JonathanChristopherson
commented
2 years ago - We want to avoid making this a "Practices" guideline, the Practice of auditing will come from another working group.
- If we align with the Code of Practice principals we should be able to get a consistency
- Want to frame the document for auditors who are not used to looking at metrics and making a decision. When an auditor gets to this point, how do they think about it.
- We don't want to change the practice, but we can frame up how metrics are provided to an auditor to enable their analysis and evaluation
- Two parts: How do I trust that the metrics are right, and once I trust that they're right, 2) How do I interpret them / use them?
- Make a repeatable process to frame up the presentation of the metrics as a solution to facilitate the audit. Repeatably enable the organization to collect and present the metrics, and repeatably enable the auditors to use the metrics.
- Present the vision of how one evaluates the metric collection system, assure the integrity of the metrics, and then trust them for the controls around which they make assertions.
- May have a model of using the metrics as a validation that the results of a traditional audit are still upheld by the systems being measured.