CQI/IRCA ISMS Lead Auditor key terms

A set of interrelated policies, objectives, processes and controls an organization uses to protect the confidentiality, integrity and availability of its information, managed as a system and continually improved. ISO/IEC 27001 defines the requirements for establishing, operating and maintaining one.

A documented statement of the boundaries and applicability of the ISMS, identifying which parts of the organization, locations, technologies and information are covered, and taking account of internal and external issues and interfaces with third parties.

The internal and external issues, legal, regulatory and contractual obligations, and stakeholder expectations that influence how an organization designs its ISMS. Clause 4 of ISO/IEC 27001 requires it to be determined and kept up to date.

The ongoing process of enhancing the suitability, adequacy and effectiveness of the ISMS. ISO/IEC 27001 requires it, typically implemented through monitoring, internal audit, management review, corrective action and the treatment of identified opportunities.

A systematic, independent and documented process for obtaining objective evidence and evaluating it against agreed criteria to determine the extent to which those criteria are fulfilled. Audits can be internal (first party), supplier (second party) or certification (third party).

The set of requirements used as a reference against which audit evidence is compared; for an ISMS audit typically ISO/IEC 27001, the organization's own policies and procedures, contracts, and applicable legal or regulatory requirements.

Records, statements of fact or other information that is relevant to the audit criteria and verifiable. Evidence is collected through interviews, observation and document review, and must be recorded to support findings and conclusions.

The organization, or part of it, being audited. The auditee's management is responsible for providing access, information and personnel, and for acting on the findings and nonconformities arising from the audit.

The principle requiring auditors to be independent of the activity being audited and free from bias, conflict of interest or undue influence, so that findings and conclusions are based only on the evidence collected.

The principle that auditors exercise the diligence, judgement and skill expected of a competent auditor, recognizing that audit evidence is only a sample and that conclusions are therefore subject to uncertainty.

A set of planned arrangements for one or more audits over a defined period, including schedules, resources, methods and responsibilities, designed to meet a specific purpose and to cover the ISMS requirements over time.

A description of the activities and arrangements for an individual audit, covering objectives, criteria, scope, dates, locations, expected participants, sampling approach and allocation of audit time to processes and controls.

The purpose of a specific audit, expressing what it is intended to achieve, for example determining conformity of the ISMS with ISO/IEC 27001, evaluating its effectiveness, or assessing supplier readiness.

The pre-audit or on-site examination of documents and records such as the scope, risk assessment, statement of applicability or policies, to understand the ISMS, check completeness and plan where to gather further evidence.

The approach of concentrating audit effort and sampling on the areas of highest information security risk and weakest control, so that limited audit time is spent where failure would matter most.

Selecting a subset of records, transactions or personnel from a larger population in order to reach a conclusion about the whole. Samples should be representative and sufficient in size to support reliable findings and conclusions.

Collecting evidence by questioning auditees at their workplace, combining open questions to understand processes with probing and verifying questions, and cross-checking the answers against records and observation.

A meeting at the start of an on-site audit to confirm the audit plan, scope, criteria, schedule, communication channels and the roles of the audit team, and to confirm that relevant resources and access are available.

A meeting at the end of the audit where findings and conclusions are presented, the level of conformity is summarized, any disagreement is resolved, and reporting and follow-up arrangements are agreed.

The result of evaluating collected evidence against the audit criteria. Findings describe conformity or nonconformity, may also record opportunities for improvement, and together they support the audit conclusions.

A failure to meet a requirement of the audit criteria, such as a clause of ISO/IEC 27001, an Annex A control, or the organization's own documented policy. It must be recorded with objective evidence and addressed.

A nonconformity that seriously affects the capability of the ISMS to achieve its intended results, for example a missing required process or a systemic failure of a control; it normally must be corrected and verified before certification.

An isolated or limited lapse that does not indicate a systemic failure of the ISMS and does not by itself prevent the management system from meeting its intended outcomes; it nevertheless requires correction and corrective action.

An action taken to eliminate a detected nonconformity or fault, such as fixing a misconfigured system or amending a record. It deals with the immediate problem, not with the underlying causes of that problem.

An action to eliminate the cause of a nonconformity so that it does not recur, usually following root cause analysis; its implementation and effectiveness must be reviewed and evidenced before the finding can be closed.

A structured investigation to identify why a nonconformity occurred, distinguishing immediate causes from underlying systemic ones, so that corrective action addresses the cause rather than the visible symptom.

The professional judgement of the audit team about the significance and conformance of the audited area, derived from the set of findings and reported to the audit client and the auditee.

The auditor appointed to manage a specific audit, including planning, briefing the team, allocating tasks, guiding communication with the auditee, resolving conflicts and producing the audit report.

The combination of knowledge of the standards and subject matter, auditing skills, education, experience and personal attributes needed to perform audits effectively, maintained through professional development and evaluated by those managing the audit programme.

A situation where an auditor's personal, financial or professional interests could compromise impartial judgement, for example auditing a process the auditor manages; it must be identified and either avoided or managed.

A documented statement of the Annex A controls that are necessary and applicable, with justification for inclusions and exclusions and the implementation status of each. It is mandatory and a key document in any ISMS audit.

A documented plan recording the selected information security risk treatment options, the controls chosen, the residual risk accepted by risk owners, and the resources and responsibilities for implementation.

An information security control listed in Annex A of ISO/IEC 27001, organized into organizational, people, physical and technological themes, which organizations include in their statement of applicability as their risk assessment requires.

An audit conducted by, or on behalf of, the organization itself to determine whether its ISMS conforms to its own requirements and to ISO/IEC 27001 and is effectively implemented and maintained, as required by clause 9.2.

A top-management review of the ISMS at planned intervals to assess its continuing suitability, adequacy and effectiveness, using defined inputs such as audit results and risk status, and producing decisions on improvement and resources.

An international standard providing detailed guidance and a catalogue of information security controls with implementation advice; it supports the selection of controls for the statement of applicability but contains no certifiable requirements.

Formal recognition by a national accreditation body that a certification body is competent and impartial to carry out certification audits in a defined field, such as ISO/IEC 27001 information security management.

An independent third-party organization that audits an ISMS against ISO/IEC 27001 and grants, maintains, suspends or withdraws certification; it must operate under accredited, impartial and demonstrably competent arrangements.

The risk that remains after risk treatment has been applied. It should be compared with the organization's risk acceptance criteria and formally accepted by the relevant risk owner before being audited.

The terms of reference defining what constitutes a significant risk, how likelihood and consequence are evaluated, and the level of risk the organization is willing to accept.