Common mistakes in the NEN 7510 audit
A common pattern in a NEN 7510 audit is the gap between what is written down and what happens in practice. The auditor tests that gap. Below are eight mistakes we often see in audits, with what the auditor wants to see and how to prevent each one. The audit process itself is on the audit page, an example of a day is on an audit day in practice, and a list to practise with is in the checklist. Mistakes during implementation itself are covered in the step-by-step plan.
1. A scope that does not match reality
What goes wrong: the scope in the Statement of Applicability (VvT, Verklaring van Toepasselijkheid) lists two locations, but a third location uses the same EPD (electronic patient record) and was not included.
What the auditor wants to see: a scope decision with the reasoning for each exclusion, and evidence that the excluded parts are really separated.
Fix: check the scope once more against the list of systems and locations in the asset register. Every system that processes patient data belongs in the scope, or has a justified exclusion.
2. A risk analysis that is too general
What goes wrong: the risk analysis mentions “phishing” and “theft” but not the risks in the organisation’s own care processes, such as sending the wrong patient file.
What the auditor wants to see: a risk register with care-specific threats, an owner for each risk and a decision for each risk.
Fix: use the care processes as the starting point. See the risk analysis for NEN 7510 for a method.
3. A Statement of Applicability without evidence
What goes wrong: the VvT says a measure is in place, but there is no document, log or report that shows it.
What the auditor wants to see: for each chosen measure, a reference to evidence, and for each excluded measure, a reason.
Fix: keep an “evidence” column for every line of the VvT. The statement of applicability with an example shows how.
4. Policy that does not match the work
What goes wrong: the policy says every new employee gets a security briefing, but the onboarding form does not include that step.
What the auditor wants to see: that the policy and practice match. They often check this by asking an employee.
Fix: for each policy rule, ask one employee how it works in practice. The gap is the point you need to work on.
5. No documented supplier checks
What goes wrong: the data processing agreement was signed in 2022, but nobody has checked since then whether the supplier still meets the agreed terms.
What the auditor wants to see: a yearly check, for example through an audit report or a questionnaire, with the findings and the follow-up.
Fix: put the check in the annual plan and store the result in the supplier folder.
6. Logs that are not reviewed
What goes wrong: the system logs everything, but nobody looks at the logs. After a data breach, it turns out the logs existed but were never analysed.
What the auditor wants to see: a fixed log review, with a sample and a report.
Fix: plan a monthly sample. The technical requirements for logging are on NEN 7513 logging.
7. An internal audit that finds nothing
What goes wrong: a colleague who knows the system well carried out the internal audit and therefore found nothing.
What the auditor wants to see: an internal audit by someone independent of the part being checked (ISO 27001 requires internal auditors to be objective and impartial), with findings and an action plan.
Fix: rotate the auditor for each part. Read the internal audit page for the independence requirements and the report.
8. Nonconformities that are not resolved
What goes wrong: a minor nonconformity from the previous audit is still open, and there is no evidence of a fix.
What the auditor wants to see: for each nonconformity, a root cause analysis, a corrective measure and evidence that it was carried out.
Fix: keep a nonconformity register, and only close a nonconformity once the evidence is in place.
Three or more minor nonconformities on the same part can together form a major nonconformity. See the audit process. A pattern carries more weight than a single error.
Table: mistake, evidence and fix
| Mistake | Evidence the auditor wants | Fix |
|---|---|---|
| Scope does not match | Scope decision with reasoning | Compare with the asset register |
| Risks too general | Care-specific risk register | Start from the care processes |
| VvT without evidence | Reference for each measure | Add an evidence column |
| Policy does not fit | Conversation with an employee | Put policy and practice side by side |
| Suppliers not checked | Yearly check | Fixed schedule |
| Logs not reviewed | Sample review report | Monthly check |
| Internal audit not independent | Report from an independent auditor | Rotate the auditor per part |
| Nonconformities open | Root cause analysis and evidence | Nonconformity register |
How to use this list?
Go through the list one month before the audit with the owners of the measures. Ask for each point: what is the evidence, and where is it kept? If the answer is unclear, that is the point to fix first. Also use the checklist and the sample audit day to practise.
Additional notes
- This overview is based on common patterns, not on statistics from a certification body. The examples are fictional.
- The exact requirements and the way nonconformities are classified follow the standard and the audit plan of your certification body.
- For the general background to the standard and the clauses that are audited, see the NEN 7510 requirements.