CQI/IRCA ISMS Lead Auditor study guide
CQI/IRCA ISMS Lead Auditor · Work through your exam, one topic at a time.
The CQI/IRCA ISMS Lead Auditor credential is a personnel certification for people who audit information security management systems against ISO/IEC 27001. It is administered through the UK's Chartered Quality Institute and International Register of Certificated Auditors, and is normally earned by completing an IRCA-certified lead auditor training course, passing the course's written examination, and being assessed on audit-practice exercises run during the course. The CQI/IRCA ISMS Lead Auditor study guide has 8 sections and about 2,760 words.
01The ISMS: purpose, benefits and the structure of ISO/IEC 27001
An information security management system is the set of interrelated policies, processes, roles and records by which an organisation preserves confidentiality, integrity and availability of information. ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving such a system; it does not mandate specific technologies.
339 words, about 2 min02Audit fundamentals and the principles of auditing (ISO 19011)
An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Systematic means planned and consistent; independent means free from bias and conflict of interest; documented means the process and its results are recorded.
337 words, about 2 min03Audit planning, scope, criteria, documentation review and programme management
The audit programme (clause 9.2) is the set of audits arranged over a period, with objectives, frequency, methods, responsibilities and resourcing. The audit plan covers one audit: schedule, activities, team, sampling approach and logistics.
348 words, about 2 min04Conducting the audit: evidence, interviewing, sampling and technique
Evidence is objective when it is verifiable and traceable to records, observations or statements of fact. Hearsay and unsupported assertion are not objective evidence.
353 words, about 2 min05Findings, nonconformity reporting, conclusions and corrective-action follow-up
A nonconformity is a failure to fulfil a requirement of the audit criteria. 'Major' typically means a required element of the ISMS is absent, a systemic breakdown exists, or the failure would prevent the ISMS achieving its intended results or leaves significant risk unmanaged.
325 words, about 2 min06Leading the audit team: communications, conflict and competence
Plan and allocate work, brief and guide team members, manage the interface with the auditee, control the schedule, resolve disagreements within the team, and take responsibility for the report. The leader represents the audit team, but cannot unilaterally change the audit scope or criteria - those are agreed with the client.
350 words, about 2 min07ISO/IEC 27001 requirements and Annex A controls in an audit context
Clause 4: issues, interested parties, scope, processes. Clause 5: leadership, policy, roles.
362 words, about 2 min08Related standards, risk concepts and the legal, regulatory and certification context
ISO/IEC 27002:2022 provides implementation guidance and attributes for the Annex A controls but is not certifiable. ISO/IEC 27003 covers implementation, 27004 measurement, 27005 information security risk management, 27017 cloud services, 27018 cloud PII, 27035 incident management, 27036 supplier relationships, and 27701 extends the ISMS to privacy.
346 words, about 2 min