This is where the real audit is performed. The auditors will perform the audit using one or several checklists or audit working papers (AWP) that are described hereunder:
1. Internal Audit Checklist/Observation template – This contains audit test procedures that are specific to the organizational unit to be audited. The assigned auditors are to generate interview questions based on the test steps as they deem appropriate.
2. Management System (MS) Standard Checklist – This contain items or test procedures relating to the requirements of the standards being audited such as ISO 27001 (ISMS), ISO 22301 (BCMS), ISO 20000 (ITSMS), ISO 9001 (QSM), COBIT 5 Assessment, etc.
Audit findings are collected through interviews of responsible persons, document examination and observation of activities and processes in the areas being audit, which is noted against each test procedures or steps performed in the audit checklists as mentioned above. The auditors through its test of controls confirm the effectiveness of the internal control system. Where the controls are inadequate or ineffective in addressing the identified risks, the issues are noted for management attention and remediation. Evidences suggesting non-conformities are noted depending on their significance or materiality, even though not covered by the checklist. Other objective evidence and/or observations that may impact positively or negatively on the area being audited shall also be listed on the space provided on the checklist.
The audit team must display high level of professionalism and due care in all their activities and communicate to the auditee their expectations and concerns. Where conflict or disagreement arises during the audit, the Audit Team Leader should engage the auditee management and ensure that the issues are address amicably and areas of disagreement sorted out with proper explanations. If the Audit Team Leader is not able to resolve the conflict or disagreement amicably, such issue should be escalated to higher authorities through his/her reporting lines.