I85PREP
⌘ K
CQI/IRCA ISMS Lead Auditor study materials
CQI/IRCA ISMS Lead Auditor study resources

CQI/IRCA ISMS Lead Auditor practice questions

One question at a time. Build your CQI/IRCA ISMS Lead Auditor understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information security management systems: purpose, benefits and structure of ISO/IEC 27001

What does ISO/IEC 27001 primarily specify?

  1. A certification scheme for individual information security professionals
  2. Detailed technical configuration settings for firewalls and servers in data centres
  3. Guidance on privacy engineering for products that process personal data
  4. Requirements for an ISMS, covering its establishment and improvement Correct answer.

Explanation

ISO/IEC 27001 is a requirements standard: it states what an information security management system must do to be auditable and certifiable, covering its establishment, implementation, maintenance and continual improvement. It deliberately stops short of prescribing specific technologies or configurations.

Question 2Information security management systems: purpose, benefits and structure of ISO/IEC 27001

In the main body of ISO/IEC 27001, which clause contains the requirements for leadership and top management commitment?

  1. Clause 4 - Context of the organization
  2. Clause 6 - Planning
  3. Clause 5 - Leadership Correct answer.
  4. Clause 7 - Support

Explanation

Clause 5 addresses leadership and commitment, the information security policy, and organizational roles, responsibilities and authorities. It requires top management to integrate the ISMS into the organization's business processes and to demonstrate direction and support.

Question 3Information security management systems: purpose, benefits and structure of ISO/IEC 27001

In ISO/IEC 27001:2022, the Annex A controls are organized into how many themes?

  1. Fourteen
  2. Eight
  3. Five
  4. Four Correct answer.

Explanation

The 2022 revision restructured Annex A into four themes: organizational, people, physical and technological. These replace the 14 control clauses used in the 2013 edition and group a total of 93 controls.

Question 4Information security management systems: purpose, benefits and structure of ISO/IEC 27001

Which item must the Statement of Applicability record for each Annex A control?

  1. The date on which the control was last reviewed by internal audit
  2. The residual risk rating accepted by the certification body
  3. The name of the auditor who tested the control's effectiveness
  4. Whether the control is implemented, and why it is included or excluded Correct answer.

Explanation

Clause 6.1.3 requires the Statement of Applicability to identify the controls deemed necessary, justify their inclusion (and the exclusion of any Annex A control), and state whether each is implemented. It is a living document tied directly to the results of risk treatment.

Question 5Information security management systems: purpose, benefits and structure of ISO/IEC 27001

ISO/IEC 27001 requires the information security risk assessment to be carried out:

  1. Once, before the initial certification audit, and then left unchanged
  2. Only when a security incident has resulted in a confirmed data breach
  3. At planned intervals and when significant changes are proposed or occur Correct answer.
  4. Annually, always on the anniversary of the certification decision

Explanation

Clause 6.1.2 requires a defined risk assessment process that is applied at planned intervals and whenever significant changes are proposed or occur. The outputs must be consistent, valid and comparable so that results can be relied upon over time.

Question 6Information security management systems: purpose, benefits and structure of ISO/IEC 27001

What is the role of ISO/IEC 27002 in relation to ISO/IEC 27001?

  1. It defines the audit methodology used by certification bodies assessing an ISMS
  2. It replaces Annex A for organizations that do not use a risk-based approach
  3. It provides guidance on selecting and implementing information security controls Correct answer.
  4. It sets additional certifiable requirements audited alongside Annex A

Explanation

ISO/IEC 27002 is a code of practice: it gives guidance on the purpose and implementation of the controls referenced in Annex A. It contains no certifiable requirements, so an ISMS is certified against ISO/IEC 27001 only.

Question 7Information security management systems: purpose, benefits and structure of ISO/IEC 27001

Clause 4 of ISO/IEC 27001 requires the organization to determine:

  1. The budget allocated to information security for the coming financial year
  2. The number of internal auditors needed to cover each Annex A theme
  3. The technical standards to be used for encryption across all systems in scope
  4. External and internal issues and relevant interested party requirements Correct answer.

Explanation

Clause 4 requires the organization to understand its context, including external and internal issues and the relevant needs and expectations of interested parties, before defining the scope of the ISMS. These determinations then feed the risk assessment and planning activities.

Question 8Information security management systems: purpose, benefits and structure of ISO/IEC 27001

What does certification of an ISMS to ISO/IEC 27001 provide?

  1. A legal opinion confirming compliance with data protection legislation
  2. Independent confirmation that the ISMS meets the standard's requirements Correct answer.
  3. A technical benchmark showing controls are better than competitors'
  4. A guarantee that the organization will not suffer a security breach

Explanation

Certification is third-party attestation that the management system conforms to the requirements of ISO/IEC 27001, based on audit evidence gathered at a point in time. It gives confidence to interested parties but does not certify legal compliance or immunity from incidents.

Question 9Information security management systems: purpose, benefits and structure of ISO/IEC 27001

Under clause 6.1.3, which approval must be obtained before the risk treatment plan is implemented?

  1. Approval by internal audit of the risk assessment methodology used
  2. Risk owners' approval of the plan and acceptance of residual risk Correct answer.
  3. Written approval from every interested party named in the ISMS scope
  4. The certification body's approval of each control chosen for the plan

Explanation

Clause 6.1.3 requires the organization to obtain risk owners' approval of the risk treatment plan and their acceptance of the residual risks. The certification body audits whether this process was followed but does not approve the plan itself.

Question 10Information security management systems: purpose, benefits and structure of ISO/IEC 27001

An organization outsources all IT processing and states that Clause 8 (Operation) is not applicable to its ISMS. How should a lead auditor evaluate this?

  1. Accept it, because Annex A controls for outsourced services substitute for Clause 8
  2. Reject it, because every requirement in Clauses 4 to 10 applies Correct answer.
  3. Accept it, provided the outsourced services are covered by a supplier contract
  4. Refer it to the certification body, since excluding a clause is allowed with justification

Explanation

Clauses 4 to 10 contain the management system requirements, and none of them can be declared inapplicable by an organization claiming conformity. Only Annex A controls may be excluded, and only where justified and recorded in the Statement of Applicability.

Question 11Audit fundamentals and the principles of auditing (ISO 19011)

According to ISO 19011, an audit is best described as which of the following?

  1. An informal review of records carried out by the process owner with the aim of identifying improvement opportunities
  2. A structured inspection of product characteristics performed by the line supervisor who owns the process being examined
  3. A systematic, independent and documented process for obtaining and evaluating objective evidence Correct answer.
  4. A management review meeting held with top management to decide on corrective actions and resource allocation

Explanation

ISO 19011 defines an audit as a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. All three attributes - systematic, independent and documented - must be present.

Question 12Audit fundamentals and the principles of auditing (ISO 19011)

Which of the following is one of the principles of auditing given in ISO 19011?

  1. Process approach
  2. Customer focus
  3. Continuous improvement
  4. Integrity Correct answer.

Explanation

ISO 19011 lists seven auditing principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach. The other options are quality management principles from ISO 9000, not auditing principles.

Question 13Audit fundamentals and the principles of auditing (ISO 19011)

What does ISO 19011 mean by an audit programme?

  1. The checklist of questions that an auditor uses during interviews to guide the discussion
  2. A set of one or more audits planned for a specific time frame and directed towards a specific purpose Correct answer.
  3. The schedule of meetings agreed with the auditee at the opening meeting
  4. The documented description of the activities and arrangements for a single audit, including timing and resources

Explanation

An audit programme covers a set of audits arranged over a time frame and directed at a purpose, such as a year's internal ISMS audits. A description of the activities and arrangements for one individual audit is an audit plan, which is a different concept.

Question 14Audit fundamentals and the principles of auditing (ISO 19011)

An audit team is comparing a supplier's documented procedure with the requirements of ISO/IEC 27001 to determine whether requirements are met. What is ISO/IEC 27001 in this context?

  1. Audit evidence
  2. The audit scope
  3. The audit criteria Correct answer.
  4. An audit finding

Explanation

Audit criteria are the set of requirements used as a reference against which objective evidence is compared. The standard supplies those requirements, while the procedure text and records are evidence and the evaluation result is a finding.

Question 15Audit fundamentals and the principles of auditing (ISO 19011)

During an audit, an auditor notes that backup jobs log completion but that no restore test has been performed for two years. Before it is evaluated against criteria, how is this observation best described in ISO 19011 terms?

  1. The audit plan
  2. An audit conclusion
  3. The audit programme
  4. Audit evidence Correct answer.

Explanation

Records and statements of fact that are relevant to the criteria and verifiable constitute audit evidence. Findings and conclusions only arise once that evidence has been evaluated against the audit criteria.

Question 16Audit fundamentals and the principles of auditing (ISO 19011)

What is the primary purpose of the opening meeting in an audit?

  1. To sign the audit report jointly with the auditee's top management at the start of the audit
  2. To present the audit findings to top management and agree deadlines for the corrective actions that will follow
  3. To collect the objective evidence needed to reach the audit conclusions on the day
  4. To confirm the audit plan, introduce the team and confirm communication arrangements Correct answer.

Explanation

The opening meeting confirms agreement on the audit plan and communication channels, introduces the team and explains how the audit will be conducted. Findings are not yet available and evidence collection happens afterwards.

Question 17Audit fundamentals and the principles of auditing (ISO 19011)

Which auditing principle requires auditors to be free from bias and conflict of interest in relation to the activity being audited?

  1. Independence Correct answer.
  2. Integrity
  3. Fair presentation
  4. Confidentiality

Explanation

Independence is the basis for the impartiality of the audit and for the objectivity of the audit conclusions, requiring auditors to be free of bias and conflict of interest. Integrity concerns honesty and professional conduct, and confidentiality concerns the handling of information.

Question 18Audit fundamentals and the principles of auditing (ISO 19011)

An audit team is being formed to audit an ISMS covering a cloud-hosted service. Which action best reflects ISO 19011 guidance on auditor competence?

  1. Select team members whose knowledge and skills match the competence needed for the audit scope Correct answer.
  2. Assign the whole audit to the IT manager of the audited organisation, who knows the systems best
  3. Select only auditors with more years of service than the auditee's manager, as seniority guarantees objectivity
  4. Choose auditors who have never audited before so that they bring a completely fresh perspective

Explanation

ISO 19011 requires the competence of the audit team to be appropriate to the audit scope, considering the knowledge and skills needed for the specific processes and technology involved. Competence is determined by the needs of the audit, not by seniority or novelty.

Question 19Audit fundamentals and the principles of auditing (ISO 19011)

The auditing principle of due professional care requires auditors to apply which of the following?

  1. Diligence and judgement proportionate to the importance of the task and the confidence placed in them Correct answer.
  2. The use of a single fixed checklist for every audit so that results are comparable across sites
  3. Complete coverage of every record and every interview within the agreed audit scope, without exception and regardless of time
  4. A guarantee that no nonconformity anywhere in the organisation is ever missed by the team

Explanation

Due professional care means applying diligence and judgement in a way that is proportionate to the importance of the task and to the confidence placed in the auditors. It does not demand exhaustive coverage or guarantee that no nonconformity is ever missed.

Question 20Audit fundamentals and the principles of auditing (ISO 19011)

An auditor samples 15 of 400 access requests to test whether approvals were obtained. What does the evidence-based approach in ISO 19011 require the auditor to do?

  1. Treat the sample as conclusive proof that all 400 requests were approved correctly and report accordingly
  2. Rely on verbal assurance from the access administrator instead of examining the records
  3. Reject the sample outright because every one of the 400 requests must be examined in an audit
  4. Base findings on verifiable evidence and use samples whose size and selection are justified Correct answer.

Explanation

The evidence-based approach requires findings and conclusions to be based on verifiable information, with sampling used only where its size and selection can be justified. Conclusions are then drawn with an awareness of the sampling risk.

Question 21Audit fundamentals and the principles of auditing (ISO 19011)

An auditor concludes that a documented procedure exists but that staff are not following it. How is this correctly classified in ISO 19011 terms?

  1. An observation that requires no further action by the auditee
  2. An audit conclusion, because conclusions are reached at the level of individual pieces of evidence
  3. An opportunity for improvement only, since a procedure exists
  4. A nonconformity, because objective evidence does not fulfil an audit criterion Correct answer.

Explanation

A finding indicates nonconformity when the evidence shows that a requirement (here the organisation's own documented procedure) is not fulfilled. Individual results are findings; conclusions are drawn only after all findings are considered together.

Question 22Audit fundamentals and the principles of auditing (ISO 19011)

Which of the following is required content of an audit report according to ISO 19011?

  1. The full text of every document examined during the audit, appended for completeness
  2. The audit objectives, scope, criteria and the audit findings and conclusions Correct answer.
  3. The auditor's personal opinion of the auditee's management style and culture
  4. A list of the auditee's staff salaries and contractual arrangements

Explanation

ISO 19011 specifies that the audit report should include the audit objectives, scope, identification of the client and team, dates and locations, criteria, findings and conclusions. Opinions and unrelated personal data are not part of the required content.

Question 23Audit fundamentals and the principles of auditing (ISO 19011)

After considering all findings, an audit team states that the ISMS is effectively implemented and maintained, with two minor nonconformities. What is this statement called?

  1. An audit criterion
  2. An audit programme
  3. An audit conclusion Correct answer.
  4. An audit finding

Explanation

An audit conclusion is the outcome of an audit, reached after consideration of the audit objectives and all audit findings. Findings are the individual evaluation results, and criteria are the requirements they are measured against.

Question 24Audit fundamentals and the principles of auditing (ISO 19011)

What is the purpose of audit follow-up in ISO 19011?

  1. To reopen the audit programme and select a new audit team for the next certification cycle
  2. To re-issue the audit report with revised findings after the closing meeting
  3. To verify that corrective actions have been implemented and are effective Correct answer.
  4. To extend the audit scope to include additional sites and processes

Explanation

Follow-up verifies whether corrective actions arising from findings have been implemented and are effective, and it may form part of a subsequent audit. It does not change the scope or reopen the audit programme.

Question 25Audit fundamentals and the principles of auditing (ISO 19011)

Which auditing principle requires auditors to exercise discretion in the use and protection of information acquired during an audit?

  1. Confidentiality Correct answer.
  2. Fair presentation
  3. Integrity
  4. Independence

Explanation

Confidentiality requires auditors to exercise discretion in the use and protection of information acquired in the course of their duties, including information about the auditee's systems and people. Integrity and fair presentation concern conduct and reporting rather than information protection.

Question 26Audit fundamentals and the principles of auditing (ISO 19011)

An audit team plans to interview staff and review records using video conferencing and shared screens. How should this be handled according to ISO 19011?

  1. The methods should be agreed with the auditee and their risks considered when planning the audit Correct answer.
  2. The approach is prohibited because every audit must be conducted physically on the auditee's site
  3. The audit criteria must be rewritten to exclude records that are only viewed remotely
  4. The approach is acceptable only where the auditee signs a waiver giving up the right to receive the audit report

Explanation

ISO 19011 permits the use of information and communication technology to gather information, provided the methods are agreed with the auditee and their effectiveness and risks are considered during planning. On-site presence is not a universal requirement.

Question 27Audit fundamentals and the principles of auditing (ISO 19011)

An audit programme allocates more auditor days to the parts of the ISMS that handle payment data and fewer to a low-risk internal wiki. Which auditing principle does this best illustrate?

  1. Confidentiality
  2. Fair presentation
  3. Risk-based approach Correct answer.
  4. Due professional care

Explanation

The risk-based approach means an audit approach that considers risks and opportunities, so audit effort and depth are directed where the risks are greatest. Concentrating resources on payment data is a direct application of that principle.

Question 28Audit fundamentals and the principles of auditing (ISO 19011)

An auditor who helped design the organisation's access control process is assigned to audit that process. What is the most appropriate response under ISO 19011?

  1. Reassign the activity, since the auditor is not independent of the activity being audited Correct answer.
  2. Proceed, because deep knowledge of the process improves the quality and efficiency of the audit
  3. Proceed, provided the auditor signs the audit team's confidentiality declaration
  4. Proceed, because independence applies only to the audit client and not to individual auditors

Explanation

Auditors must be independent of the activity being audited wherever practicable, and they should not audit their own work because it undermines the objectivity of conclusions. Where independence cannot be fully maintained, the risk should be managed and the client informed.

Question 29Audit fundamentals and the principles of auditing (ISO 19011)

An auditor relies on a verbal statement from a single administrator and records it as evidence of an effective access review. What is the main weakness from an ISO 19011 perspective?

  1. The evidence is invalid because it was obtained during an interview rather than during a document inspection
  2. Verbal statements are never permitted as evidence and must always be excluded from the audit file
  3. The evidence is acceptable because auditors are expected to accept what auditees tell them
  4. The evidence is not verifiable and a single source is unlikely to be representative Correct answer.

Explanation

Audit evidence must be verifiable, and conclusions should rest on information that can be corroborated and is representative of the activity. An uncorroborated statement from one person satisfies neither condition on its own.

Question 30Audit fundamentals and the principles of auditing (ISO 19011)

An organisation reviews its audit programme annually to check whether it met its objectives and to identify improvements. Under ISO 19011, what is this activity?

  1. The competence evaluation of individual auditors only
  2. The preparation of the audit report for each audit
  3. Monitoring and reviewing the audit programme Correct answer.
  4. The opening meeting of each individual audit

Explanation

ISO 19011 requires the audit programme to be monitored and reviewed at defined intervals to assess whether its objectives have been met and to identify opportunities for improvement. This is a programme-level activity, distinct from steps within a single audit.

Question 31Audit planning, scope, criteria, documentation review and audit programme management

In an ISMS audit, what is meant by the audit criteria?

  1. The set of requirements used as a reference against which objective evidence is compared Correct answer.
  2. The arrangement of audits scheduled over a certification cycle
  3. The documented responsibilities assigned to the audit team members
  4. The extent and boundaries of the audit, including locations and processes

Explanation

Audit criteria are the requirements against which conformity is judged, and they may come from the standard, contracts, legislation or the organisation's own ISMS documentation. They are distinct from the scope, which defines boundaries, and from the programme, which schedules audits. The criteria must be agreed with the client and stated in the audit plan.

Question 32Audit planning, scope, criteria, documentation review and audit programme management

Which statement best describes the audit scope of an ISMS certification audit?

  1. The schedule of interviews and the allocation of auditors to clauses
  2. The extent and boundaries of the audit, such as locations and processes covered Correct answer.
  3. The objectives that the audit is expected to achieve
  4. The standards, contractual obligations and internal documents used as references

Explanation

The scope of an audit describes its extent and boundaries, including the functions, locations, processes and time period covered. It should be agreed with the client and should be consistent with the organisation's defined ISMS scope. Criteria and objectives are separate concepts that must be documented in their own right.

Question 33Audit planning, scope, criteria, documentation review and audit programme management

How does an audit programme differ from an audit plan?

  1. The programme is the arrangement of audits over a time frame; the plan details one audit Correct answer.
  2. The programme is prepared by the auditee, whereas the plan is prepared by the auditor
  3. The programme covers a single audit, whereas the plan covers a multi-year cycle
  4. The programme records audit findings, whereas the plan records audit criteria

Explanation

An audit programme is the arrangement of one or more audits planned for a specific time frame and directed towards a specific purpose. An audit plan is narrower: it describes the activities and arrangements for a single audit, such as timings, areas to be audited and team assignments. The programme may therefore contain many plans.

Question 34Audit planning, scope, criteria, documentation review and audit programme management

What is the primary purpose of the stage 1 audit in initial ISMS certification?

  1. Evaluating the client's ISMS documentation and readiness for the stage 2 audit Correct answer.
  2. Confirming that the ISMS controls are operating effectively in all areas
  3. Verifying that every Annex A control has been implemented as planned
  4. Deciding whether certification can be granted on the basis of documentation alone

Explanation

Stage 1 provides a focus for planning stage 2 by reviewing the client's documentation, evaluating understanding of the standard's requirements and confirming readiness for implementation evidence. It also reviews whether internal audits and management review are planned and performed. It does not evaluate the effectiveness of implemented controls, which is stage 2 work.

Question 35Audit planning, scope, criteria, documentation review and audit programme management

What do audit objectives describe?

  1. Which standard clauses will be audited first
  2. How long each audit activity will take
  3. What the audit is intended to accomplish Correct answer.
  4. Which sites and departments will be visited

Explanation

Audit objectives define what the audit sets out to achieve, for example determining conformity, evaluating effectiveness or identifying improvement opportunities. They are agreed with the client and drive the choice of scope, criteria and methods. The other options are matters of scope or of the audit plan.

Question 36Audit planning, scope, criteria, documentation review and audit programme management

Who establishes the audit plan for a certification audit, and how is it handled before the audit?

  1. The auditee's top management, and it is filed with the certification body
  2. The accreditation body, and it is issued to the audit team on the audit day
  3. The audit team leader, and it is communicated to the client before the audit Correct answer.
  4. The auditor who performs the documentation review, and it is kept from the auditee

Explanation

The audit plan is prepared by the audit team leader, who has the overview of objectives, criteria, scope and team competence. It must be agreed and communicated to the client in advance so that the auditee can arrange interviewees, records and facilities. Adjustments during the audit are permitted but should be communicated.

Question 37Audit planning, scope, criteria, documentation review and audit programme management

In the context of auditing, what does sampling mean?

  1. Asking the auditee to nominate the records to be examined
  2. Examining a selected subset of available information Correct answer.
  3. Selecting records only from the largest department within the audit scope
  4. Testing every record held in the area being audited

Explanation

Sampling is the examination of a selected subset of the available information in order to draw conclusions about the whole population within the audit scope. The sample should be sufficient and representative, and the auditor should remain in control of its selection. Sampling never guarantees full coverage, so findings should reflect that limitation.

Question 38Audit planning, scope, criteria, documentation review and audit programme management

What is the main purpose of reviewing the auditee's ISMS documentation before the audit?

  1. To decide the audit criteria for the certification
  2. To replace interviews and observation during the on-site audit
  3. To gather information and identify areas needing attention during the audit Correct answer.
  4. To confirm that the ISMS is fully effective

Explanation

Documentation review gathers information about the ISMS and helps the team leader target audit effort on areas of risk or potential weakness. It also supports the preparation of working documents and the audit plan. It cannot by itself demonstrate effectiveness, which requires evidence of implementation.

Question 39Audit planning, scope, criteria, documentation review and audit programme management

A stage 1 audit finds that the client has not yet completed an internal audit or a management review of its ISMS. What is the most appropriate action for the certification body?

  1. Address the concerns with the client and confirm they are resolved before stage 2 proceeds Correct answer.
  2. Issue a major nonconformity and suspend the application immediately
  3. Reduce the stage 2 audit time to compensate for the delay
  4. Proceed to stage 2 and verify the internal audit and management review there instead

Explanation

Stage 1 exists to establish readiness for stage 2, and internal audit and management review are key readiness indicators. Concerns raised at stage 1 must be communicated and resolved with the client before stage 2 so that stage 2 evidence is meaningful. Only where readiness cannot be demonstrated should progression be postponed.

Question 40Audit planning, scope, criteria, documentation review and audit programme management

Which set of factors most directly determines the audit time needed for an ISMS certification audit?

  1. The size and complexity of the scope, personnel numbers and prior audit results Correct answer.
  2. The number of Annex A controls listed in the Statement of Applicability
  3. The number of auditors the certification body wishes to deploy
  4. The number of pages in the ISMS documentation and the fee agreed

Explanation

Audit time reflects the effective number of personnel, the complexity of processes and technology, the number of sites, and the results of previous audits. These factors are applied using recognised rules such as IAF MD 5. Documentation volume and control counts alone are poor predictors of audit effort.

Question 41Audit planning, scope, criteria, documentation review and audit programme management

When must the first surveillance audit after initial certification be conducted?

  1. At any time before the first anniversary of the certificate's expiry
  2. Within six months of the certification decision date
  3. No later than twelve months from the certification decision date Correct answer.
  4. Within twelve months of the last day of the stage 2 audit

Explanation

Surveillance audits are conducted at least once a calendar year, and the first one must take place no later than twelve months from the certification decision date. The reference point is the decision date rather than the last day on site. Recertification years replace one surveillance cycle but do not change this anchor for the first surveillance.

Question 42Audit planning, scope, criteria, documentation review and audit programme management

How should recertification be planned in relation to the certificate expiry date?

  1. It is only required if surveillance audits found nonconformities
  2. It is planned and conducted in due time to allow renewal before the expiry date Correct answer.
  3. It must start on the expiry date so that the cycle is continuous
  4. It may be carried out at any time within twelve months after expiry

Explanation

Recertification activities must be planned and conducted with enough lead time for the recertification decision to be made before the existing certificate expires. If the decision cannot be taken in time, the certificate lapses and the status of the certification must be managed accordingly. Starting on the expiry date is therefore too late.

Question 43Audit planning, scope, criteria, documentation review and audit programme management

A client asks that one clause of ISO/IEC 27001 be excluded from its certification scope. How should the audit team leader respond?

  1. Accept the exclusion provided the client documents a justification in the Statement of Applicability
  2. Refer the request to the accreditation body for a decision before the audit
  3. Explain that all requirements apply within the defined scope, so the clause cannot be excluded Correct answer.
  4. Exclude the clause but record it as a minor nonconformity in the audit report

Explanation

ISO/IEC 27001 does not permit requirements to be excluded from the management system; applicability is handled through risk treatment and the Statement of Applicability for Annex A controls, not by deleting clauses. The certification scope may be narrowed in terms of organisational or system boundaries, but the requirements still apply within whatever scope is declared. The team leader should explain this before the audit begins.

Question 44Audit planning, scope, criteria, documentation review and audit programme management

During the audit, a planned interview cannot take place because the interviewee is unavailable. What should the audit team leader do?

  1. Replace the interview with a review of the auditee's internal audit reports
  2. Adjust the audit plan and inform the client of the change Correct answer.
  3. Raise a nonconformity against the auditee for lack of cooperation
  4. Stop the audit and reschedule it in full

Explanation

Audit plans are working documents and may be adjusted as evidence gathering progresses, provided changes are agreed with the client and the audit objectives remain achievable. The team leader should assess whether alternative evidence can satisfy the objective. Unavailability alone is not evidence of a management system failure.

Question 45Audit planning, scope, criteria, documentation review and audit programme management

An audit in which two management system standards are audited together at a single auditee is called a:

  1. special audit
  2. combined audit Correct answer.
  3. joint audit
  4. surveillance audit

Explanation

ISO 19011 distinguishes a combined audit, where two or more management systems are audited together at a single auditee, from a joint audit, where two or more auditing organisations cooperate on the same auditee. The distinction matters for planning, team composition and reporting responsibilities. A surveillance audit describes timing within a certification cycle, not the number of systems covered.

Question 46Audit planning, scope, criteria, documentation review and audit programme management

When allocating audit effort across the processes of an ISMS, which input is most relevant?

  1. The risk significance of processes and the results of previous audits Correct answer.
  2. The number of years the audit team leader has worked in the sector
  3. The IT manager's preference for which areas to cover
  4. The order of the Annex A control themes in the standard

Explanation

Audit effort should follow risk: processes that carry greater information security risk, or that have a history of nonconformity, warrant more time and deeper sampling. Prior audit results, incident history and changes to the environment are therefore key inputs to planning. The structure of the standard is not itself a basis for weighting effort.

Question 47Audit planning, scope, criteria, documentation review and audit programme management

Part of an ISMS audit is to be conducted using information and communication technology. What should the audit team do?

  1. Obtain the accreditation body's approval for each remote session
  2. Treat remote interviews as equivalent to document review only
  3. Reduce the audit duration by at least half to reflect the lack of travel
  4. Assess the risks to the validity of the evidence and agree the arrangements with the auditee Correct answer.

Explanation

Using ICT changes how evidence is gathered but not the standard of evidence required, so the team must consider risks such as connectivity, information security, and the auditee's ability to demonstrate processes remotely. Arrangements for platforms, access and confidentiality should be agreed in advance. Audit time is determined by the factors affecting the audit, not by travel savings alone.

Question 48Audit planning, scope, criteria, documentation review and audit programme management

The client's ISMS policy contains a requirement that conflicts with ISO/IEC 27001. How should the auditor treat this?

  1. Treat the standard as guidance only where the policy differs
  2. Disregard the policy and audit only against the standard
  3. Audit against all applicable criteria and report the conflict as a finding Correct answer.
  4. Treat the client's policy as the sole audit criterion

Explanation

The audit criteria normally comprise the standard, applicable legislation and contracts, and the client's own ISMS requirements. Where these conflict, the auditor evaluates conformity against all of them and reports the conflict as a finding. The auditor does not arbitrate by silently dropping one criterion.

Question 49Audit planning, scope, criteria, documentation review and audit programme management

What is the most appropriate basis for selecting the audit team for an ISMS audit of a cloud service provider?

  1. The client's preference for particular individual auditors
  2. The competences needed to achieve the audit objectives Correct answer.
  3. The seniority of auditors within the certification body
  4. The availability of auditors on the client's preferred dates

Explanation

Team selection follows from the competences required to meet the objectives, covering ISMS knowledge, sector knowledge and technology knowledge such as cloud architectures and shared responsibility models. Impartiality must also be assured, and no team member should have audited the client's own work. Availability and seniority are secondary considerations.

Question 50Audit planning, scope, criteria, documentation review and audit programme management

At the opening meeting the team leader learns that a data centre critical to the ISMS scope was omitted from the audit plan. What should happen?

  1. Audit the data centre without altering the plan or the agreed scope
  2. Continue as planned and note the omission in the audit report
  3. Inform the client and the certification body, and resolve the scope issue before continuing Correct answer.
  4. Close the meeting and withdraw the certificate immediately

Explanation

The audit conclusion must be valid for the declared scope, so any material gap in coverage has to be resolved rather than merely recorded. The team leader should inform the client and the certification body and agree how to address the additional activities, including any effect on time and resources. Only then can the audit proceed on a sound basis.