I85PREP
⌘ K
Exemplar Global ISMS Lead Auditor study materials
Exemplar Global ISMS Lead Auditor study resources

Exemplar Global ISMS Lead Auditor practice questions

One question at a time. Build your Exemplar Global ISMS Lead Auditor understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1ISMS criteria, programme and independent audit planning

Which international standard provides the auditable requirements for an information security management system used as audit criteria?

  1. ISO/IEC 27000:2018
  2. ISO/IEC 27001:2022 Correct answer.
  3. ISO/IEC 27002:2022
  4. ISO/IEC 27005:2022

Explanation

ISO/IEC 27001:2022 contains the certifiable ISMS requirements and is the standard against which ISMS audits are conducted. ISO 27000 defines vocabulary, ISO 27002 gives implementation guidance for Annex A controls, and ISO 27005 provides guidance on information security risk management.

Question 2ISMS criteria, programme and independent audit planning

Which clause of ISO/IEC 27001:2022 requires the organization to determine the scope of its ISMS?

  1. 4.1
  2. 4.3 Correct answer.
  3. 5.2
  4. 6.1

Explanation

Clause 4.3 requires the organization to determine the boundaries and applicability of the ISMS to establish its scope. The scope must consider internal/external issues (4.1), requirements of interested parties (4.2), and interfaces and dependencies with other organizations, and be available as documented information.

Question 3ISMS criteria, programme and independent audit planning

Which ISO/IEC 27001:2022 clause covers nonconformity and corrective action?

  1. 9.2
  2. 10.2 Correct answer.
  3. 8.7
  4. 6.1

Explanation

Clause 10.2 requires reacting to nonconformity, evaluating the need for action to eliminate the cause, implementing action, reviewing effectiveness, and making changes to the ISMS if necessary. Documented information of nature and actions taken must be retained.

Question 4ISMS criteria, programme and independent audit planning

In ISO/IEC 27001:2022 Clause 6.1.2, information security risk assessment must:

  1. Use ISO 31000 risk registers only
  2. Establish criteria, identify risks, analyze, and evaluate risks consistently to produce comparable, valid and reproducible results Correct answer.
  3. Eliminate all risk before certification
  4. Be optional for organizations under 50 employees

Explanation

Clause 6.1.2 requires the organization to define and apply an information security risk assessment process that establishes risk criteria (including acceptance and assessment criteria), and ensures repeated assessments produce consistent, valid and comparable results. ISO 27005 provides guidance.

Question 5ISMS criteria, programme and independent audit planning

Who has overall accountability for the effectiveness of the ISMS under ISO/IEC 27001:2022?

  1. The CISO
  2. Top management Correct answer.
  3. The certification auditor
  4. The internal audit team

Explanation

Clause 5.1 places accountability for ISMS effectiveness on top management. Top management must demonstrate leadership by ensuring resources, integrating ISMS into business processes, communicating importance, and promoting continual improvement.

Question 6ISMS criteria, programme and independent audit planning

In ISO/IEC 27001:2022, 'documented information' encompasses:

  1. Only procedures and policies
  2. Only retained records
  3. Information to be maintained AND evidence to be retained Correct answer.
  4. Only externally controlled documents

Explanation

Documented information replaced the older distinction between 'documents' and 'records'. It covers both information maintained to support operation of the ISMS (policies, procedures, risk methodology) and evidence retained to show results were achieved (risk assessment results, audit reports, monitoring records).

Question 7ISMS criteria, programme and independent audit planning

Which clause of ISO/IEC 27001:2022 specifically requires internal audits at planned intervals?

  1. 9.1
  2. 9.2 Correct answer.
  3. 9.3
  4. 10.1

Explanation

Clause 9.2 requires the organization to conduct internal audits at planned intervals to determine whether the ISMS conforms to its own requirements and to ISO 27001, and is effectively implemented and maintained.

Question 8ISMS criteria, programme and independent audit planning

Which clause of ISO/IEC 27001:2022 addresses competence?

  1. 7.2 Correct answer.
  2. 7.4
  3. 8.1
  4. 9.1

Explanation

Clause 7.2 requires the organization to determine necessary competence of persons doing work that affects ISMS performance, ensure they are competent based on education, training, or experience, take actions to acquire competence where needed, and retain documented information as evidence.

Question 9ISMS criteria, programme and independent audit planning

Which clause of ISO/IEC 27001:2022 requires the organization to determine internal and external issues relevant to its purpose?

  1. 4.1 Correct answer.
  2. 4.2
  3. 4.3
  4. 6.2

Explanation

Clause 4.1 'Understanding the organization and its context' requires the organization to determine external and internal issues relevant to its purpose and that affect its ability to achieve the intended outcome of its ISMS - typically including regulatory landscape, threat environment, business model, and supply chain.

Question 10ISMS criteria, programme and independent audit planning

Information security objectives per Clause 6.2 of ISO/IEC 27001:2022 must be:

  1. Secret and known only to top management
  2. Consistent with the policy, measurable, monitored, communicated, and updated as appropriate Correct answer.
  3. Identical across all departments
  4. Approved by the certification body before use

Explanation

Clause 6.2 requires information security objectives to be consistent with the policy, measurable (if practicable), take into account applicable requirements and risk assessment/treatment results, monitored, communicated, and updated as appropriate. Plans must define what, who, when, resources, and how results will be evaluated.

Question 11ISMS criteria, programme and independent audit planning

Which clause of ISO/IEC 27001:2022 covers operational planning and control of risk treatment?

  1. 7.1
  2. 8.1 Correct answer.
  3. 8.3
  4. 9.1

Explanation

Clause 8.1 operational planning and control requires the organization to plan, implement, and control processes needed to meet requirements and to implement the actions in Clause 6.1, including the risk treatment plan. Documented information must be retained to demonstrate processes are carried out as planned.

Question 12ISMS criteria, programme and independent audit planning

Which clause of ISO/IEC 27001:2022 addresses management review?

  1. 9.2
  2. 9.3 Correct answer.
  3. 10.1
  4. 10.2

Explanation

Clause 9.3 requires top management to review the ISMS at planned intervals to ensure continuing suitability, adequacy, and effectiveness. It specifies required inputs (audit results, status of nonconformities, monitoring results, feedback from interested parties, risk assessment results, opportunities for continual improvement) and required outputs.

Question 13ISMS criteria, programme and independent audit planning

Which is a required input to ISMS management review per Clause 9.3.2?

  1. Stock prices
  2. Status of nonconformities, monitoring results, audit results, fulfilment of objectives, and feedback from interested parties Correct answer.
  3. Number of employees who took vacation
  4. Lunch menu satisfaction

Explanation

Clause 9.3.2 lists required inputs including: status of previous review actions, changes in external/internal issues, feedback on ISMS performance (NCs, monitoring/measurement, audit results, fulfilment of objectives), feedback from interested parties, risk assessment and risk treatment plan results, and opportunities for continual improvement.

Question 14ISMS criteria, programme and independent audit planning

Which evidence best demonstrates conformity with Clause 7.2 competence in an ISMS?

  1. A training calendar showing planned courses
  2. Records that identify competence required for security roles, evidence personnel have achieved it (certifications, training, experience), evaluation of effectiveness, and corroborating job output Correct answer.
  3. A motivational security poster
  4. A statement that everyone is experienced

Explanation

Clause 7.2 requires determining competence needed, ensuring competence is achieved (education, training, experience), taking actions if gaps exist, and retaining documented information. Auditors verify required competence is defined for ISMS roles (SOC analysts, administrators, risk owners), achieved, evaluated, and reflected in actual work.

Question 15ISMS criteria, programme and independent audit planning

An auditor finds during interview that an HR specialist believes the information security policy is 'whatever IT says today.' This may indicate a nonconformity against:

  1. Clause 5.2 communication and availability of the information security policy Correct answer.
  2. Clause 8.3 risk treatment
  3. Clause 7.5 documented information
  4. Clause 9.1 monitoring

Explanation

Clause 5.2 requires the information security policy to be available as documented information, communicated within the organization, and available to interested parties as appropriate. If a worker cannot reasonably articulate the policy's intent (not memorization, but understanding), this suggests the communication requirement is not effectively met.

Question 16ISMS criteria, programme and independent audit planning

During Stage 2, an auditor finds a critical process has no documented procedure, while ISO 27001 requires documented information necessary for ISMS effectiveness. The auditor should:

  1. Immediately classify a major NC based on lack of documents
  2. Investigate whether the process is consistently performed and produces conforming outputs; ISO 27001 does not require documents for all processes - only those determined necessary Correct answer.
  3. Withdraw from the audit
  4. Ask the auditee to write a procedure during the audit

Explanation

ISO 27001:2022 Clause 7.5.1 requires documented information 'determined by the organization as being necessary for the effectiveness of the ISMS.' Auditors test process effectiveness via outputs, not just document existence. However, certain documented information IS mandatory (scope, policy, risk methodology, SoA, risk treatment plan, internal audit results, management review).

Question 17ISMS criteria, programme and independent audit planning

A security KPI dashboard shows 'green' (on-target) but excludes incidents from the largest cloud workload. The auditor should:

  1. Accept the dashboard at face value
  2. Investigate whether monitoring methods produce valid results per Clause 9.1 and whether exclusions are justified given the ISMS scope Correct answer.
  3. Raise an NC because all KPIs should be red sometimes
  4. Ignore KPIs entirely

Explanation

Clause 9.1 requires the organization to determine what needs to be monitored, methods, when, and who. Excluding significant in-scope workloads may undermine validity unless justified. The auditor should probe the methodology and scope, not the colour.

Question 18ISMS criteria, programme and independent audit planning

Which is the BEST distinction between an information security event, an information security incident, and a nonconformity?

  1. They are the same
  2. An event is an identified occurrence; an incident is one or more related events that compromise security; a nonconformity is non-fulfilment of an ISMS requirement Correct answer.
  3. Events apply to people, incidents to systems
  4. Only nonconformities require documented information

Explanation

ISO 27000 defines: an information security event as an identified occurrence indicating a possible breach or failure of controls; an information security incident as one or more unwanted/unexpected events with significant probability of compromising business and threatening information security; a nonconformity as non-fulfilment of a requirement. They are different concepts auditors must distinguish.

Question 19ISMS criteria, programme and independent audit planning

Which is the BEST example of demonstrating 'leadership' per Clause 5.1 of ISO/IEC 27001:2022?

  1. Top management signing the information security policy poster
  2. Top management taking accountability for ISMS effectiveness, integrating it into business processes, communicating its importance, ensuring resources, and supporting people to contribute Correct answer.
  3. The CISO attending all audits
  4. Adopting another company's information security manual

Explanation

Clause 5.1 lists specific demonstrations of leadership including: accountability for ISMS effectiveness, ensuring the policy and objectives are established and compatible with strategic direction, integration of ISMS requirements into business processes, ensuring resources, communicating importance, ensuring ISMS achieves intended outcomes, and developing/engaging/supporting/directing people.

Question 20ISMS criteria, programme and independent audit planning

How many controls are in Annex A of ISO/IEC 27001:2022?

  1. 114 controls in 14 clauses
  2. 93 controls in 4 themes Correct answer.
  3. 133 controls in 11 domains
  4. 100 controls in 5 categories

Explanation

ISO/IEC 27001:2022 Annex A contains 93 controls organized into 4 themes: Organizational (37, A.5.x), People (8, A.6.x), Physical (14, A.7.x), and Technological (34, A.8.x). This consolidated the prior 114 controls from ISO 27001:2013 and introduced 11 new controls.

Question 21ISMS criteria, programme and independent audit planning

Which new control was introduced in ISO/IEC 27001:2022 Annex A to address threat intelligence?

  1. A.5.7 Threat intelligence Correct answer.
  2. A.5.30 ICT readiness for business continuity
  3. A.8.16 Monitoring activities
  4. A.5.23 Information security for use of cloud services

Explanation

A.5.7 Threat intelligence is one of the 11 new controls added in ISO/IEC 27001:2022 Annex A. It requires the organization to collect and analyze information relating to information security threats to produce threat intelligence.

Question 22ISMS criteria, programme and independent audit planning

Which Annex A:2022 control addresses data leakage prevention?

  1. A.8.12 Data leakage prevention Correct answer.
  2. A.8.16 Monitoring activities
  3. A.5.34 Privacy and protection of PII
  4. A.8.11 Data masking

Explanation

A.8.12 Data leakage prevention is a new control introduced in ISO/IEC 27001:2022 Annex A. It requires data leakage prevention measures to be applied to systems, networks, and any other devices that process, store, or transmit sensitive information.

Question 23ISMS criteria, programme and independent audit planning

Which Annex A:2022 control covers information security incident management planning?

  1. A.5.24 Information security incident management planning and preparation Correct answer.
  2. A.8.16 Monitoring activities
  3. A.5.7 Threat intelligence
  4. A.6.8 Information security event reporting

Explanation

A.5.24 Information security incident management planning and preparation requires the organization to plan and prepare for managing information security incidents by defining, establishing, and communicating processes, roles, and responsibilities. Related controls include A.5.25 assessment, A.5.26 response, A.5.27 learning, and A.5.28 evidence collection.

Question 24ISMS criteria, programme and independent audit planning

Which Annex A:2022 control covers information security in supplier relationships?

  1. A.5.19 Information security in supplier relationships Correct answer.
  2. A.5.23 Information security for use of cloud services
  3. A.5.21 Managing information security in the ICT supply chain
  4. A.5.20 Addressing information security within supplier agreements

Explanation

A.5.19 Information security in supplier relationships is the umbrella control requiring processes to manage information security risks associated with use of supplier products or services. A.5.20 (agreements), A.5.21 (ICT supply chain), A.5.22 (monitoring), and A.5.23 (cloud services) build on it.

Question 25ISMS criteria, programme and independent audit planning

Annex SL provides which feature for management system standards including ISO 27001?

  1. A list of certification bodies
  2. A high-level structure with common clauses, text, and terminology Correct answer.
  3. A schedule of mandatory audit fees
  4. A template for nonconformity reports

Explanation

Annex SL (now Appendix 2 to the ISO/IEC Directives) provides the high-level structure, identical core text, common terms, and core definitions used across all management system standards. This makes ISO 9001, ISO 14001, ISO 27001, and others structurally aligned with clauses 4-10.

Question 26ISMS criteria, programme and independent audit planning

What is the Statement of Applicability (SoA) per ISO/IEC 27001:2022 Clause 6.1.3 d?

  1. A list of all organizational policies
  2. A documented statement containing the necessary controls, justifications for their inclusion, whether they are implemented, and justifications for excluding any Annex A controls Correct answer.
  3. A risk register
  4. A vendor contract

Explanation

Clause 6.1.3 d requires the SoA to contain the necessary controls determined by risk treatment, justification for their inclusion, current implementation status, and justification for exclusion of any Annex A controls. The SoA is the single document linking risk treatment outputs to Annex A.

Question 27ISMS criteria, programme and independent audit planning

An auditor finds the organization's SoA marks A.8.16 Monitoring activities as 'Excluded' but the organization clearly runs a SIEM and monitors networks and applications. Which ISO 27001 area is most directly implicated?

  1. Clause 6.1.3 d - SoA justification of inclusion/exclusion of Annex A controls Correct answer.
  2. Clause 8.3 design only
  3. Clause 7.4 communication only
  4. Clause 5.2 policy

Explanation

Clause 6.1.3 d requires the SoA to contain controls determined necessary, justification for inclusion, implementation status, and justification for any exclusion. Excluding a control that is actually implemented contradicts both the risk treatment plan and operational reality, undermining the integrity of the SoA.

Question 28ISMS criteria, programme and independent audit planning

An organization claims certain Annex A:2022 controls 'do not apply' to their service business (e.g., A.7 Physical controls because they are 100% cloud-hosted). The auditor must verify:

  1. The controls are irrelevant because they are cloud-only
  2. Whether the SoA justifies the exclusion (Clause 6.1.3 d), whether physical controls of the cloud provider are addressed through supplier management (A.5.19-A.5.23), and whether on-premises facilities such as offices still require A.7 controls Correct answer.
  3. Service businesses cannot have A.7 controls
  4. Non-applicability is automatic for cloud-only organizations

Explanation

Clause 6.1.3 d requires justification for excluded Annex A controls. Even a fully cloud-hosted organization typically still has offices and end-user devices requiring physical and people controls; physical controls in cloud DCs are addressed through supplier assurance (A.5.19-A.5.23, A.5.34 PII processors). Blanket exclusion is almost never justified.

Question 29ISMS sampling, findings, reporting and corrective follow-up

What is the primary purpose of a closing meeting?

  1. To negotiate findings with the auditee
  2. To present audit findings and conclusions so they are understood and acknowledged Correct answer.
  3. To approve corrective action plans
  4. To select auditors for the next audit

Explanation

ISO 19011 Clause 6.4.10 identifies closing meeting purposes: present audit findings and conclusions, ensure they are understood by the auditee, identify post-audit activities (corrective action submission, follow-up), and address any diverging opinions formally.

Question 30ISMS sampling, findings, reporting and corrective follow-up

What is the best practice for handling a disagreement between auditor and auditee on an ISMS audit finding?

  1. Auditor withdraws the finding immediately to avoid conflict
  2. Auditor and auditee review the requirement and evidence objectively; if disagreement persists, it is recorded and reported per the audit process Correct answer.
  3. Auditor escalates to top management immediately
  4. Finding is removed if the auditee promises to fix it later

Explanation

ISO 19011 expects auditors to handle diverging opinions professionally: re-examine criteria, evidence, and wording. If the disagreement is not resolved, it should be documented in the audit report. The auditee's promise does not eliminate evidence-based findings.

Question 31ISMS sampling, findings, reporting and corrective follow-up

During an audit, a system administrator demonstrates a privileged-access workflow that differs from the documented procedure. The auditor should:

  1. Immediately raise a major nonconformity
  2. Investigate further: ask why, observe logs and approval records, check if the procedure is current and required, and triangulate evidence Correct answer.
  3. Ignore it because interviews alone are unreliable
  4. Instruct the administrator on the correct method

Explanation

Auditors must corroborate evidence through observation, logs (A.8.15 Logging), approval records, and additional interviews before raising findings. The deviation may be a document control issue (A.5.37), a recent unapproved change, training gap, or no issue at all if the procedure is outdated.

Question 32ISMS sampling, findings, reporting and corrective follow-up

Which is the MOST important quality of an effective ISMS opening meeting?

  1. Maximum formality
  2. Clear communication of audit purpose, scope, plan, methods, and arrangements to all attendees including handling of classified information Correct answer.
  3. Long duration
  4. Many slides

Explanation

The opening meeting must align auditor and auditee on the audit's purpose, scope, criteria, plan, methods, communication channels, safety, confidentiality of sensitive evidence, and post-audit activities. Clarity supports cooperation and efficient fieldwork. Formality, length, and slides are secondary.

Question 33ISMS sampling, findings, reporting and corrective follow-up

During fieldwork, an auditor observes a server room door propped open with no badge enforcement, against the auditee's procedure under A.7.2 Physical entry. The auditor should:

  1. Ignore it because the audit is ISMS not physical security
  2. Immediately demand the door be closed
  3. Document the observation with timestamp/location, communicate the safety/security concern to escorts, and gather corroborating evidence (badge logs, CCTV) Correct answer.
  4. Raise a minor NC and move on without further evidence

Explanation

ISO 19011 expects auditors to communicate significant risks through agreed channels without taking over operational decisions. Physical entry is in scope for ISMS (A.7.2 in the new Physical theme). Auditors document, communicate, and corroborate before raising findings; classification depends on systemic vs. isolated and impact.

Question 34ISMS sampling, findings, reporting and corrective follow-up

Which of the following BEST illustrates a 'leading question' that an ISMS auditor should AVOID?

  1. Can you show me how a user account is provisioned?
  2. You always disable accounts within 24 hours of termination, right? Correct answer.
  3. What happens when a phishing report comes in?
  4. How do you handle access to backups?

Explanation

Leading questions suggest the desired answer and produce biased evidence. The second option implies the answer is yes (and references the auditee's expected control). Open process-based questions invite the auditee to describe actual practice and produce richer audit trails - which is especially valuable for verifying Annex A.5.18 (access rights) and HR-related controls.

Question 35ISMS sampling, findings, reporting and corrective follow-up

Per ISO 19011, recording ISMS audit findings during fieldwork should be:

  1. Done from memory at the end of the day
  2. Documented contemporaneously with sufficient detail (criterion such as ISO 27001 clause or Annex A control number, evidence source, sample identifiers, system names, interviewee role) to allow later verification and report writing Correct answer.
  3. Done only after the closing meeting
  4. Skipped if no NCs are expected

Explanation

Contemporaneous notes that capture criterion (clause/control), evidence source (log file name, document version, system ID), sample identifiers, names of interviewees by role, and observations support traceability and report writing. Memory-based recording at day's end introduces error. Notes also protect the auditor if findings are challenged.

Question 36ISMS sampling, findings, reporting and corrective follow-up

A nonconformity statement should include three core elements. They are:

  1. Statement of nonconformity, evidence, and requirement Correct answer.
  2. Recommendation, action plan, and deadline
  3. Auditor name, audit date, and location
  4. Pass/fail decision, score, and signature

Explanation

A well-written NCR has three parts often remembered as SER: Statement of the nonconformity (what failed), Evidence (objective, verifiable), and the Requirement (ISO 27001 clause, Annex A control, organizational procedure, contract, or law breached). All three are required for a defensible finding.

Question 37ISMS sampling, findings, reporting and corrective follow-up

A 'major' nonconformity in an ISMS audit is most commonly classified when:

  1. A single spelling error appears in a policy
  2. The ISMS or a key control fails to address an ISO 27001 requirement or an Annex A control in the SoA, or the failure raises significant doubt about the ISMS's ability to achieve its information security outcomes Correct answer.
  3. An auditor prefers a different procedure format
  4. A meeting started 5 minutes late

Explanation

While certification bodies define classification rules, a major nonconformity typically reflects a systemic failure to implement a required clause or SoA-listed Annex A control, absence of a required process (e.g., risk assessment), or a single failure with significant security impact. It usually requires correction before certification.

Question 38ISMS sampling, findings, reporting and corrective follow-up

A finding is documented as: 'IT security is bad.' This finding is:

  1. Excellent and ready to issue
  2. Poorly written: it lacks the requirement (ISO 27001 clause or Annex A control), objective evidence, and specific nature of the failure Correct answer.
  3. Acceptable because it identifies a department
  4. Minor and can be issued as-is

Explanation

A defensible ISMS nonconformity must state (1) the specific requirement breached (ISO 27001 clause, Annex A control, organizational procedure, contract), (2) the objective verifiable evidence (sampled records, system observations), and (3) the precise nature of the failure. Vague subjective language must be avoided.

Question 39ISMS sampling, findings, reporting and corrective follow-up

In an ISMS audit, an 'opportunity for improvement' (OFI) is:

  1. A nonconformity
  2. An observation that is not a nonconformity but suggests an area where the auditee could enhance the ISMS Correct answer.
  3. A required corrective action
  4. A mandatory recommendation

Explanation

An OFI is a positive observation pointing to where the organization could improve its ISMS, even though no requirement is breached. OFIs must not be disguised consulting (e.g., proposing a specific technology), and the auditee is not required to act on them.

Question 40ISMS sampling, findings, reporting and corrective follow-up

Which best describes a 'systemic' nonconformity in an ISMS?

  1. A one-off error in a single user account
  2. A failure repeated across multiple users, systems, or business units indicating an Annex A control or ISMS process is not effectively implemented Correct answer.
  3. An auditor preference
  4. An OFI

Explanation

A systemic NC reflects a recurring failure across multiple sampled records, systems, or business units, indicating the underlying control or ISMS process is inadequate. These often warrant major NC classification because they affect the ISMS broadly, not a single instance.

Question 41ISMS sampling, findings, reporting and corrective follow-up

Which BEST describes 'audit conclusions' per ISO 19011?

  1. A list of all evidence gathered
  2. The outcome of an audit after consideration of the audit objectives and all audit findings, including positive and negative aspects Correct answer.
  3. A single pass/fail decision
  4. The closing meeting minutes

Explanation

ISO 19011 defines audit conclusions as the outcome of an audit, after considering audit objectives and all findings. For ISMS, conclusions address conformity to ISO 27001 and Annex A controls in the SoA, ISMS effectiveness, capability of management review and risk processes, and may include recommendations.

Question 42ISMS sampling, findings, reporting and corrective follow-up

Which of the following is the MOST defensible ISMS nonconformity statement?

  1. The access control process is weak and should be improved.
  2. ISO 27001:2022 Annex A.5.18 requires access rights to be reviewed at planned intervals. For 5 of 12 sampled privileged accounts (DBA-001, DBA-004, OPS-007, OPS-011, OPS-013), no access review records were retained for the last 12 months, contrary to procedure IAM-04 which requires quarterly review. Correct answer.
  3. Access control is non-compliant.
  4. Privileged users were not reviewed. Major NC.

Explanation

This statement identifies the requirement (A.5.18 and IAM-04), provides specific verifiable evidence (5 of 12 named accounts, missing records, time period), and clearly states the failure. It enables defensible classification and effective corrective action.

Question 43ISMS sampling, findings, reporting and corrective follow-up

An organization argues that a finding should be downgraded from major to minor because they will fix it quickly. The auditor should:

  1. Downgrade it as a goodwill gesture
  2. Classify based on the criteria-evidence-impact at the time of the audit, independent of future intent Correct answer.
  3. Always classify as minor when fix is promised
  4. Remove the finding

Explanation

Classification reflects the conformity status at the time of the audit and the significance of the deviation, not the auditee's future intentions. Speed of correction is relevant to follow-up actions, not classification. Auditor independence requires resisting classification pressure.

Question 44ISMS sampling, findings, reporting and corrective follow-up

What is the PRIMARY purpose of an ISMS audit report?

  1. To replace direct communication with the auditee
  2. To provide a complete, accurate, concise, and clear record of the audit including objectives, scope, criteria, findings, and conclusions, suitable for the audit client and intended distribution Correct answer.
  3. To list auditor expenses
  4. To recommend specific technical controls to the auditee

Explanation

ISO 19011 Clause 6.5 requires the audit report to be complete, accurate, concise, and clear, including audit objectives, scope, criteria, dates, locations, team, findings, conclusions, and statement of confidence in audit conclusions. Recommending specific controls would be consulting and threatens impartiality.

Question 45ISMS sampling, findings, reporting and corrective follow-up

During Stage 2, the auditor finds the organization has performed no internal audits in the past 12 months despite an annual cycle. This is MOST appropriately:

  1. An OFI
  2. A minor NC because internal audit is just one clause
  3. A major NC against Clause 9.2 because internal audit is a required process and the absence affects multiple downstream requirements (management review inputs, risk assurance) Correct answer.
  4. Outside the auditor's concern

Explanation

Total absence of a required process (internal audit) over a planned cycle is a systemic failure. It also undermines management review inputs (Clause 9.3.2), risk assurance, and continual improvement. For ISMS, this is usually classified as a major NC requiring resolution before certification.

Question 46ISMS sampling, findings, reporting and corrective follow-up

What is the PRIMARY difference between an 'observation' and a 'nonconformity' in an ISMS audit?

  1. Observations are always more serious
  2. An observation is a factual statement supported by evidence but not (yet) a nonconformity; a nonconformity is a non-fulfilment of a specified requirement (ISO 27001 clause, Annex A control, organizational procedure) Correct answer.
  3. Observations have no place in audit reports
  4. They are synonyms

Explanation

An observation captures a fact relevant to the audit (e.g., a potential weakness, trend, or context) without yet establishing breach of a requirement. A nonconformity is a documented non-fulfilment of a specified requirement. Some CBs use 'observation' interchangeably with 'OFI'; check definitions in audit programme procedures.

Question 47ISMS criteria, programme and independent audit planning

Audit criteria are best defined as:

  1. The auditor's personal opinion of good practice
  2. The set of policies, procedures, or requirements used as a reference against which audit evidence is compared Correct answer.
  3. The final certification decision
  4. The audit team's qualifications

Explanation

Per ISO 19011, audit criteria are the set of policies, procedures, or requirements used as a reference against which objective evidence is compared. Common ISMS criteria include ISO 27001 clauses, Annex A controls, the organization's own information security policies, customer requirements, and statutory/regulatory requirements such as GDPR.

Question 48ISMS criteria, programme and independent audit planning

Which ISO 19011 principle requires auditors to act in an ethical manner with trust, integrity, and confidentiality?

  1. Risk-based approach
  2. Integrity Correct answer.
  3. Independence
  4. Evidence-based approach

Explanation

Integrity is the foundation of professionalism in ISO 19011:2018. Auditors must perform their work ethically, with honesty and responsibility, comply with legal requirements, and demonstrate competence while performing work.

Question 49ISMS criteria, programme and independent audit planning

Which of the following is a third-party ISMS audit?

  1. A supplier audit conducted by a customer
  2. An internal audit conducted by the organization itself
  3. A certification audit conducted by an accredited certification body Correct answer.
  4. An audit conducted by a parent company on a subsidiary

Explanation

Third-party audits are conducted by independent external organizations such as accredited certification bodies (operating under ISO/IEC 27006). First-party audits are internal; second-party audits are conducted by an interested party (customer, parent company) on a supplier or subsidiary.

Question 50ISMS criteria, programme and independent audit planning

Which audit principle protects information acquired during ISMS audit activities?

  1. Integrity
  2. Confidentiality (information security) Correct answer.
  3. Fair presentation
  4. Independence

Explanation

ISO 19011:2018 lists confidentiality (security of information) as an audit principle. ISMS auditors must protect information obtained during audit activities - which often includes highly sensitive vulnerability data, incident records, and architecture diagrams - and use it only for authorized purposes.