Design of the Auditing Guideline

[JonathanChristopherson]

• We want to avoid making this a "Practices" guideline, the Practice of auditing will come from another working group.
• If we align with the Code of Practice principals we should be able to get a consistency
• Want to frame the document for auditors who are not used to looking at metrics and making a decision. When an auditor gets to this point, how do they think about it.
• We don't want to change the practice, but we can frame up how metrics are provided to an auditor to enable their analysis and evaluation
• Two parts: How do I trust that the metrics are right, and once I trust that they're right, 2) How do I interpret them / use them?
• Make a repeatable process to frame up the presentation of the metrics as a solution to facilitate the audit. Repeatably enable the organization to collect and present the metrics, and repeatably enable the auditors to use the metrics.
• Present the vision of how one evaluates the metric collection system, assure the integrity of the metrics, and then trust them for the controls around which they make assertions.
• May have a model of using the metrics as a validation that the results of a traditional audit are still upheld by the systems being measured.

[JonathanChristopherson]

We need to create a poll/ask a question in the next session to find out how many of the people in the conversation are auditors.

[JonathanChristopherson]

Should we collect some of this information, as well as introductory information into the PR for the Auditing Document, rather than PR it as a blank document.

• Create a "README.md" starter
• Collect references to existing documentation

[JonathanChristopherson]

Send the seed document out to the group in an email as a pre-read for the next meeting.

[JonathanChristopherson]

@apannetrat , should that email come from you/CSA?