ISO-IEC-27001-LEAD-AUDITOR Practice Questions

In the context of a third-party certification audit, it is very important to have effective

communication between the audit team and the auditee. The formal communication channels, such

as the names and contact details of the audit team members, the auditee representatives, the audit

client and any other relevant parties, can be established during the opening meeting. This helps to

ensure that the audit objectives, scope, criteria, methods, schedule and any other arrangements are

clearly understood and agreed by all parties. It also facilitates the exchange of information, feedback,

requests, concerns and complaints during the audit process. Reference: = ISO 19011:2022, clause

6.4.2; PECB Candidate Handbook ISO 27001 Lead Auditor, page 25.

B . This clause requires the organisation to determine the interested parties that are relevant to the

ISMS, and the requirements of these interested parties12. This clause is relevant to the verification of

the scope of the ISMS because it helps the organisation to identify the stakeholders that have an

influence or an interest in the information security of the organisation, such as customers, suppliers,

regulators, employees, etc. The organisation should also consider the needs and expectations of

these interested parties when defining the scope of the ISMS, and ensure that they are met and

communicated.

E . This clause requires the organisation to establish an information security policy that provides the

framework for setting the information security objectives and guiding the information security

activities13. This clause is relevant to the verification of the scope of the ISMS because it helps the

organisation to define the direction and principles of the ISMS, and to align them with the strategic

goals and context of the organisation. The information security policy should also be consistent with

the scope of the ISMS, and should be communicated and understood within the organisation and by

relevant interested parties.

F . This clause requires the organisation to determine the internal and external issues that are

relevant to the purpose and the context of the organisation, and that affect its ability to achieve the

intended outcomes of the ISMS14. This clause is relevant to the verification of the scope of the ISMS

because it helps the organisation to understand the factors and conditions that influence the

information security of the organisation, such as the legal, technological, social, economic,

environmental, etc. The organisation should also monitor and review these issues, and consider

them when defining the scope of the ISMS.

H . This clause requires the organisation to determine the boundaries and applicability of the ISMS to

establish its scope15. This clause is relevant to the verification of the scope of the ISMS because it

helps the organisation to describe the information and processes that are included in the ISMS, and

to document the scope in a clear and concise manner. The organisation should also consider the

issues, requirements, and interfaces identified in clauses 4.1, 4.2, and 4.3 when determining the

scope of the ISMS, and ensure that the scope is appropriate to the nature and scale of the

organisation.

Reference:

1: PECB Candidate Handbook - ISO 27001 Lead Auditor, page 17 2: ISO/IEC 27001:2022 - Information

technology — Security techniques — Information security management systems — Requirements,

clause 4.2 3: ISO/IEC 27001:2022 - Information technology — Security techniques — Information

security management systems — Requirements, clause 5.2 4: ISO/IEC 27001:2022 - Information

technology — Security techniques — Information security management systems — Requirements,

clause 4.1 5: ISO/IEC 27001:2022 - Information technology — Security techniques — Information

security management systems — Requirements, clause 4.3

According to ISO/IEC 27001:2022, which specifies the requirements for establishing, implementing,

maintaining and continually improving an information security management system (ISMS), clause

4.2 requires an organization to determine the needs and expectations of interested parties that are

relevant to its ISMS1. This includes identifying the legal, regulatory, contractual and other

requirements that apply to its information security activities1. Therefore, collecting more evidence

on what the service requirements of healthcare monitoring are may not be relevant to verifying the

information security incident management process, as it is not directly related to the audit objective

or criteria. This option will not be in the audit trail.

Even though the marketing department was not included in the audit scope, the issue of employees'

access rights control must be communicated to Sinvestment's representatives and included in the

audit report because it is part of Sinvestment’s information security policy. It reflects on the overall

adherence to the ISMS requirements.

Reference: ISO/IEC 27001:2013, Clause 9.2 (Internal audit)

According to ISO 19011:2018, which provides guidelines for auditing management systems, an audit

programme is a set of one or more audits planned for a specific time frame and directed towards a

specific purpose1. The individual(s) managing the audit programme are responsible for establishing,

implementing and maintaining the audit programme in accordance with the organization’s policies

and objectives1. This includes defining the extent of the audit programme based on strategic

direction, risks and opportunities; establishing the audit programme by defining its objectives, scope

and criteria; determining the resources necessary for the audit programme; selecting competent

auditors and assigning them to appropriate audits; defining the objectives, scope and criteria for

each individual audit; defining the plan of each individual audit; retaining documented information

of the audit results; reviewing and improving the performance of the audit programme1. Therefore,

these six actions are part of the responsibilities of the individual(s) managing the audit

programme. The other option, communicating with the auditee during the audit, is not a

responsibility of the individual(s) managing the audit programme, but rather a responsibility of the

audit team leader1. Reference: ISO 19011:2018 - Guidelines for auditing management systems

Comprehensive and Detailed In-Depth

Northstorm adopted an international standard for Personally Identifiable Information (PII) controllers

and PII processors to ensure its data handling practices were secure and compliant with global

regulations. This aligns directly with ISO/IEC 27701, which extends ISO/IEC 27001 and ISO/IEC 27002

to cover Privacy Information Management Systems (PIMS), specifically addressing the protection of

PII.

A . ISO/IEC 27701 – Correct Answer. This standard is designed for organizations acting as PII

controllers and processors and provides guidelines on privacy management, regulatory compliance,

and data protection.

B . ISO/IEC 27009 – Incorrect because this standard provides guidance on sector-specific

requirements for ISMS, not privacy or PII protection.

C . ISO/IEC 27003 – Incorrect because it provides general implementation guidance for ISMS, not

specific controls for PII processing.

This aligns with ISO/IEC 27001:2022 Annex A Control A.5.34 (Privacy and Protection of PII), which

focuses on ensuring compliance with privacy regulations and implementing privacy-enhancing

security measures.

Confidentiality is one of the principles of audit conduct that auditors should adhere to when

performing audits. Confidentiality means that auditors should exercise discretion in the use and

protection of information acquired in the course of their duties3. Auditors should respect the

intellectual property rights of the auditee and other parties involved in the audit, and should not

disclose any information that is sensitive, proprietary, or confidential without prior approval from the

auditee or other authorized parties3. Auditors should also obtain the auditee’s permission before

using a camera or recording equipment during an audit, as these devices may capture confidential

information or infringe on the privacy of individuals3. Therefore, these two options correctly state

the function of confidentiality in an audit. The other options are either incorrect or irrelevant to

confidentiality. For example, auditors are not forced by regulatory requirements to maintain

confidentiality in an audit, but rather by ethical obligations and contractual agreements3. Observers

in an audit team can access confidential information if they have signed a confidentiality agreement

and have been authorized by the auditee3. Audit information can be used for improving personal

competence by the auditor only if it does not compromise confidentiality or conflict with other

interests3. As an auditor is always accompanied by a guide, there is still a risk to the auditee’s

sensitive information if the guide is not trustworthy or authorized to access such

information3. Reference: ISO 19011:2018 - Guidelines for auditing management systems

•

Minor Nonconformities: The identified nonconformities are minor, meaning they don't pose

a significant risk to the information security management system (ISMS). They are likely to be easily

rectified with focused corrective actions.

•

Opportunity for Improvement: This is not a nonconformity but a suggestion for enhancing

the ISMS. It doesn't require immediate corrective action but should be addressed in the

organization's continual improvement efforts.

•

Initial Certification: As this is an initial certification audit, the organization is expected to

demonstrate its commitment to addressing any gaps identified. A partial audit allows for a focused

follow-up on the specific areas of nonconformity, ensuring they have been adequately addressed.

Why other options are not suitable:

•

A . Recommend certification after your approval of the proposed corrective action plan:

While certification is the goal, it's premature to recommend it before verifying the effectiveness of

the corrective actions.

•

B . Recommend that a full scope re-audit is required within 6 months: This is too extensive

for minor nonconformities. A full re-audit is usually reserved for major nonconformities or systemic

issues.

•

D . Recommend that the findings can be closed out at a surveillance audit in 1 year: This is

too long a timeframe for addressing the nonconformities. Prompt corrective action is necessary to

demonstrate commitment to the ISMS.

In summary, recommending a partial audit within 3 months strikes the right balance between

allowing the organization time to implement corrective actions and ensuring timely verification of

their effectiveness. This approach aligns with the principles of ISO 27001 and supports the

organization's journey towards certification.

Comprehensive and Detailed In-Depth

A . Correct Answer:

Auditors conducted interviews (verbal evidence) and analyzed incident resolution records, employee

training logs, and governance policies (documentary evidence).

ISO 19011:2018 (Clause 6.4.7) states that audit evidence can be verbal, documented, observed, or

analytical.

B . Incorrect:

Confirmative evidence involves third-party validation, which was not explicitly mentioned.

C . Incorrect:

Mathematical analysis was not conducted in this audit.

Relevant Standard Reference:

ISO 19011:2018 Clause 6.4.7 (Audit Evidence Collection Methods)

A legal technical expert (LTE) is a person who provides specific knowledge or expertise related to the

legal aspects of the information security management system (ISMS) during a certification audit. The

LTE is not an auditor, but a member of the audit team who supports the auditors in collecting and

evaluating the audit evidence. The LTE is not responsible for evaluating the auditee’s legal

knowledge, criticising the organisation’s legal compliance issues, or debating complex legal points

with the auditee, as these tasks may be beyond the scope of the audit, or may compromise the

objectivity and impartiality of the audit. The LTE is responsible for advising on legal checkpoints for

the audit team, such as the applicable legal, regulatory, and contractual requirements, the relevant

sources of information, the methods of verification, and the criteria of evaluation. The LTE is also

responsible for verifying the legal status of the organisation, such as the registration, licensing,

authorisation, or accreditation of the organisation, and the compliance with the relevant laws and

regulations. Reference:

What is the role of a technical expert in ISO audit?

Roles, Responsibilities & Authorities for ISO 27001 5.3

Guide to Become an ISO 27001 Lead Auditor