We have just undergone the Stage 1 audit by our chosen CB. My concern was their approach in evaluating how our organization satisfies the requirements in determining risks and opportunities. To provide you some background, we utilized the RBT concept during our strategic and operational planning. We determined risks/opportunities when we established our strategic plans and when we plan for the controls to be integrated into our operations. Both levels of planning were fully documented (this will also ensure conformance to clause 6.1.1). Actions to address risks/opportunities are also in place (this gave us the assurance to satisfy clauses 6.1.2 and 4.4.1f). However, when they start auditing they keep on asking the question WHAT IF. Just to cite a few: "what if the president is not available? what if the funds are not available? what if manpower is not adequate?" Then followed with a question "Did you include those in your inventory of risks?" Of course, controls to manage the above risks are already in place but what I can't dig is when they conclude that our tools for determining risks/opportunities are inadequate just because we failed to include the WHAT IF issues they asked from us into our inventory of risks. What's your take on this?