Auditing

[Arviragus]

I have a question that pertains to the requirement for an ISMS to include an audit methodology and schedule (General requirement 4.3.3 and 6.4).

I've got the methodology down and document fine, however, I'm not sure what the standard requires in the scheduling. To be more precise, I'm not sure if the schedule is supposed to a) highlight the control and audit across the organization (i.e. A.5.2 - Information Classification - and then select random documents from various groups and see if they comply wiuth the control requirements), or b) select a specific department and then audit any releveant controls in that group (i.e. HR or IT).

Anyone have any ideas?
_________________
Cheers,
Arviragus

"Paranoia is the only sane approach. In this business, you would be crazy not to be paranoid."

[AndyB]

Whichever approach you want is good, as long as it is documented and the practice is followed. Both your options work as we use a mix of the two depending on department size and area of controls involved. The hardest part in ensuring that you area of personal resoponsibility is also audited to check that you are doing things right, unless you have access to another BS7799 internal auditor.


Andyb