Nazma Ahmed

The first time I sat in the auditee chair, I was extremely nervous wondering if the auditor found the evidence to be sufficient and the management system effective.  It is good experience to experience being an auditee.  A positive outcome is the perfect result for both the auditee and the auditor, however, two specifics experiences come to mind from my auditing years, which were very concerning for both the client and me. 

The first occurrence was when a company who had been adhering to all core processes for many years failed to meet a key requirement, due to change of resources, resulting in a major nonconformity, it was a challenge explaining this to the client, so to be sure I ran it by some colleagues, who indicated my judgement was correct.  Additional leadership team members were brought in to review the findings (nonconformity explained), along with steps, and timeline to address the nonconformity. Management accepted; and the ISMS team remediated the finding timely, to prevent a lapse in the continued certification.

The second event to stand out was when an audit request was made from another MSECB partner, Meeting was scheduled, and during the two hours of the audit, there were major differences between the documentation, and the interviews and interpretations of the team members present.

This was a major challenge; The most surprising thing was there were several OFI’s previously written, none of these were addressed, these did not focus on key differences between, opinion, evidence, documentation, or align to the scope.  My attempt to move forward for another two hours was an obvious sign that the company could not move ahead.  We agreed to a follow-up meeting with the MSECB partner, At the follow-up meeting, I presented the findings, (Major non-conformities), observations and OFIs based on the covered materials. At the end of the meeting, the client and MSECB partner accepted the major flaws in the ISMS.  Clients’ certification was put on hold.