees
– Audit Tools
– Logistics and Welfares.
• A readiness to comply with the
requirements of the ISO standard and
maintain the ISO standards

for your time & attention…
A presentation by Oladapo OGUNDEJI.
CTO / CISO, Digital Jewels Ltd
dapoo@digitaljewels.net

PECB Webinar: ISO Internal Audits - A signpost to ISO compliance

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à PECB Webinar: ISO Internal Audits - A signpost to ISO compliance

Similaire à PECB Webinar: ISO Internal Audits - A signpost to ISO compliance (20)

Plus de PECB

Plus de PECB (20)

Dernier

Dernier (20)

PECB Webinar: ISO Internal Audits - A signpost to ISO compliance