The auditor needs seven things, ideally a week before fieldwork starts.
- Scope statement: which parts of the company, locations and systems the ISMS covers.
- Statement of Applicability: which Annex A controls apply, which do not, and why.
- Risk assessment and risk treatment plan: the risks you identified and the controls chosen for each.
- Approved policies and procedures: access control, incident management, supplier management and the rest.
- Earlier findings: reports from a gap analysis, a previous internal audit or a certification audit, with the status of corrective actions.
- Read access to evidence systems: typically the ticketing tool, the identity provider, the cloud console and the HR system. Screen-share sessions work where read access is not possible.
- Control owners and interview slots: who is responsible for which control, with 30 to 60 minutes booked for each.
Sending this in advance changes the audit. An auditor who has already read the risk assessment can go straight to testing whether the chosen controls work. It often saves about a day of fieldwork.