I spoke in a webinar for UCISA in the last week on how I achieved ISO27001 using the processes and management practices within COBIT5. I also shared some tips about how to ‘manage’ the audit, and turn it from a defensive exercise where you’re constantly sitting waiting for the worst to be requested…. to a positive engagement where you and your auditor strike up a healthy relationship and work together towards accreditation.
Treat your auditor like a temporary part of the team. If there’s a team meeting going on (with a free buffet) then invite them to it. Take them for a coffee, a cigarette… whatever. I’m not saying bribery is the key to passing inspections, but often they’ll meet people who can provide an insight into the culture and competence of the organisation. And it’s a nice thing to do.
It’s obvious you need documentary evidence to get over the line. COBIT5 or other IT management frameworks will give you the start. You can use templates or the examples of others to fill in any gaps you might have. You need to show your internal audit, risk and review processes are all firing on all cylinders. And herein lies that crucial balance between paper and people… you can’t fake it with a briefcase full of documents, just as you can’t talk a good game but not have the evidence to back up your assertions.
In recent years I’ve got organisations ‘over the line’ be it codes of connection for the Public Services or Health networks, Cyber Essentials or ISO9x and 27x. I find it enjoyable and, as one of my earlier blog entries testifies, very satisfying. But it’s not a lone activity – everyone needs to be on board and get the importance of this. One of the interview questions I’ve been asked recently is regarding refuseniks… what do you do with people who don’t get it. My stock response (possibly unsuccessfully) has been to explain the benefits to them and the organisation of having standard approaches, structured knowledge and the confidence that comes with certification.
If you’d like me to help your organisation get certified or accredited please get in touch. And if your typical buffet has sticky sausages… well all the better!