A.6.3 Audit Evidence Pack

What the auditor wants to verify

The auditor wants evidence that training is role-relevant, current, recorded, repeated where needed, and improved based on effectiveness feedback.

Evidence to request

Strong evidence

• Training covers employees, contractors, third-party users, and relevant interested parties in scope.
• Role-based matrix defines baseline and supplementary training.
• Training is completed before access or before the relevant work is performed.
• Content aligns with current policies, topic-specific policies, and procedures.
• Individual records show completion, scope, date, provider, and assessment where applicable.
• Effectiveness is measured using tests, feedback, exercises, incidents, and audit findings.
• Training is refreshed after policy, threat, incident, system, or role changes.
• Claimed prior experience or qualifications are verified where used in place of training.

Weak evidence

• Generic annual training only.
• Attendance list without content, version, date, or role mapping.
• Contractors and third-party users omitted.
• No specialist training for administrators, managers, or security-relevant roles.
• Training delivered after access was granted.
• No assessment or effectiveness review.
• Outdated training material.
• CV claims accepted as competence evidence without verification.

Sample interview questions

Ask personnel

• What information security policy or procedure topics apply to your role?
• How do you report a security incident or weakness?
• What training did you receive before you started using the system or handling information?
• What changed in your training after your role or access changed?

Ask HR or training owners

• How do you decide which training each role requires?
• How do you track induction, refresher, and specialist training?
• How do contractors and third-party users receive training?
• How is training material updated after policy changes, incidents, or emerging threats?

Ask managers or control owners

• How do you know your team completed required training before access?
• What specialist training is required for privileged or security-sensitive roles?
• How do training metrics influence corrective actions or management review?

Common nonconformities

• No role-based training matrix.
• Training not completed before access or work begins.
• Contractors and third-party users excluded without justification.
• Training content not aligned to current policies and procedures.
• No supplementary training for specialist roles.
• No effectiveness metrics or review.
• Training records incomplete or not individual-specific.
• Equivalent experience accepted without verification.

Related notes

• A.6.3 Information Security Awareness Education and Training
• Security Awareness and Training Plan
• Role-Based Security Training Matrix
• Security Training Record
• A.6.3 Audit Checklist
• A.5.27 Learning from Information Security Incidents