I am an IT person, and I put this first, and Auditor for 27001. Wouldn't say that you can't bullshit me, cause who knows all. I go in and look at the absolute b

I am an IT person, and I put this first, and Auditor for 27001. Wouldn't say that you can't bullshit me, cause who knows all. I go in and look at the absolute basics. Like is there a person responsible for Security? What are his responsibilities? In the last 12 Months is there anything documented that proofs that he did his job? If so did the management followed through on his findings? If not why? You can fake all of this. But at some point its easier to do the job than to fake it. Well at least this is what I hope...