ServiceNow interview question

How do you typically audit ISMS? How do you communicate findings?