Approval Authority Expectations and Scope for the Review cont'd

DOE-HDBK-3027-99

g. The Approval Authority should specify the deliverables of the review. The letter may

specify a report documenting the process and the results, or only a summary of the results.

Either should require a recommendation for future action.

h. The prerequisite conditions that the Approval Authority considers necessary before the

verification may commence. The prerequisites should be specific and measurable to

minimize any confusion as to what is expected. Effective prerequisites which have been

used in past verifications include:

For Phase I Verifications

C The ISMS Description has been formally submitted

C Corporate/Site manuals of practice supporting the ISMS Description are

available for review

C Authorization Agreements (draft/approved) are available for review

C ISMS Verification Team Leader has been appointed, team has been designated

and trained, and ISMS Verification Review Plan has been approved and

promulgated

For Phase II Verifications

C The ISMS as described in the approved ISMS Description has been

implemented

C ISMS Verification Team Leader has been appointed, team has been designated

and trained, and ISMS Verification Review Plan has been approved and

promulgated

i. There should be a discussion of previous reviews that could affect the scope of the

verification. Examples of reviews that may affect the scope of a review include a previous

ORR, a SAR review and associated SER, or the implementation of Work Smart

Standards or Enhanced Work Planning programs. The Approval Authority should define

the amount of consideration to be given to each of these previous reviews or assessments.

j. The estimated date or commitment for the verification with recognition that the review

will not be started until the prerequisites have been achieved.

k. Any additional information useful to the designated Team Leader for meeting the

expectations of the Approval Authority.

A-4-4