You are an experienced ISMS audit team leader who is currently conducting a third party...

Leadership and commitment is a key requirement of ISO/IEC 27001:2022, as it establishes the top management’s role and responsibility in establishing, implementing, maintaining, and continually improving the ISMS. Without assessing this aspect, the audit team cannot conclude that the ISMS is effective and conforms to the standard. Therefore, the audit team leader should advise the auditee and audit client that it is not possible to make a positive recommendation at this point, and explain the reason and the implications. The audit team leader should also consult with the certification body and the audit programme manager on the next steps, such as extending the audit duration, conducting a follow-up audit, or issuing a conditional certification, depending on the certification body’s policy and the audit client’s agreement. References: =

ISO/IEC 27001:2022, clause 5, Leadership

PECB Candidate Handbook ISO 27001 Lead Auditor, page 19, Audit Process

PECB Candidate Handbook ISO 27001 Lead Auditor, page 22, Audit Report

PECB Candidate Handbook ISO 27001 Lead Auditor, page 23, Audit Conclusion and Recommendation