CQI/IRCA ISMS Lead Auditor case studies
CQI/IRCA ISMS Lead Auditor · Put your knowledge to work in context.
The CQI/IRCA ISMS Lead Auditor credential is a personnel certification for people who audit information security management systems against ISO/IEC 27001. It is administered through the UK's Chartered Quality Institute and International Register of Certificated Auditors, and is normally earned by completing an IRCA-certified lead auditor training course, passing the course's written examination, and being assessed on audit-practice exercises run during the course. The CQI/IRCA ISMS Lead Auditor case studies are 5 cases and about 3,250 words.
1Scope boundaries after an acquisition
You are the lead auditor for a certification body conducting a stage 2 audit of Northwind Logistics' ISMS. The scope statement reads: 'Head office and both distribution warehouses, including all IT services supporting order fulfilment.' Three weeks before the audit, Northwind acquired FastTrack Couriers, which runs a separate courier platform and processes customer address data on a cloud service.
694 words, about 3 min2Backup restoration failures and the limits of a 'green' dashboard
You are auditing Helios Health, a 42-server clinical records provider, against ISO/IEC 27001:2022. The backup dashboard shows 100% 'successful' jobs for the last 12 months.
710 words, about 4 min3Independence, competence and a client who wants to narrow the interviews
Priya is leading a three-day surveillance audit of a payment processor. Her team includes Tom, who configured the client's SIEM 18 months ago as a consultant, and a trainee auditor who is not yet qualified.
641 words, about 3 min4A surveillance audit with too little time and a late cloud change
You manage the audit programme for Meridian Financial, certified for three years. The programme provides a stage 1, stage 2 and two surveillance audits, with recertification in month 36.
633 words, about 3 min5A corrective action that only retrains people
Orion SaaS received a major nonconformity at surveillance: five of twenty sampled leavers still had active accounts 30 days after leaving, including one privileged account. The requirement cited was Annex A control A.5.18 (access rights).
572 words, about 3 min