What Will the Auditor
Ask Your Team?

IT is the highest-scrutiny department in any TISAX® AL3 assessment. The ENX auditor will spend more time here than anywhere else — and the questions are designed to probe not just whether controls exist, but whether the people responsible for them can explain, evidence, and demonstrate them in real time.

The single most common failure mode we observe in IT departments is the gap between what the policy document says and what the system actually does. An access control policy that specifies quarterly user reviews, combined with a system where reviews haven’t happened in 14 months, is not just a finding — it is a finding that triggers deeper scrutiny of everything else.

The second most probed area is network architecture. For AL3 prototype protection scope, the auditor will want to see that data classified at the highest sensitivity level cannot travel across general-purpose network segments without detection or prevention controls.

HR departments are consistently where TISAX® auditors find the most documentation failures. Not because security controls are missing — but because the paper trail that proves those controls were applied to specific individuals is incomplete.

The auditor’s methodology for HR is straightforward: they will pick a random sample of employees (typically 5-10 names), and for each one, they will ask to see the training record, the signed NDA, the onboarding IS acknowledgement, and the access provisioning record. If any one of those is missing for any individual, it is a finding.

For TISAX® AL3 with prototype protection scope, the physical security assessment is often the most viscerally revealing part of the audit. The auditor will walk the site. They will look at doors, read access logs, test that cameras cover what the documentation says they cover, and check that no-photography signage is visible from every angle in restricted zones.

AL3 prototype protection requires a defined high-security zone — a physical space where prototype information is handled — with access restricted to named, authorised individuals. The access control system must produce a log that is actively reviewed, not just retained.

Management interviews are structured to probe one thing above all else: whether information security governance is real or performative. The auditor will ask a senior manager to describe the ISMS in their own words, explain who owns security decisions, and describe what happened after the last internal audit.

The questions are not technical. They are governance questions. But the answers reveal everything about whether the ISMS is a living system or a document filing exercise.

Engineers rarely think of themselves as a security risk. But from an auditor’s perspective, the engineering workstation is where the highest-value data lives — and often where the least disciplined security behaviour occurs. TISAX® AL3 prototype protection requirements were written specifically for this environment.

An auditor conducting an on-site AL3 assessment will ask to sit at an engineering workstation and observe. They will look at whether the screen locks automatically, whether a USB stick can be plugged in freely, and whether the most recent design file they can see in the recent documents list is the kind of information that should require a password to access.

The TISAX® Data Protection module is assessed separately from the core information security requirements, but it uses many of the same evidence types. For Legal teams, the key insight is that VDA ISA asks for evidence of compliance, not just the existence of policies — and the auditor will test whether the documented processes are reflected in actual contracts, processing records, and breach response procedures.

Companies that completed GDPR compliance exercises in 2018-2019 often find that their RoPA and DPA documentation has drifted from current reality. The TISAX® audit is an opportunity — and a requirement — to close that gap.

The third-party supplier finding is the most consistently underestimated area in TISAX® AL3 preparation. Procurement teams are focused on price, quality, and delivery. The idea that they need to maintain a security assessment programme for every supplier who touches prototype data is a significant operational shift.

But from the auditor’s perspective, it is non-negotiable. VDA ISA 6.0 Section 7 is explicit: if a supplier processes information on your behalf that falls within the TISAX® scope, you must have assessed their security posture and contractually bound them to appropriate standards. Both elements — assessment evidence and contractual clause — must be present.