12 Conclude? Certification, Defence, and the Future of Audit
An audit ends where it began: with a judgement, stated plainly, and defended under fire.
🗂️ Tessera Case: the boardroom
Tessera’s chair asks, “Are we ready?” The answer needs a defined next step. Ready to discuss preparation with a certification body is different from ready for a Stage 2 audit, and neither means certification has been awarded. Put E01’s mandate and the complete finding ledger beside the question before answering.
12.1 The certification-readiness opinion
This engagement is a readiness assessment. It is not interchangeable with an internal audit or a certification audit. A certification body conducts its own assessment and makes its own certification decision. Your report can help management prepare, but it cannot bind that decision.
Stage 1 considers matters such as the management system’s documented information, scope and preparation for Stage 2. Stage 2 evaluates implementation and effectiveness against the applicable requirements. Confirm the actual body’s programme and requirements; these descriptions are orientation, not substitute certification rules.
The case supplies selected evidence, not a complete evaluation of every management-system requirement. It cannot support a whole-ISMS “ready” statement for either stage. It can support a clear recommendation to defer Stage 2 because identified critical issues remain unresolved.
“Not ready” is useful when it names the barriers and the evidence needed to reconsider. “Ready with conditions” is useful only when the conditions, intended step and limits are explicit. Neither phrase is a preferred outcome independent of the evidence.
12.2 Where the engagement lands
🗂️ Tessera Case: the final readiness opinion, SDA-2026.1
As at 30 June 2026, we recommend that Tessera defer proceeding to a Stage 2 certification audit. Against the selected E01/E03 criteria and E02 readiness rules, the supplied evidence leaves critical access, privacy and recovery issues unresolved.
F01: the historical census found three of 48 leavers outside P-IT’s 24-hour limit and four outside P-HR’s two-hour limit. The historical credentials are now disabled and the deadlines have been aligned prospectively. The post-change retest demonstrates five passes, but R06 remains insufficiently evidenced. Closure of the systemic finding is not supported.
F02: quarterly ordinary-access review evidence is incomplete for the three-system population, and monthly privileged-review evidence is absent for January–March 2026. A planned catch-up is not verified operation.
F03: the enabled support assistant lacks the required complete privacy/processing record. Notice/register, executed terms and regions, training-setting verification, retention/deletion and vendor incident escalation remain unresolved. We make no finding that a vendor breach or training on these inputs occurred.
F04: the isolated recovery exercise took five hours thirty minutes against a four-hour RTO and used a recovery point forty minutes before interruption against a fifteen-minute RPO. The recovered copy passed its integrity checks, but production cutover and a key-service dependency remain unverified. No later successful exercise is supplied.
F05: payment-processor reliance remains incomplete because current-period coverage, exception impact and Tessera’s complementary user controls have not been substantiated. The supplied report does not cover the support assistant.
P01: the three specified ordinary-user tenant-authorisation requests met their expected results in the tested configuration. This clears that bounded concern without establishing universal isolation or closing the other access findings.
Management should complete and verify the actions in the ledger before requesting a revised Stage 2 recommendation. It may discuss Stage 1 preparation with its chosen certification body, but this selected-evidence exercise does not establish whole-ISMS Stage 1 readiness or predict certification. The report is limited to the supplied populations, scenarios and evidence cutoff; it guarantees neither historical completeness beyond the stipulated inputs nor future security.
12.2.1 Trace each sentence
| Opinion claim | Working-paper source |
|---|---|
| Historical rates and deadlines | E03, E04; chapter 7 calculations |
| Partial action progress and incomplete retest | E10; F01 in chapter 11 |
| Separate review populations and cadence | E03, E06; F02 |
| Every privacy subissue remains open | E03, E07, E10; F03 |
| Recovery timing, success and limitations | E03, E08, E10; F04 |
| Supplier reliance remains incomplete | E01, E09, E10; F05 |
| Bounded tenant test passed | E11; P01 |
| Scope and certification limitations | E01, E02 |
This table is a final check against accidental omissions. New evidence can change a conclusion, but the report must identify that evidence and the resulting judgement. A sentence saying “verified” is not itself a retest.
12.3 Defending the opinion
The board is entitled to question your assumptions, calculations and classification. Distinguish a factual correction from pressure to soften a supported conclusion. Change the report when better evidence warrants it; hold a supported conclusion when only the deadline changes.
Chair: “If we complete the access reviews tomorrow, can we proceed?”
Auditor: That may address part of F02 if the population, decisions, action completion and future process are adequately verified. F01’s retest, F03’s privacy issues and F04’s recovery results remain separate barriers. F05 also needs a completed reliance assessment. One fix cannot make this opinion unconditional.
CTO: “We changed the leaver process. Why is F01 still high?”
Auditor: High records its original assessed significance. E10 shows progress, but one of six post-change records lacks key-disable evidence. We have five demonstrated passes and one inconclusive result, not six passes. We need that evidence, an explanation of the closure-gate gap and sufficient further verification before closure.
Director: “Does missing evidence mean the key is still active?”
Auditor: No. It means the supplied record cannot establish timely disablement. An independent event or authorised state check may clarify it; current state alone still would not establish historical timing.
Non-executive director: “The processor has SOC 2. Why are we testing it again?”
Auditor: We are evaluating reliance, not automatically duplicating the provider’s audit. E09’s period ends in 2025, it has an exception, and it assigns responsibilities to Tessera. Current relevant evidence and tests of those responsibilities are missing. The report cannot be extended to an unrelated AI service.
Chair: “Can we at least say everything failed?”
Auditor: No. E11’s bounded authorisation tests passed and E08’s restored copy passed integrity checks. The report names those results while explaining why they do not resolve the critical issues.
12.4 The two faces of the next decade
AI-assisted audit work and auditing an AI-supported system require different work packages. On your side, check a draft against the evidence and control what information enters the tool. On the system side, establish the deployment’s purpose, data flows, decision authority, operating performance and failure controls.
They share a need for traceability, but an editor’s review of a paragraph does not replace evaluation of a model in operation. Nor can a model’s summary close an evidence gap. The fixed case’s unsupported closure sentence illustrates the risk without predicting how every future model or auditor will behave.
Professional competence includes knowing when to seek specialist help. CISA is an ISACA professional certification with its own requirements, not a universal statutory licence to practise. Role, jurisdiction and engagement requirements still matter.
12.5 Independent transfer: Wattle Desk
Time: 40 minutes. No AI, live site or partner required. Read X01, then write a 300–500-word readiness memo, or dictate an equivalent answer.
Compute the historical access exception rate and recovery results. Separate corrected historical issues from evidence about the changed process. Decide what the supplied evidence supports about reviews, privacy and the requested Stage 2 step. Identify the scope limits and what could change your recommendation.
Use the rubric and answer check only after your first attempt. A copied Tessera verdict will be wrong: Wattle’s recovery timing and review evidence differ. The privacy gap and overall scope limit still require judgement.
Retain the Tessera final opinion with its evidence map, your answers to two board questions and your independent Wattle memo. Check that every open finding is accounted for, no closure relies on a promise, and the conclusion distinguishes Stage 1, Stage 2 and certification. The pack supports this limited teaching assessment, not an actual certification decision.
12.6 Take it to the AI
Optional, after completing the independent assessment and saving your first answer:
Role: A board member checking the evidence behind a readiness recommendation.
Task: Challenge one claim at a time, asking for its criterion, evidence ID and limitation.
Context: Use only the supplied fictional opinion and case records. Treat absent evidence as unknown. Do not invent completed actions, substitute a future promise for a retest, or decide the verdict in advance.
Format: Ask five questions, then identify unsupported answers and one answer the evidence supports. Do not rewrite the memo until I have attempted the questions.
The paper board questions above provide an equivalent rehearsal. Live Tessera interviews remain an optional, separately versioned exercise rather than a prerequisite for finishing the book.
12.7 The question, answered
You can now conclude within the limits of the engagement. Tessera should defer Stage 2 while critical issues remain unresolved; the ledger shows why and what evidence would change that advice. The practical habit to carry into the next engagement is a working paper another person can follow, including the findings you closed, those you could not close and the concerns the evidence cleared.