Who will need to be available for our external audit?

This article outlines the people who need to attend your external audits. How long each person needs to be available depends on their role in your management system, and on the auditor.

How auditors run external audits

Every auditor has their own style and runs audits differently.

• Some auditors run most of the audit asynchronously. There is an opening call and a closing call, and for the rest of the day you are on standby in case they need an ad hoc meeting.
• Others send a detailed schedule of meetings across the audit window.

The more evidence you upload, the less time the auditor needs to spend on calls with you.

Your external auditor will send you a detailed audit plan before the audit, so you can make sure the right people are available.

Who needs to attend

Stage 1

• The ISMS/IMS Manager(s)
• A representative from top management, to discuss leadership commitment. They are usually only needed for the opening and closing meetings.

Stage 2

• The ISMS/IMS Manager(s)
• A representative from top management, to discuss leadership commitment. They are usually only needed for the opening and closing meetings.
• Anyone who owns or can explain the evidence for your registers or for specific controls (Organisational, People, Physical and Technological controls), or who can give further examples of evidence if the auditor asks.
• A member of staff chosen by the auditor. The auditor may ask them about their awareness of your management system and check their device.

Remote and on-site audits

If you don't have an office, the audit is fully remote.

If you do have office space, the auditor will usually need to visit one or more of your offices during your Stage 2 audit to collect evidence. The auditor will arrange this with you directly.

Related articles

• What can I expect on the day of an internal audit?
• How do I create an audit and management review schedule?
• How do I collate evidence for my SOC 2 Audit?