CQI/IRCA ISMS Lead Auditor flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Information security management system

A systematic approach to managing information security risks through policies, objectives, processes and controls that preserve confidentiality, integrity and availability of information.

Annex A control themes

ISO/IEC 27001:2022 Annex A contains 93 controls grouped into four themes: organizational (37), people (8), physical (14) and technological (34).

Statement of Applicability

Document identifying applicable Annex A controls, justifying inclusions and exclusions, and recording implementation status; required by ISO/IEC 27001 clause 6.1.3.

Certification body role

An independent, accredited body conducts third-party audits and issues ISO/IEC 27001 certification; the standard itself is a requirements specification and does not certify organizations.

Audit definition

A systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled.

Seven audit principles

Integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach are the ISO 19011 principles of auditing.

Third-party audit

An audit performed by an external, independent organization such as a certification body or regulator, often to grant or maintain certification or verify regulatory compliance.

Audit programme versus plan

An audit programme covers arrangements for a set of audits over time; an audit plan describes activities and arrangements for one specific audit.

Audit scope

The boundaries of an audit, including locations, functions, processes, activities and time period covered; it is agreed with the auditee and stated in the audit plan.

Audit criteria

A set of requirements used as a reference against which objective evidence is compared, such as ISO/IEC 27001, policies, contracts, legislation or internal procedures.

Stage 1 certification audit

Initial audit that reviews documented information and readiness to determine whether Stage 2 can proceed; it may identify concerns but does not certify the ISMS.

Documentation review purpose

To understand the auditee's ISMS, confirm scope and criteria, identify gaps and plan sampling; it supports but does not replace gathering objective evidence during the audit.

Objective evidence

Verifiable data, records, statements or observations about facts or activities that can be confirmed and are relevant to the audit criteria.

Open questioning technique

An interview technique using broad questions beginning with what, how or why to encourage the auditee to explain processes and provide evidence in their own words.

Audit sampling

Selecting a representative subset of records, transactions or activities for examination; sample size and selection are risk-based and documented.

Audit trail

A documented path linking findings and conclusions to objective evidence, enabling another auditor to trace and verify how conclusions were reached.

Nonconformity

Non-fulfilment of a requirement in the audit criteria; it is reported with the requirement, objective evidence, location and classification, and requires correction and corrective action.

Correction versus corrective action

Correction fixes the detected nonconformity; corrective action eliminates the root cause to prevent recurrence, and its effectiveness is verified.

Major nonconformity

A nonconformity that significantly affects the ISMS's ability to achieve intended results or indicates systemic failure; certification is normally withheld until it is resolved.

Closing meeting purpose

To present audit findings, conclusions and recommendations to the auditee and agree responsibilities and timelines for corrective action while preserving confidentiality.

Audit team leader role

Manages the audit, assigns tasks, represents the team in communications, resolves conflicts, ensures objectivity and delivers the audit report and conclusions.

Auditor independence

Auditors must not audit their own work or have conflicts of interest; independence supports impartial, objective findings and credible conclusions.

Technical expert role

Provides specialist knowledge or advice to the audit team but does not act as an auditor unless also competent and assigned as one.

Audit team competence

The collective ability to apply knowledge, skills and behaviour to conduct the audit, including ISMS, sector, legal and auditing skills evaluated before assignment.

ISMS scope statement

Documented boundary and applicability of the ISMS, including interfaces and dependencies, required by ISO/IEC 27001 clause 4.3 and considered in audit scope.

Risk treatment options

ISO/IEC 27001 expects options including modifying risk, retaining risk, avoiding risk and sharing risk; selected controls are recorded in the Statement of Applicability.

Internal audit requirement

ISO/IEC 27001 clause 9.2 requires planned internal audits at intervals with defined criteria, scope, frequency and methods, and reporting to management.

Management review inputs

ISO/IEC 27001 clause 9.3 requires review of ISMS status, changes, feedback, risk assessment results, objectives and audit results, producing decisions on improvement.

ISO/IEC 27005

Provides guidance on managing information security risk, including risk identification, analysis, evaluation, treatment and communication, supporting ISO/IEC 27001 risk requirements.

ISO/IEC 27006

Specifies requirements for bodies providing audit and certification of information security management systems, supplementing ISO/IEC 17021-1 for ISMS certification.

Surveillance audit

A periodic audit after initial certification, typically at least once a year, to confirm continued conformity and effective operation of the certified ISMS.

Residual risk

Risk remaining after risk treatment has been applied; it is compared with risk criteria and accepted by risk owners where it exceeds tolerable levels.