Select two of the following options that are the responsibility of a legal technical expert on the audit team during a certification audit.

A technical expert, including a legal expert, is part of the audit team to provide specific knowledge that the auditors may lack. Their primary role is to support the audit team, not to act as an auditor. Therefore, a key responsibility is advising on legal checkpoints for the audit team (D), guiding them on what specific legal and regulatory aspects to examine. To gather the necessary information to provide this advice, it is often appropriate and necessary for the expert to meet the organisation's legal representative (F) to clarify complex points and understand the auditee's compliance posture.

A. Evaluating the auditee's legal knowledge: The expert helps evaluate evidence of compliance with legal requirements, not the personal knowledge of the auditee's staff.
B. Criticising the organisation's legal compliance issues: The role requires objectivity and providing factual input to the team, not criticism.
C. Debating complex legal points with the auditee: The expert's role is to advise the audit team, not to engage in debates with the auditee.
E. Verifying the legal status of the organisation: This is too broad; the expert's focus is on specific legal requirements relevant to the ISMS scope.

1. ISO/IEC 19011:2018, Clause 3.11, "Definition of a technical expert". A technical expert "provides specific knowledge or expertise to the audit team." The note clarifies they do not act as an auditor.

2. ISO/IEC 19011:2018, Clause 6.2.2, "Role of the audit team leader". The team leader is responsible for directing the technical experts, confirming their advisory role.

3. Calder, A., & Watkins, S. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002. Kogan Page Publishers. Chapter 14 discusses the audit process, noting the use of specialists to cover areas like legal compliance where generalist auditors lack deep expertise.