After reading, you can write a checklist that guides the audit without limiting it, and leaves usable evidence behind.
Definition
ISO 19011 treats checklists as work documents that help auditors keep track, and it warns that they must not restrict the audit. Whatever comes up along the way still deserves following.
Why it matters
It makes sure the scope gets covered, and afterwards it shows what was and was not checked.
A less experienced auditor also gains a structure that keeps their work consistent.
How it works
Take the criteria in scope. For each one, write what you expect to see in practice, the documents and records to request, and the people to meet.
Decide your samples in advance: how many, over what period, and how they will be chosen.
During the audit, record the evidence precisely, with the document name, version, date and record numbers seen. End each line with a result.
A worked case
Criterion: ISO/IEC 27001 control 5.18, access rights. The auditor expects a yearly review signed by system owners, and requests the last review of the finance system plus the list of 15 staff who joined or changed role this year.
The evidence is a review of 14 February signed by the CFO, and 15 of 15 access changes approved. Result: conforming.
Good practices
- Describe the practice you expect to see. Copying the wording of the standard adds nothing.
- Leave room on each line to record the evidence.
- Prepare a fresh version for each audit, using what the last one found.
- Follow what you discover, even when it is off the list.
Common mistakes
- Reusing last year's list without looking at what changed.
- Asking closed questions and accepting a yes. People tend to answer what you seem to want to hear.
- Turning the audit into form filling, so that the auditor stops looking up from the page.
- Writing “checked” with no reference, which leaves nothing to rely on later.
Questions
- Is an audit checklist mandatory?
- No. ISO 19011 lists it among the work documents an auditor may prepare.
- Should the checklist be shared in advance?
- The audit plan is shared. Sending the list of records to prepare saves time, as long as the auditor still chooses samples on site.
- How many lines does an audit checklist need?
- As many as the scope and time allow you to check properly, which is usually far fewer than the full text of the standard.
- What sample size is right for an audit?
- No single figure fits. It depends on the population, the risk and the frequency of the control. Write down how you chose.
- Can results be anything but pass or fail?
- Yes: conforming, nonconforming, opportunity for improvement and not audited are all useful results.