The Opening Meeting & On-site Audit Activities

Lesson 4 produced a plan and a checklist. This lesson covers what happens the moment the audit actually begins: the opening meeting, and how on-site (or remote) activities should unfold from there.

What the opening meeting actually establishes

A common misconception is that the opening meeting is a formality — introductions and coffee before the "real" audit starts. In fact, it's where several substantive things get confirmed on the record, before any evidence-gathering begins:

• Confirming the audit objectives, scope, and criteria (Lesson 3) with the auditee, giving them a final chance to flag anything that's changed since the document review (Lesson 4) — such as the divested business unit example from that lesson
• Confirming the audit plan and schedule, including who from the auditee will be available for which interviews
• Reconfirming communication channels — who the audit team's day-to-day point of contact is, and how urgent issues (like access problems) get escalated
• Explaining the grading system to be used for findings (major/minor/observation — covered in Lesson 8) so there are no surprises about terminology at the closing meeting
• Confirming confidentiality arrangements — reinforcing Lesson 1's confidentiality principle in concrete terms the auditee can act on

Skipping or rushing this meeting risks exactly the kind of scrambling described in Lesson 4's challenge scenario — discovering a scope problem mid-audit instead of at the one moment specifically designed to catch it.

Handling a scope-change request at the opening meeting

Occasionally, the auditee raises a legitimate reason to adjust scope right at the opening meeting — a system was decommissioned, a team was reorganized. The correct response isn't to unilaterally accept or reject the change on the spot; it's to evaluate whether the change is genuinely justified against the original audit objective (Lesson 3), and if so, formally document the updated scope before proceeding — not just verbally acknowledge it and continue as if nothing changed. An undocumented, informal scope change creates exactly the kind of ambiguity a later audit report review would struggle to defend.

Keeping on-site activities aligned to the plan

As the audit proceeds, the audit team works through the plan and checklist (Lesson 4), but real audits rarely go exactly as scripted — an interviewee is unexpectedly unavailable, an unexpected finding in one area prompts more time there and less somewhere else. The audit plan is a guide, not a rigid script; reasonable, documented adjustments in response to what the evidence is actually showing are a normal and expected part of skilled auditing.

Legitimate deviation vs. a red flag

The key distinction: a deviation is legitimate when it's driven by what the evidence is showing and is documented as it happens — for example, spending extra time on access control after finding an unexpected gap there, at the expense of a lower-priority area. A deviation is a red flag when it happens without documentation, or when it conveniently steers the audit away from an area the auditee seems reluctant to have examined — for example, an interviewee's sudden unavailability that happens to be for the one process area where document review (Lesson 4) had already flagged a red flag. An auditor who notices this pattern shouldn't simply reschedule and move on without at least noting the pattern and probing for an alternative way to gather that evidence.

Maintaining the audit trail throughout

Every activity — who was interviewed, what documents were reviewed, what was observed — should be logged as it happens, not reconstructed from memory afterward. This isn't paperwork for its own sake; it's what makes the eventual findings (Lessons 7-8) traceable back to specific evidence, exactly the evidence-based approach principle from Lesson 1 in its most concrete, day-to-day form.