Which two of the following are examples of audit methods that ‘do not’ involve human interaction?

Which two of the following are examples of audit methods that ‘do not’ involve human interaction?
A . Conducting an interview using a teleconferencing platform
B . Performing a review of auditees procedures in preparation for an audit
C . Reviewing the auditee’s response to an audit finding
D . Analysing data by remotely accessing the auditee’s server
E . Observing work performed by remote surveillance
F . Confirming the date and time of the audit

View Answer

Answer: BD

Explanation:

Audit methods are the techniques and procedures that auditors use to collect and evaluate audit evidence. Audit methods can be classified into two categories: those that involve human interaction and those that do not. Human interaction methods are those that require direct or indirect communication with the auditee or other relevant parties, such as interviews, questionnaires, surveys, observations, or walkthroughs. Non-human interaction methods are those that do not require any communication with the auditee or other parties, such as document reviews, data analysis, or remote surveillance.

Some examples of audit methods that do not involve human interaction are:

Performing a review of auditee’s procedures in preparation for an audit: This method involves examining the auditee’s documented information, such as policies, processes, records, or reports, to verify their adequacy and effectiveness in meeting the audit criteria. The auditor does not need to interact with the auditee or anyone else to perform this method. Analysing data by remotely accessing the auditee’s server: This method involves accessing and processing the auditee’s data, such as performance indicators, logs, metrics, or statistics, to verify their accuracy and reliability in meeting the audit criteria. The auditor does not need to interact with the auditee or anyone else to perform this method.

Reference: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) objectives and content from Quality.org and PECB

ISO 19011:2018 Guidelines for auditing management systems [Section 6.2.2]