ISO 27001 Internal Auditor case studies
ISO 27001 Internal Auditor · Put your knowledge to work in context.
The ISO/IEC 27001 Internal Auditor credential is aimed at professionals who audit an information security management system (ISMS) from the inside: internal auditors, ISMS coordinators, risk and compliance staff, and consultants who support first- and second-party audits against ISO/IEC 27001. The exam is delivered in multiple-choice format and tests seven areas: fundamental information security concepts and principles; the ISMS itself; fundamental audit concepts and principles; an audit approach based on ISO/IEC 27001; preparation of an audit; conducting an audit; and audit reporting and closure. The ISO 27001 Internal Auditor case studies are 5 cases and about 2,949 words.
1Scope boundary, colocation and an acquired subsidiary
Northwind Diagnostics is a 520-person manufacturer of laboratory analysers. Its ISMS scope statement reads: 'Design, manufacture, sales and support of analysers; Northwind House, Cambridge.' Production planning and the customer service platform run on an ERP hosted in a colocation cage in Amsterdam operated by CanalData.
573 words, about 3 min2A risk register full of identical medium scores
Harbourline Freight operates three warehouses and 180 vehicles. Its risk assessment method is a 5x5 matrix applied by 12 'risk champions' after a two-hour workshop.
613 words, about 3 min3The auditor who owns the firewall
Atlas Health Services runs a 90-person internal audit function for a 4,000-employee health insurer. The 12-month audit programme contains 14 audits.
543 words, about 3 min4Two days, 35,000 credentials and a request to work remotely
You are the lead auditor for a two-day internal audit of physical security, HR security and access control at a 600-bed hospital. The previous audit, 16 months ago, raised three findings: 9 of 40 leavers retained active accounts; visitor badges were not returned; and a server room door was propped open.
621 words, about 3 min5Closing a major finding with a screenshot and a reminder email
At the closing meeting of an internal audit of a payment processor, you present a major nonconformity: 14 of 30 leavers sampled still had active VPN accounts 10 days after their exit date, and 3 had logged in after leaving. The HR director says the accounts were disabled the same afternoon and sends a screenshot of the identity console showing all 14 disabled.
599 words, about 3 min