ISO-IEC-27001-Lead-Auditor PECB Certified ISO/IEC 27001 2022 Lead Auditor exam Questions and Answers

In the context of ISO/IEC 27001 audits, the audit team is appointed by the certification body, not by the organization being audited. Data Grid Inc. is responsible for specifying the audit criteria and defining the audit scope, but not for appointing the audit team.

The auditors primarily collected physical and technical evidence, making option B the correct answer. Physical and technical evidence refers to evidence obtained through direct observation of systems, configurations, and operational practices, as well as inspection of tangible or technical elements within the organization’s environment.

In the scenario, the auditors reviewed firewall configurations, examined operational planning and control activities, and inspected the inventory of information and associated assets. Firewall configurations are a clear example of technical evidence, as they involve system settings and security mechanisms that can be directly reviewed and validated. Asset inventories, while documented, are often verified through physical or system-level inspection to confirm their accuracy and completeness. Operational planning and control observations involve witnessing how processes are executed in practice, which also constitutes physical or technical evidence.

Option A is incorrect because analytical and documentary evidence would primarily involve reports, metrics, trend analysis, or formal documents without direct system inspection. While some documentation was reviewed, the scenario emphasizes inspection and observation of operational and technical controls. Option C is incorrect because mathematical evidence is not a recognized audit evidence category under ISO standards.

ISO 19011 recognizes observation and inspection as valid methods for collecting audit evidence, particularly when assessing the effectiveness of technical and operational controls. Therefore, the evidence collected in this audit is best classified as physical and technical evidence.

These four scenarios are examples of a lack of competence, which is defined as the ability to apply the knowledge and skills needed to perform a work role or a task effectively and efficiently12. Competence in ISO 27001:2022 is determined by the organisation’s needs and expectations, and it is based on the relevant education, training, or experience of the people involved in the ISMS34. The organisation is required to ensure that all the people who affect the performance of the ISMS are competent, and to provide them with the necessary training and awareness to fulfil their roles and responsibilities35. The four scenarios indicate that the people involved either lack the knowledge or skills to perform their tasks, or have not received the appropriate training or guidance to do so. The other scenarios are not related to competence, but to other factors such as negligence, error, or policy violation.

According to ISO/IEC 27001:2022, which specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), clause 9.3 requires top management to review the organization’s ISMS at planned intervals to ensure its continuing suitability, adequacy and effectiveness1. Clause 9.2 requires the organization to conduct internal audits at planned intervals to provide information on whether the ISMS conforms to its own requirements and those of ISO/IEC 27001:2022, and is effectively implemented and maintained1. Therefore, when reviewing the audit process and audit findings as a final check before the external certification body arrives, an internal ISMS auditor should verify that these clauses are met in accordance with the audit criteria.

Six of the following statements would cause concern in respect of conformity to ISO/IEC 27001:2022 requirements:

The audit programme shows management reviews taking place at irregular intervals during the year: This statement would cause concern because it implies that the organization is not conducting management reviews at planned intervals, as required by clause 9.3. This may affect the ability of top management to ensure the continuing suitability, adequacy and effectiveness of the ISMS.

The audit programme does not take into account the relative importance of information security processes: This statement would cause concern because it implies that the organization is not applying a risk-based approach to determine the audit frequency, methods, scope and criteria, as recommended by ISO 19011:2018, which provides guidelines for auditing management systems2. This may affect the ability of the organization to identify and address the most significant risks and opportunities for its ISMS.

Although the scope for each internal audit has been defined, there are no audit criteria defined for the audits carried out to date: This statement would cause concern because it implies that the organization is not establishing audit criteria for each internal audit, as required by clause 9.2. Audit criteria are the set of policies, procedures or requirements used as a reference against which audit evidence is compared2. Without audit criteria, it is not possible to determine whether the ISMS conforms to its own requirements and those of ISO/IEC 27001:2022.

Audit reports to date have used key performance indicator information to focus solely on the efficiency of ISMS processes: This statement would cause concern because it implies that the organization is not evaluating the effectiveness of ISMS processes, as required by clause 9.1. Effectiveness is the extent to which planned activities are realized and planned results achieved2. Efficiency is the relationship between the result achieved and the resources used2. Both aspects are important for measuring and evaluating ISMS performance and improvement.

The audit programme does not take into account the results of previous audits: This statement would cause concern because it implies that the organization is not using the results of previous audits as an input for planning and conducting subsequent audits, as recommended by ISO 19011:20182. This may affect the ability of the organization to identify and address any recurring or unresolved issues or nonconformities related to its ISMS.

Top management commitment to the ISMS will not be audited before the certification visit, according to the audit programme: This statement would cause concern because it implies that the organization is not verifying that top management demonstrates leadership and commitment with respect to its ISMS, as required by clause 5.1. This may affect the ability of top management to ensure that the ISMS policy and objectives are established and compatible with the strategic direction of the organization; that roles, responsibilities and authorities for relevant roles are assigned and communicated; that resources needed for the ISMS are available; that communication about information security matters is established; that continual improvement of the ISMS is promoted; that other relevant management reviews are aligned with those of information security; and that support is provided to other relevant roles1.

The other statements would not cause concern in respect of conformity to ISO/IEC 27001:2022 requirements:

Audit reports are not held in hardcopy (i.e. on paper). They are only stored as ".POF documents on the organisation’s intranet: This statement would not cause concern because it does not imply any nonconformity with ISO/IEC 27001:2022 requirements. The standard does not prescribe any specific format or media for documenting or storing audit reports, as long as they are controlled according to clause 7.5.

The audit programme mandates auditors must be independent of the areas they audit in order to satisfy the requirements of ISO/IEC 27001:2022: This statement would not cause concern because it does not imply any nonconformity with ISO/IEC 27001:2022 requirements. The standard does not prescribe any specific requirement for auditor independence, as long as the audit is conducted objectively and impartially, in accordance with ISO 19011:20182.

The audit programme does not reference audit methods or audit responsibilities: This statement would not cause concern because it does not imply any nonconformity with ISO/IEC 27001:2022 requirements. The standard does not prescribe any specific requirement for referencing audit methods or audit responsibilities in the audit programme, as long as they are defined and documented according to ISO 19011:20182.

The audit process states the results of audits will be made available to ‘relevant’ managers, not top management: This statement would not cause concern because it does not imply any nonconformity with ISO/IEC 27001:2022 requirements. The standard does not prescribe any specific requirement for communicating the results of audits to top management, as long as they are reported to the relevant parties and used as an input for management review, according to clause 9.3.

In the context of a third-party certification audit, the management responsibilities of the audit team leader in managing the audit and the audit team include adopting a risk-based approach to planning the audit and establishing contact with the auditee. A risk-based approach to planning the audit means that the team leader should consider the risks and opportunities that may affect the achievement of the audit objectives, the scope and criteria, the audit methods and techniques, the allocation of resources and the assignment of tasks to the audit team members. Establishing contact with the auditee means that the team leader should communicate with the auditee before, during and after the audit, to confirm the audit arrangements, to obtain relevant information, to address any issues or concerns, to provide feedback and to report the audit results and conclusions. References: = ISO 19011:2022, clauses 6.4.1 and 6.4.2; PECB Candidate Handbook ISO 27001 Lead Auditor, pages 24 and 25.

According to ISO/IEC 27001, organizations must control planned changes and review the consequences of unintended changes in order to ensure continued alignment with information security requirements. In this scenario, the organization failed to perform appropriate testing after an emergency update to the mobile app, which constitutes a nonconformity with clause 8.1 of the standard.

**References**:

- ISO/IEC 27001 Lead Auditor Reference Materials

- PECB Candidate Handbook for ISO 27001 Lead Auditor

ISO/IEC 27001 requires that organizations adhere to their established procedures for software security management. The IT Manager's approval of the app despite failed security tests and lack of proper documentation for the new version indicates noncompliance with the procedure, thus reflecting a nonconformity.

**References**:

- ISO/IEC 27001 Lead Auditor Reference Materials

- PECB Candidate Handbook for ISO 27001 Lead Auditor

This scenario represents a conformity because ABC Inc. has implemented procedures for managing removable storage media that align with the classification scheme of the information stored. When information is classified as "confidential," more stringent procedures apply, whereas for "public" information, the procedures focus only on integrity and availability, following the organization's defined information classification policy.

The auditor should verify that the selected controls are included in the Statement of Applicability (SoA), making option C the correct answer. ISO/IEC 27001:2022 requires organizations to document which Annex A controls are applicable based on the results of the risk assessment and risk treatment process. The SoA is the formal document that records these decisions, including justification for inclusion or exclusion of controls.

The existence of a risk assessment alone is not sufficient. Auditors must confirm traceability between identified risks, selected controls, and their formal documentation in the SoA. This ensures transparency, consistency, and accountability in how the organization manages information security risks.

Option A is incorrect because ISO/IEC 27001 does not require organizations to use external consultants for risk assessments. Risk assessments may be conducted internally, provided they follow a defined and systematic methodology. Option B is incorrect because controls can be preventive, detective, or corrective; there is no requirement that selected controls be corrective only.

Therefore, verifying that selected controls are properly reflected in the Statement of Applicability is a mandatory audit activity and a core requirement of ISO/IEC 27001 compliance.

Comprehensive and Detailed In-Depth Explanation:

A preventive control is a security measure implemented to prevent security incidents or risks from occurring. It proactively protects information systems and mitigates potential threats.

A. Using an application that prioritized orders based on its prior knowledge – This is an operational enhancement but not a security control. It improves efficiency but does not directly prevent security breaches or risks.

B. Signing a confidentiality agreement – This is a preventive control because it ensures that sensitive business information remains protected from unauthorized disclosure before transitioning to an outsourced service provider. It mitigates the risk of intellectual property theft or data misuse by legally binding the parties to confidentiality.

C. Expanding the capacity of the in-house data center – This is a corrective or operational control, as it addresses the issue of insufficient infrastructure but does not prevent security-related threats.

This aligns with ISO/IEC 27001:2022 Annex A Control A.5.6 (Contact with Special Interest Groups), which includes legal agreements and confidentiality measures to protect sensitive information.

The best action to take in this scenario is to determine whether any additional effective arrangements are in place to verify individual access to secure areas, such as CCTV. This action is consistent with the audit principle of evidence-based approach, which requires the auditor to obtain sufficient and appropriate audit evidence to support the audit findings and conclusions1. By verifying the existence and effectiveness of other security controls, the auditor can assess the extent and impact of the nonconformity observed, and determine the appropriate audit finding and recommendation.

The other options are not the best actions to take in this scenario, because they are either premature or inappropriate. For example:

•Option A is inappropriate, because it is not the auditor’s role to suggest specific solutions or improvements to the auditee, but rather to report the audit findings and recommendations based on the audit criteria and objectives2. A large sign in reception may not be an effective or feasible solution to address the issue of tailgating, and it may not reflect the root cause of the problem.

•Option C is premature, because it assumes that the control A.7.1 ‘security perimeters’ is not adequately implemented, without verifying the existence and effectiveness of other security controls that may compensate for the observed nonconformity. The auditor should not jump to conclusions based on a single observation, but rather gather sufficient and appropriate audit evidence to support the audit finding3.

•Option D is premature, because it assumes that the control A.7.6 ‘working in secure areas’ is not adequately implemented, without verifying the existence and effectiveness of other security controls that may compensate for the observed nonconformity. The auditor should not jump to conclusions based on a single observation, but rather gather sufficient and appropriate audit evidence to support the audit finding3.

•Option E is inappropriate, because it is not related to the observed nonconformity, which is about the access control to secure areas, not the information security requirements agreed upon with the supplier. The auditor should not raise a nonconformity based on irrelevant or incorrect audit criteria4.

•Option F is inappropriate, because it is not the auditor’s role to suggest specific solutions or improvements to the auditee, but rather to report the audit findings and recommendations based on the audit criteria and objectives2. Requiring contractors to be accompanied at all times when accessing secure facilities may not be an effective or feasible solution to address the issue of tailgating, and it may not reflect the root cause of the problem.

Comprehensive and Detailed In-Depth Explanation:

C. Correct Answer:

Materiality helps auditors identify significant areas for audit focus and is used to set audit objectives appropriately.

Materiality determines which processes, risks, or controls are critical for achieving effective ISMS implementation.

A. Incorrect:

Materiality affects audit scope but does not directly determine duration.

B. Incorrect:

Team roles are assigned based on expertise, not materiality considerations.

Relevant Standard Reference:

ISO 19011:2018 Clause 6.2.3 (Determining Feasibility of Audit)

These two options are not required for audit planning of a certification audit, as they are not relevant to the audit objectives, scope, criteria, and methods. The working experience of the management system representative is not a requirement of ISO/IEC 27001, nor does it affect the conformity or effectiveness of the ISMS. The organisation’s financial statement is not part of the ISMS documentation, nor does it provide evidence of the ISMS performance or improvement. The other options are required for audit planning, as they help to determine the audit activities, resources, schedule, and sampling strategy. References: PECB Candidate Handbook1, page 19-20; ISO 9001 Auditing Practices Group Guidance on2, page 1-2; ISO/IEC 27001:2022 (en)3, clause 9.2.

No, the audit scope should reflect all of the organization's divisions that are covered by the ISMS. If the ISMS scope stated that it includes the whole company, the audit scope should align with this unless specifically justified and agreed upon by all stakeholders.

According to the PECB Candidate Handbook1, one of the principles of auditing is confidentiality, which means that auditors should respect the confidentiality of information obtained during the audit and not disclose it to unauthorized parties. The handbook also states that auditors should only report audit results to those who have a legitimate need to know, such as the client, the auditee, and the certification body. Therefore, sharing the findings with other relevant managers in A or B’s other customers would be a breach of confidentiality, as they are not directly involved in the audit process or the information security management system of B. Sharing the findings with B’s Information Security Manager or other relevant managers in B would be appropriate, as they are part of the auditee organization and responsible for the implementation and improvement of the ISMS. Sharing the findings with A’s supplier evaluation team or B’s certification body would also be acceptable, as they have a legitimate need to know the audit results for the purpose of supplier selection or certification, respectively. References: 1: PECB Candidate Handbook - ISO 27001 Lead Auditor, pages 7-8.

This scenario presents a risk that primarily impacts availability, which is one of the three core information security principles alongside confidentiality and integrity. Relying on a single server to manage all incoming traffic introduces a single point of failure, meaning that if the server fails, services become unavailable.

From an ISO/IEC 27001 perspective, this is clearly a risk, not merely a misconfiguration or a system error. A risk exists because there is a reasonable likelihood that the server could fail and a significant impact if it does, namely service disruption. ISO/IEC 27001 clause 6.1.2 requires organizations to identify such risks that could affect the availability of information and services.

Option B is incorrect because while misconfiguration can cause outages, the scenario does not describe an incorrect configuration; it describes an architectural dependency. Option C is incorrect because authentication is not the primary concern; the issue affects the ability to deliver services at all, regardless of user authentication.

Availability is explicitly addressed in ISO/IEC 27002:2022 through controls such as redundancy and capacity management. The absence of redundancy increases availability risk. Therefore, the scenario correctly represents a risk impacting availability, making option A the best answer.

Third-party accredited certification of information security management systems to ISO/IEC 27001:2022 provides assurance to organisations and interested parties that the organisation’s management system is maintained and effective, meaning that it conforms to the requirements of the standard, meets the organisation’s objectives and policies, and addresses the risks and opportunities related to information security. Third-party accredited certification also demonstrates that the organisation’s management system adopted a systematic approach to information security, meaning that it follows the Plan-Do-Check-Act (PDCA) cycle, applies the risk-based thinking principle, and considers the context and needs of the organisation and its stakeholders

A checklist is a tool that helps auditors to collect and verify information relevant to the audit objectives and scope. It can provide the following advantages:

Ensuring relevant audit trails are followed: A checklist can help auditors to identify and trace the sources of evidence that support the conformity or nonconformity of the audited criteria. It can also help auditors to avoid missing or overlooking any important aspects of the audit.

Ensuring the audit plan is implemented: A checklist can help auditors to follow and fulfil the audit plan, which describes the arrangements and details of the audit, such as the objectives, scope, criteria, schedule, roles, and responsibilities. It can also help auditors to manage their time and resources effectively and efficiently.

The other options are not advantages of using a checklist, but rather:

Using the same checklist for every audit without review: This is a disadvantage of using a checklist, as it can lead to a rigid and ineffective audit approach. A checklist should be tailored and adapted to each specific audit, taking into account the context, risks, and changes of the auditee and the audit criteria. A checklist should also be reviewed and updated periodically to ensure its validity and relevance.

Restricting interviews to nominated parties: This is a disadvantage of using a checklist, as it can limit the scope and depth of the audit. A checklist should not prevent auditors from interviewing other relevant parties or sources of information that may provide valuable evidence or insights for the audit. A checklist should be used as a guide, not as a constraint.

Reducing audit duration: This is not necessarily an advantage of using a checklist, as it depends on various factors, such as the complexity, size, and maturity of the auditee’s ISMS, the availability and quality of evidence, the competence and experience of the auditors, and the level of cooperation and communication between the auditors and the auditee. A checklist may help reduce audit duration by improving efficiency and organization, but it may also increase audit duration by requiring more evidence or verification.

Not varying from the checklist when necessary: This is a disadvantage of using a checklist, as it can result in a superficial or incomplete audit. A checklist should not prevent auditors from exploring or investigating any issues or concerns that arise during the audit, even if they are not included in the checklist. A checklist should be used as a support, not as a substitute.

In the context of a third-party certification audit, it is very important to have effective communication between the audit team and the auditee. The formal communication channels, such as the names and contact details of the audit team members, the auditee representatives, the audit client and any other relevant parties, can be established during the opening meeting. This helps to ensure that the audit objectives, scope, criteria, methods, schedule and any other arrangements are clearly understood and agreed by all parties. It also facilitates the exchange of information, feedback, requests, concerns and complaints during the audit process. References: = ISO 19011:2022, clause 6.4.2; PECB Candidate Handbook ISO 27001 Lead Auditor, page 25.

While competence is important for an effective ISMS, the specific competence records of the ISMS manager are less relevant when determining resources for the internal audit program. The focus should be on resources directly related to the audit process itself. Here's why the other options matter:

•A. Availability of competent auditors and technical experts: Crucial for conducting thorough audits and accurately assessing the ISMS.

•C. Availability of the necessary documented information: Essential for auditors to review policies, procedures, and records related to the ISMS.

•D. Impact of different time zones: Can affect scheduling, coordination, and communication during the audit, potentially requiring additional resources.

Sinvestment should correct the identified issue related to the lack of documentation on information security training and awareness before the stage 2 audit. Addressing this gap promptly ensures that the ISMS is fully compliant and effective when assessed in the subsequent audit stage.

Information is an asset like other important business assets, as it has value to an organization and consequently needs to be protected. Information can be in any form, such as electronic, paper, or verbal. Information security is the protection of information from unauthorized access, use, disclosure, modification, or destruction2. References: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) | CQI | IRCA

The Statement of Applicability (SoA) is a core document within an ISMS that outlines the security controls an organization implements. When a new control, such as the SSH protocol, is implemented, it should be included in the SoA to reflect the current state of the ISMS. The SoA should be updated to justify the inclusion of the new control and to document how it is implemented within the organization12. References: = This guidance is based on the best practices for maintaining the SoA as per ISO/IEC 27001, which requires the SoA to be a living document that accurately reflects the security controls in use by the organization

From Exact Extract:

Explanation for B (True):

This statement is true because ISO 27001 requires an organization to establish processes for identifying, reviewing, and complying with applicable legal, statutory, regulatory, and contractual obligations. A key part of this is being aware of changes to these requirements to maintain ongoing compliance. An auditor's role is to verify that the organization has such a process in place and that it is effective.

1. An auditor using a copy of ISO/IEC 27001:2022 to check that its requirements are met:

Termed: Reviewing audit criteria.

Justification: The auditor is comparing the auditee's information security management system (ISMS) against the established criteria outlined in the ISO/IEC 27001:2022 standard. This activity falls under the use of audit criteria to determine conformity or nonconformity.

2. An auditor's note that the auditee is not adhering to its clear desk policy:

Termed: Identifying an audit finding.

Justification: The auditor has observed a deviation from the auditee's established policy on clear desks. This observation is documented as a potential nonconformity, which requires further investigation and evaluation.

3. An auditor making a decision regarding the auditee's conformity or otherwise to criteria:

Termed: Determining an audit conclusion.

Justification: Based on the collected audit evidence and evaluation against the established criteria, the auditor forms an opinion about the overall compliance of the auditee's ISMS. This opinion is the audit conclusion and is a key element of the audit report.

4. An auditor examining verifiable records relevant to the audit process:

Termed: Collecting audit evidence.

Justification: The auditor is gathering objective and verifiable information to support their findings and conclusions. This information comes from various sources, including documents, records, interviews, and observations.

Comprehensive and Detailed In-Depth Explanation:

The CIA Triad (Confidentiality, Integrity, and Availability) is the foundation of information security principles.

Availability ensures that data and services are accessible when needed. By implementing regular, automated backups and offsite storage, the organization ensures that critical data remains accessible even after a security incident (e.g., data loss, cyberattacks, or hardware failures). This aligns with ISO/IEC 27001:2022 Annex A Control A.8.13 (Information Backup), which emphasizes maintaining and testing backups to ensure system resilience.

Integrity ensures that data remains unaltered and accurate, but backups do not inherently enforce integrity unless accompanied by checksum or validation mechanisms.

Confidentiality ensures that only authorized users can access data, which is not the primary goal of a backup procedure.

Sinvestment should correct the documentation deficiencies before proceeding to the stage 2 audit, making option A the correct answer. The purpose of the stage 1 audit is to assess the organization’s readiness for certification, including the adequacy and completeness of required documented information. Identified gaps during stage 1 are intended to be resolved prior to stage 2 to avoid major nonconformities.

ISO/IEC 27001 requires organizations to maintain documented information for information security awareness, education, and training. While Sinvestment’s management stated that training was delivered, the absence of complete documentation represents a failure to demonstrate conformity. Audits rely on objective evidence, not verbal assurances.

Option B is incorrect because deferring corrective action until after certification contradicts the intent of the two-stage audit process. Stage 2 should only proceed once readiness gaps are addressed. Option C is incorrect because the issue is not a risk identification problem but a documentation and evidence problem. The existence of training is not in question; the lack of proper documentation is.

Therefore, Sinvestment should update the documentation promptly and provide it to the audit team before stage 2.

Materiality should be considered during the initial contact to obtain reasonable assurance that the audit can be successfully completed. Determining materiality helps establish the threshold for the significance of audit findings, ensuring that the audit focuses on substantial issues that could impact the audit conclusions.

According to ISO/IEC 27001:2022, which specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), clause 4.2 requires an organization to determine the needs and expectations of interested parties that are relevant to its ISMS1. This includes identifying the legal, regulatory, contractual and other requirements that apply to its information security activities1. Therefore, collecting more evidence on what the service requirements of healthcare monitoring are may not be relevant to verifying the information security incident management process, as it is not directly related to the audit objective or criteria. This option will not be in the audit trail.

Comprehensive and Detailed In-Depth Explanation:

A. Correct Answer:

ISO/IEC 27001:2022 Annex A Control A.5.19 (Information Security in Supplier Relationships) requires organizations to monitor and control their suppliers to ensure compliance with security requirements.

Branding must monitor, assess, and ensure Techvology maintains compliance with ISO/IEC 27001 and outsourcing agreements.

B. Incorrect:

Even if not explicitly stated in the contract, ISO/IEC 27001 requires continual supplier monitoring.

C. Incorrect:

Branding is responsible for both controlling and monitoring outsourced services, not just monitoring them.

Relevant Standard Reference:

ISO/IEC 27001:2022 Annex A Control A.5.19 (Supplier Security Compliance)

ISO/IEC 27001:2022 Clause 8.2 (Outsourced Service Controls)

The purpose of a follow-up audit is to verify the completion and effectiveness of corrective actions taken by the auditee in response to the nonconformities identified in a previous audit1. A follow-up audit is a type of audit that is conducted after an initial audit, and it focuses on the specific areas where nonconformities were found and corrective actions were agreed upon2. A follow-up audit can be conducted as a separate audit or as part of a scheduled audit, depending on the nature and severity of the nonconformities and the audit programme objectives3.

The other options are not the purpose of a follow-up audit, but rather the purpose of other types of audits. For example:

•Option A is the purpose of a performance audit, which is a type of audit that evaluates the effectiveness of the management system in achieving its intended results4.

•Option B is the purpose of a compliance audit, which is a type of audit that verifies the conformity of the management system with the specified requirements, such as the ISMS objectives5.

•Option C is the purpose of a process audit, which is a type of audit that examines the inputs, activities, outputs, and interactions of a specific process within the management system, such as the risk treatment process.

Comprehensive and Detailed In-Depth Explanation:

B. Correct Answer:

The organization is focusing on direct costs associated with running specific processes.

"Personnel, third-party services, and general fees" refer to operational costs of specific processes, not overall business operations.

A. Incorrect:

Cost of operations refers to the total business expenses, not individual processes.

C. Incorrect:

Potential cost of errors relates to risk assessment and impact analysis, not direct expenses.

Relevant Standard Reference:

ISO 19011:2018 Clause 6.3.2 (Audit Planning and Materiality Considerations)

Comprehensive and Detailed In-Depth Explanation:

B. Correct Answer:

Audit test plans define the structured approach for conducting interviews, observations, and control testing.

ISO 19011:2018 describes audit test planning as essential for consistent evidence collection.

A. Incorrect:

Test plans do not generate reports—they outline procedures for evidence collection.

C. Incorrect:

Audit test plans focus on specific risks rather than evaluating all elements.

Relevant Standard Reference:

ISO 19011:2018 Clause 6.4.5 (Audit Test Planning Procedures)

The following statements are true:

The role of a certification body auditor involves evaluating the organization’s processes for ensuring compliance with their legal requirements. This is part of the auditor’s responsibility to assess the effectiveness and conformity of the organization’s ISMS against the ISO/IEC 27001:2022 standard and the applicable legal and regulatory requirements.

During a third-party audit, the auditor evaluates how the organization ensures that they are made aware of changes to the legal requirements. This is part of the auditor’s responsibility to verify that the organization has established and maintained a process for identifying and updating their legal and other requirements related to information security. The following statement is false:

As part of a certification body audit, the auditor is responsible for verifying the organization’s legal compliance status. This is not true, as the auditor is not authorized or qualified to provide legal advice or judgment on the organization’s compliance status. The auditor can only report on the evidence of compliance or noncompliance observed during the audit, but the ultimate responsibility for ensuring legal compliance lies with the organization. References: : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 66. : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 67. : ISO/IEC 27001 LEAD AUDITOR - PECB, page 22.

The management review is a key component of the "Check" stage in the Plan-Do-Check-Act (PDCA) cycle. Its primary purpose is to evaluate the overall ISMS and make strategic decisions for improvement. Here's why the other options are less accurate:

•A. Random intervals: Reviews should be conducted at planned intervals for consistency and tracking progress.

•B. Compliance: While compliance is a consideration, the main focus is on the system's suitability for the organization's needs, its adequacy in managing risks, and its overall effectiveness in achieving information security objectives.

•D. Update: The management review might lead to updates, but its primary goal is evaluation, not immediate modification.

The benefits of implementing an ISMS primarily result from a reduction in information security risks. E. The purpose of an ISMS is to apply a risk management process for preserving information security. : According to the ISO 27001 standard, the benefits of implementing an ISMS include the following1:

Assuring customers and other stakeholders of the confidentiality, integrity and availability of information

Enhancing the ability to respond to information security incidents and minimize their impacts

Improving the governance and management of information security

Reducing the costs and losses associated with information security breaches

Increasing the competitiveness and reputation of the organization

Complying with legal, regulatory and contractual obligations The purpose of an ISMS is to provide a systematic approach to managing information security risks, based on the Plan-Do-Check-Act (PDCA) cycle1. The ISMS enables the organization to establish, implement, maintain and continually improve its information security performance, in alignment with its business objectives and the needs and expectations of interested parties1. The ISMS consists of the following elements1:

The information security policy and objectives

The scope and boundaries of the ISMS

The processes and procedures for information security risk assessment and treatment

The resources and competencies for information security

The roles and responsibilities for information security

The performance evaluation and improvement of the ISMS

The internal and external communication and awareness of the ISMS References:

ISO/IEC 27001:2013, Information technology — Security techniques — Information security management systems — Requirements, clauses 1, 4, 5, 6, 7, 8, 9 and 10

PECB Candidate Handbook ISO 27001 Lead Auditor, pages 9-11

ISO/IEC 27001:2013 Information Security Management Standards

4 Key Benefits of ISO 27001 Implementation | ISMS.online

ISO/IEC 27001:2022

An Introduction to the ISO 27001 ISMS | Secureframe

Yes, it is acceptable for the work documents of the audit team leader to be reviewed by another auditor after reaching audit conclusions. This is part of the quality control and assurance processes within the audit to ensure the accuracy and reliability of the audit conclusions.

According to the PECB Candidate Handbook for ISO/IEC 27001 Lead Auditor, the auditee should take the following actions in response to a nonconformity against clause 6.1.3.e of ISO/IEC 27001:20221:

Implement the appropriate risk treatment for each of the applicable controls, as this is the main requirement of clause 6.1.3.e and the objective of the risk treatment process2.

Revise the relevant content in the Statement of Applicability to justify their exclusion, as this is the expected output of the risk treatment process and the evidence of the risk-based decisions3.

Revisit the risk assessment process relating to the three controls, as this is the input for the risk treatment process and the source of identifying the risks and the controls4.

The other options are not correct because:

Allocating responsibility for producing evidence to prove to auditors that the controls are implemented is not a valid action, as the audit team already found that there was no evidence of the implementation of the three controls.

Compiling plans for the periodic assessment of the risks associated with the controls is not a valid action, as this is part of the risk monitoring and review process, not the risk treatment process5.

Incorporating written procedures for the controls into the organisation’s Security Manual is not a valid action, as this is part of the documentation and operation of the ISMS, not the risk treatment process.

Removing the three controls from the Statement of Applicability is not a valid action, as this is not a sufficient justification for their exclusion and does not reflect the risk treatment process.

Undertaking a survey of customers to find out if the controls are needed by them is not a valid action, as this is not a relevant criterion for the risk assessment and treatment process, which should be based on the organisation’s own context and objectives.

 1: PECB Candidate Handbook for ISO/IEC 27001 Lead Auditor, page 36, section 4.5.22: ISO/IEC 27001:2022, clause 6.1.3.e3: ISO/IEC 27001:2022, clause 6.1.3.f4: ISO/IEC 27001:2022, clause 6.1.25: ISO/IEC 27001:2022, clause 6.2. : ISO/IEC 27001:2022, clause 7.5 and 8. : ISO/IEC 27001:2022, clause 6.1.3.d. : ISO/IEC 27001:2022, clause 4.1 and 4.2.

Audit evidence should be evaluated against the audit criteria in order to determine audit findings.

Audit evidence is the information obtained by the auditors during the audit process that is used as a basis for forming an audit opinion or conclusion12. Audit evidence could include records, documents, statements, observations, interviews, or test results12.

Audit criteria are the set of policies, procedures, standards, regulations, or requirements that are used as a reference against which audit evidence is compared12. Audit criteria could be derived from internal or external sources, such as ISO standards, industry best practices, or legal obligations12.

Audit findings are the results of a process that evaluates audit evidence and compares it against audit criteria13. Audit findings can show that audit criteria are being met (conformity) or that they are not being met (nonconformity). They can also identify best practices or improvement opportunities13.

References :=

ISO 19011:2022 Guidelines for auditing management systems

ISO/IEC 27001:2022 Information technology — Security techniques — Information security management systems — Requirements

Components of Audit Findings - The Institute of Internal Auditors

The audit procedure used here is "analysis." The audit team analyzed server logs to verify if they can be edited or deleted, focusing on evaluating the logs' properties and the controls over their manipulation to ensure they comply with ISO/IEC 27001 requirements.

According to the PECB Candidate Handbook for ISO/IEC 27001 Lead Auditor, a correction is an action to eliminate a detected nonconformity, such as rework, repair, or replacement1. The examples of A, B, C, and E are corrections because they fix the errors or defects that caused the nonconformities, such as a missing signature, a missing guide, a wrong date, or a wrong colour code. The other examples (D, F, G, and H) are not corrections, but corrective actions, because they address the root causes of the nonconformities, such as inadequate training, poor planning, ineffective documentation, or unclear responsibility2. References: 1: PECB Candidate Handbook for ISO/IEC 27001 Lead Auditor, page 35, section 4.5.12: PECB Candidate Handbook for ISO/IEC 27001 Lead Auditor, page 36, section 4.5.2.

Comprehensive and Detailed In-Depth Explanation:

A vulnerability in information security refers to a weakness in a system, process, or software that can be exploited, leading to security incidents. In this case, the most significant vulnerability in Northstorm’s system was the installation of an illegitimate (compromised) version of the application, which directly impacted the main server and resulted in system downtime.

A. The new version of the application directly affecting the main server is an outcome rather than the vulnerability itself. The reason it affected the server was due to its compromised nature.

B. The need for a replacement version of the application is not a vulnerability but rather a necessity due to the incompatibility issue introduced by the OS upgrade.

C. The new version of the application being illegitimate is the true vulnerability because it represents an unauthorized or unverified change that introduced malicious code or other security risks. This could have been mitigated by proper validation, secure software development practices, and adherence to change management policies outlined in ISO/IEC 27001:2022 Annex A controls:

A.8.8 Management of Technical Vulnerabilities – Ensures that systems and applications are updated and maintained securely.

A.8.9 Configuration Management – Covers proper software deployment and validation procedures.

A.8.14 Redundancy of Information Processing Facilities – Ensures resilience to failures like server downtimes.

This incident underscores the importance of implementing rigorous change management processes and software validation measures to prevent the installation of unauthorized software, a key requirement under ISO/IEC 27001:2022 Clause 8 (Operational Planning and Control).

The responsibilities described fit those of a "guide." A guide in an audit context is typically someone from the auditee's organization who facilitates audit activities, manages logistics, ensures compliance with health and safety policies, and may also witness the audit process, assisting the audit team.

The technical expert can communicate their audit findings to the auditee only through one of the audit team members. This ensures that communications remain coordinated and that the audit team maintains control over the audit process.

Comprehensive and Detailed In-Depth Explanation:

B. Correct Answer:

Audit plans must remain flexible to adapt to unforeseen findings and risks.

ISO 19011:2018 specifies that audit planning should allow dynamic adjustments.

A. Incorrect:

Audit procedures are part of execution, not planning.

C. Incorrect:

The audit team, not top management, prepares the audit plan.

Relevant Standard Reference:

ISO 19011:2018 Clause 5.4 (Audit Planning Flexibility)

A management system audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled. The audit criteria are a set of requirements that may include policies, procedures, standards, regulations, etc. The purpose of a management system audit is to evaluate the performance of an organisation’s management system in terms of its effectiveness, efficiency, compliance, and improvement. A management system audit can also identify strengths, weaknesses, opportunities, and risks of the management system and provide recommendations for improvement.

This situation represents an audit finding, making option A the correct answer. An audit finding is the result of evaluating audit evidence against audit criteria and identifying conformity, nonconformity, or opportunities for improvement. In this case, the auditor evaluated training records and discovered that two employees did not receive adequate information security training, which is a deviation from ISO/IEC 27001 training and awareness requirements.

Audit evidence consists of the records, interviews, or observations used to support findings. The training records themselves are evidence, not the finding. Information sources are where evidence originates, such as documents, personnel, or systems, but they are not the conclusion drawn by the auditor.

Option B is incorrect because the lack of training is not evidence; it is the conclusion derived from evaluating evidence. Option C is incorrect because employees or records may be information sources, but the situation described is the auditor’s evaluative conclusion.

ISO 19011 emphasizes that audit findings must be based on objective evidence and clearly documented. Therefore, identifying that some employees lacked adequate training constitutes an audit finding.

Comprehensive and Detailed In-Depth Explanation:

C. Correct Answer: Changes to the audit scope must be approved by the auditee, the auditor, and the certification body. This ensures fairness and maintains compliance with ISO 19011 guidelines on audit planning.

A. Incorrect: The audit schedule cannot be changed solely at Cobt’s request—approval is required.

B. Incorrect: Audit scope is not limited to technological changes but includes organizational and procedural changes as well.

Relevant Standard Reference:

ISO 19011:2018 Clause 5.5.2 (Determining the Audit Scope and Schedule)

According to ISO 19011:2018, which provides guidelines for auditing management systems, an audit programme is a set of one or more audits planned for a specific time frame and directed towards a specific purpose1. The individual(s) managing the audit programme are responsible for establishing, implementing and maintaining the audit programme in accordance with the organization’s policies and objectives1. This includes defining the extent of the audit programme based on strategic direction, risks and opportunities; establishing the audit programme by defining its objectives, scope and criteria; determining the resources necessary for the audit programme; selecting competent auditors and assigning them to appropriate audits; defining the objectives, scope and criteria for each individual audit; defining the plan of each individual audit; retaining documented information of the audit results; reviewing and improving the performance of the audit programme1. Therefore, these six actions are part of the responsibilities of the individual(s) managing the audit programme. The other option, communicating with the auditee during the audit, is not a responsibility of the individual(s) managing the audit programme, but rather a responsibility of the audit team leader1. References: ISO 19011:2018 - Guidelines for auditing management systems

The audit team leader suggesting a specific solution on resolving the nonconformities is unacceptable in an external audit. This could compromise the impartiality of the audit process by appearing to assist the auditee in corrective actions, which should independently originate from the auditee to ensure the integrity and effectiveness of the ISMS.

According to ISO 27001:2022 clause 4.3, the organisation shall determine the scope of the information security management system (ISMS) by considering the internal and external issues, the requirements of interested parties, and the interfaces and dependencies with other organisations12

In this case, the ISMS scope covers an outsourced data center that hosts the artificial intelligence (AI) cloud server for healthcare monitoring and analysis of the residents’ data. Therefore, the audit evidence you need to find to verify the scope of the ISMS should include:

The auditee has identified the governmental authorities’ needs and expectations on healthcare services and patient data handling. This is an external issue and an interested party requirement that affects the ISMS scope, as the auditee has to comply with the relevant laws and regulations regarding the quality, safety, and privacy of healthcare services and patient data12

The auditee has identified the resident’s needs and expectations on how they should protect the resident’s personal data. This is an external issue and an interested party requirement that affects the ISMS scope, as the auditee has to ensure the confidentiality, integrity, and availability of the resident’s personal data that is collected, processed, and stored by the electronic wristband and the AI cloud server12

The IT service agreement with the data center where the artificial intelligence (AI) cloud server is located. This is an interface and dependency with another organisation that affects the ISMS scope, as the auditee has to control the externally provided processes, products, and services that are relevant to the ISMS, and to implement appropriate contractual requirements related to information security12

The following options are not relevant or sufficient for verifying the scope of the ISMS:

The auditee has identified the resident’s needs and expectations on the facility and environmental safety. This is an external issue and an interested party requirement, but it does not affect the ISMS scope, as it is not related to information security12

The auditee has ISO 9001 certification. This is an indication of the auditee’s quality management system, but it does not verify the scope of the ISMS, as it is not related to information security12

The auditee has identified the resident’s needs and expectations on the comfort facility, medical professional’s competence, and clean environment. These are external issues and interested party requirements, but they do not affect the ISMS scope, as they are not related to information security12

The auditee has identified the resident’s needs and expectations on healthcare medical treatment services. These are external issues and interested party requirements, but they do not verify the scope of the ISMS, as they are not specific to information security12

The auditee is considering the purchase of a healthcare monitoring app from an external software company. This is a potential change that may affect the ISMS scope in the future, but it does not verify the current scope of the ISMS, as it is not yet implemented or controlled12

The auditee is required to submit action plans that include detailed information on how every corrective action will be implemented. General statements are not sufficient; the action plans must specify the corrective actions in detail to ensure that the root causes of the nonconformities are addressed effectively.

Comprehensive and Detailed In-Depth Explanation:

C. Correct Answer:

The audit team documented findings, but the scenario does not confirm whether sufficient supporting evidence was included.

ISO 19011:2018 requires audit findings to be properly documented and justified with evidence.

Failing to document evidence reduces audit credibility.

A. Incorrect:

Preparing for the audit by reviewing policies and procedures is correct practice.

B. Incorrect:

Evaluating management responsibility for ISMS compliance is a required step in Stage 1.

Relevant Standard Reference:

ISO/IEC 27001:2022 Clause 9.2 (Internal Audit)

ISO 19011:2018 Clause 6.5.3 (Audit Documentation Requirements)

CyberShielding Systems Inc. should have included the identification of areas for improvement when defining the audit objectives, making option A the correct answer. ISO/IEC 27001 audits are not limited to verifying compliance; they also support continual improvement of the ISMS. ISO 19011 encourages audits to provide value by identifying weaknesses, improvement opportunities, and areas where effectiveness can be enhanced.

In the scenario, the audit objectives were primarily focused on conformity with criteria and compliance with statutory and regulatory requirements. While this is essential, a well-defined audit objective should also include evaluating opportunities to improve security practices, control effectiveness, and risk management maturity. Identifying improvement areas helps the organization strengthen its ISMS beyond basic compliance and aligns with ISO/IEC 27001 clause 10 on continual improvement.

Option B is incorrect because audit objectives should not be narrowly focused only on recent incidents or management concerns, as this could lead to biased or incomplete coverage. Option C is incorrect because limiting the audit to documentation review undermines the effectiveness of the audit and contradicts the requirement for evidence-based evaluation of operational controls.

Therefore, including improvement identification as an audit objective would have strengthened the audit’s value and alignment with ISO/IEC 27001 principles.

Comprehensive and Detailed In-Depth Explanation:

Detection Risk (Correct Answer) – Detection risk occurs when control mechanisms fail to identify significant defects or errors. Cobt identified that major defects were not detected or prevented by internal controls, making detection risk the correct answer.

Inherent Risk refers to the likelihood of a security event occurring without considering any controls. The scenario mentions control failures, not natural risks, so this is incorrect.

Control Risk is the risk of controls failing to prevent a risk. However, the scenario specifically mentions that the defects were not detected, making detection risk the more precise answer.

Relevant Standard Reference:

ISO/IEC 27001:2022 Clause 6.1.2 (Information Security Risk Assessment Process)

The use of new technologies such as big data presents new challenges in auditing, particularly the issue of combining structured and unstructured data. Big data environments often include diverse data sets that auditors need to understand and interpret, which requires new skills and approaches to ensure effective and comprehensive audit coverage.

According to ISO 19011:2018, which provides guidelines for auditing management systems, an opening meeting is a formal communication between the audit team and the auditee at the start of an audit1. The purpose of the opening meeting is to confirm the audit objectives, scope and criteria, introduce the audit team and their roles, confirm the audit plan and logistics, explain the audit methods and procedures, and establish the communication channels1. Therefore, if the Managing Director of the client organization invites the audit team to view a new company video lasting 45 minutes during the opening meeting of a Stage 2 audit, the audit team leader should respond in a way that does not compromise the effectiveness and efficiency of the audit or create any misunderstanding or conflict with the auditee. Two possible ways to respond are to advise the Managing Director that the audit team has to keep to the planned schedule, as there may be limited time and resources available for the audit; or to suggest that the video could be viewed during a refreshment break, if it is relevant and useful for the audit and does not interfere with other audit activities1. The other options are not appropriate responses for the audit team leader to make in this situation. For example, stating that the audit team leader will stay behind after the opening meeting to view the video on behalf of the team may imply that the video is not important or relevant for the rest of the audit team; inviting the Managing Director to the auditors’ hotel for a viewing that evening may create an impression of bias or favouritism; stating that the audit team will make a decision on the viewing at a later time may be vague or indecisive; and advising the Managing Director that the audit team agrees to his request may result in wasting valuable audit time or losing focus on the audit objectives1. References: ISO 19011:2018 - Guidelines for auditing management systems

Auditors have the authority to object or even refuse an audit mandate if they believe that the audit duration proposed by the auditee is not sufficient to thoroughly assess the ISMS. It is crucial for the audit to be comprehensive enough to cover all necessary aspects of the system, ensuring its effectiveness and compliance.

According to ISO 19011:2018, which provides guidelines for auditing management systems, an auditor conducting a certification audit should prepare for an audit by reviewing relevant information about the auditee’s context and processes1. This may include reviewing documented information related to the audited management system (such as policies, procedures, manuals), previous audit reports and records (such as findings, nonconformities, corrective actions), relevant legal and regulatory requirements (such as laws, standards), relevant risks and opportunities (such as internal and external issues), relevant performance indicators (such as objectives, targets), etc1. Therefore, an auditor may need work documents such as an audit plan (which defines what will be done during an audit), a sample plan (which defines how many samples will be taken from a population), and a checklist (which helps to ensure that all relevant aspects are covered during an audit)1. However, an auditor does not need work documents such as an organisation’s financial statement (which is not directly related to information security management), a career history of the IT manager (which is not relevant to assessing conformity with ISO/IEC 27001:2022), or a list of external providers (which is not necessary for planning an audit)1. References: ISO 19011:2018 - Guidelines for auditing management systems

Comprehensive and Detailed In-Depth Explanation:

B. Correct Answer:

ISO 19011:2018 (Guidelines for Auditing) requires auditors to consider all relevant evidence before making a final recommendation.

Clastus has the right to present additional evidence if they disagree with findings.

A. Incorrect:

Certification recommendations should remain open to valid new evidence until officially finalized.

C. Incorrect:

Auditors must consider revisions if they provide relevant clarification or evidence.

Relevant Standard Reference:

ISO 19011:2018 Clause 6.6.3 (Handling Disputes and Additional Evidence in Audits)

ISO/IEC 27001:2022 explicitly requires that risk treatment decisions be based on the results of the information security risk assessment. Clause 6.1.3 states that, after completing a risk assessment, the organization shall determine appropriate risk treatment options and select controls to implement those options. This ensures that controls are proportionate, justified, and aligned with actual information security risks rather than arbitrary or purely cost-driven decisions.

In the scenario, Knight conducted a risk assessment after implementing SSH to replace FTP and then chose a risk treatment option based on the assessment results. This approach is fully compliant with ISO/IEC 27001. The organization first identified the risk, implemented a control to address the vulnerability, and then reassessed the residual risk to confirm whether it was reduced to an acceptable level. This demonstrates a structured and systematic risk management process.

Option B is incorrect because ISO/IEC 27001 does not allow financial considerations to override risk assessment outcomes. While cost is a factor, it must be balanced against the risk and potential impact. Option C is incorrect because random selection of risk treatment options contradicts the fundamental principles of risk-based decision-making and would undermine the effectiveness of the ISMS.

Therefore, selecting a risk treatment option based on risk assessment results is not only acceptable but required under ISO/IEC 27001:2022.

The four statements that are true are:

•Major nonconformities may be subject to on-site follow up

•The action taken to address major nonconformities is typically more substantial than the action taken to address minor nonconformities

•Several minor nonconformities can be grouped into a major nonconformity

•Nonconformities may be graded to indicate their significance

According to ISO 19011:2018, a nonconformity is the non-fulfilment of a requirement1. Nonconformities may be graded to indicate their significance, based on the criteria established by the audit programme or the audit client2. The grading of nonconformities may use different terms or levels, such as major, minor, critical, etc., depending on the nature and context of the audit3. However, some common definitions of major and minor nonconformities are:

•A major nonconformity is a nonconformity that affects the ability of the management system to achieve its intended results, or that represents a significant breakdown of the management system4. Major nonconformities may require immediate corrective action and on-site follow up by the auditor to verify their closure5.

•A minor nonconformity is a nonconformity that does not affect the ability of the management system to achieve its intended results, or that represents an isolated lapse of the management system4. Minor nonconformities may require corrective action within a specified time frame and off-site verification by the auditor to confirm their closure5.

The action taken to address nonconformities depends on the severity and impact of the nonconformity, and the risk of recurrence or escalation. Typically, the action taken to address major nonconformities is more substantial than the action taken to address minor nonconformities, as it may involve identifying and eliminating the root cause of the problem, implementing preventive measures, and monitoring the effectiveness of the solution.

Several minor nonconformities can be grouped into a major nonconformity if they are related to the same requirement, process, or area, and if they indicate a systemic failure or a significant risk to the management system. The auditor should use professional judgment and evidence-based approach to decide whether to group or report nonconformities individually.

The other statements are false, based on the guidance of ISO 19011:2018. For example:

•Option B is false, because nonconformities can be graded using different terms or levels, depending on the criteria established by the audit programme or the audit client2. The terms ‘major’ and ‘minor’ are not mandatory or universal, but rather examples of possible grading levels3.

•Option D is false, because very minor nonconformities should not be re-graded as opportunities for improvement, but rather reported as nonconformities, as they still represent a non-fulfilment of a requirement1. An opportunity for improvement is a suggestion for enhancing the performance or effectiveness of the management system, but it is not a nonconformity or a requirement.

•Option F is false, because the grading of nonconformities does not have to be explained to the auditee at the opening meeting, but rather at the closing meeting, where the audit findings and conclusions are presented and discussed. The opening meeting is intended to provide an overview of the audit objectives, scope, criteria, and methods, and to confirm the audit arrangements and logistics.

•Option G is false, because the auditee is not always responsible for determining the criteria for grading nonconformities, but rather the audit programme or the audit client, in consultation with the auditee and other relevant parties2. The auditee is responsible for taking corrective action to address the nonconformities, and for providing evidence of their completion and effectiveness.

Comprehensive and Detailed In-Depth Explanation:

A. Correct Answer:

Auditors conducted interviews (verbal evidence) and analyzed incident resolution records, employee training logs, and governance policies (documentary evidence).

ISO 19011:2018 (Clause 6.4.7) states that audit evidence can be verbal, documented, observed, or analytical.

B. Incorrect:

Confirmative evidence involves third-party validation, which was not explicitly mentioned.

C. Incorrect:

Mathematical analysis was not conducted in this audit.

Relevant Standard Reference:

ISO 19011:2018 Clause 6.4.7 (Audit Evidence Collection Methods)

The mail sent by the CEO giving his views on the status of the company and the company’s future strategy and the CEO’s vision and the employee’s part in it should be classified as internal mail. Internal mail is a type of classification that indicates that the information is intended for internal use only, and should not be disclosed to external parties without authorization. The mail sent by the CEO contains information that is relevant and important for the employees of the company, but may not be suitable for public disclosure, as it may contain sensitive or confidential information about the company’s performance, goals, or plans. References: : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 34. : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 37. : [ISO/IEC 27001 LEAD AUDITOR - PECB], page 14.

•C. Collect more evidence on how and when the Human Resources manager pays the ransom fee to unlock personal mobile data, i.e., credit card, and bank transfer. (Relevant to control A.5.26)

This is not relevant to the audit of the organization's incident management process. The HR manager's personal phone and how they handle a ransomware attack on it falls outside the scope of the ISMS audit. The organization is not responsible for personal devices.

•B. Collect more evidence on how and when the company pays the ransom fee to unlock the company's mobile phone and data, i.e., credit card, and bank transfer. (Relevant to control A.5.26)

While seemingly relevant, this focuses on the method of payment for the ransom. The core issue is the organization paying the ransom at all, which is generally not best practice in incident response. The audit should focus on why this decision was made and if alternative solutions were considered (e.g., data backups, device wiping and restoration).

Why the other options ARE relevant:

•A. Collect more evidence by interviewing more staff about their understanding of the reporting process. (Relevant to control A.6.8) This directly addresses the identified discrepancy in understanding "weakness, event, and incident," which is crucial for proper incident reporting.

•D. Collect more evidence on how the organisation determined the incident recovery time. (Relevant to control A.5.27) This investigates the basis for the 24-hour recovery time, which seems arbitrary and may not be appropriate for all incidents.

•E. Collect more evidence on how the organization determined no further action was needed after the incident. (Relevant to control A.5.26) This probes the adequacy of the incident response, especially the lack of preventative measures after paying the ransom.

•F. Collect more evidence on the incident recovery procedures. (Relevant to control A.5.26) This examines the actual procedures to assess their effectiveness and alignment with best practices.

Comprehensive and Detailed In-Depth Explanation:

A. Correct Answer:

ISO 19011:2018 mandates that auditors present all nonconformities with sufficient detail and context to ensure proper understanding and corrective action planning.

Failure to explain nonconformities fully could lead to ineffective remediation.

B. Incorrect:

Minor nonconformities must also be presented to ensure full transparency.

C. Incorrect:

Aligning with standard clauses is necessary, but detailed analysis is more critical.

Relevant Standard Reference:

ISO 19011:2018 Clause 6.6.2 (Presentation of Audit Findings in Closing Meetings)

Information security is a matter of building and maintaining trust. Trust is the confidence that information and information processing facilities are protected from unauthorized or malicious actions that could compromise their confidentiality, integrity or availability. Trust is essential for establishing and maintaining relationships with customers, partners, suppliers, employees and other stakeholders who rely on the organization’s information and services. Trust is also a key factor for achieving compliance with legal, regulatory and contractual obligations, as well as meeting the organization’s own information security objectives and policies. ISO/IEC 27001:2022 defines information security as “preservation of confidentiality, integrity and availability of information” (see clause 3.28) and states that “the purpose of an information security management system is to provide a framework for managing activities that influence the trustworthiness of information” (see Introduction). References: CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course, ISO/IEC 27001:2022 Information technology — Security techniques — Information security management systems — Requirements, What is Trust?

Comprehensive and Detailed In-Depth Explanation:

C. Correct Answer – This is a Threat. A cyberattack exploiting a zero-day vulnerability is an active security threat, as it causes harm to the organization.

A. Employee accessing unauthorized files is a vulnerability (insider risk) rather than an external threat.

B. Lack of MFA is a security weakness (vulnerability), not a threat.

This aligns with ISO/IEC 27001:2022 Annex A Control A.8.25 (Assessment and Decision on Information Security Events).

The definition of information that is not correct is C: mature and measurable data. This is not a valid definition of information, as information does not have to be mature or measurable to be considered as such. Information can be any data that has meaning or value for someone or something in a certain context. Information can be subjective, qualitative, incomplete or uncertain, depending on how it is interpreted or used. Mature and measurable data are characteristics that may apply to some types of information, but not all. The other definitions of information are correct, as they describe different aspects of information, such as accuracy and timeliness (A), specificity and organization (B), and understanding and uncertainty reduction (D). ISO/IEC 27001:2022 defines information as “any data that has meaning” (see clause 3.25). References: CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course, ISO/IEC 27001:2022 Information technology — Security techniques — Information security management systems — Requirements, What is Information?

The correct answer is B, because the audit did not fully address all necessary steps required for auditing outsourced operations under ISO/IEC 27001:2022. While the auditors reviewed several important aspects, including contractual obligations, governance arrangements, and quality monitoring processes, the scenario clearly states that SendPay’s protocols did not fully address contingencies for unanticipated cancellations of outsourcing agreements. This represents a gap in the audit coverage.

ISO/IEC 27001:2022 requires organizations to ensure that information security requirements are addressed in supplier relationships throughout the entire lifecycle, including planning for termination. Annex A controls relating to supplier relationships require organizations to consider continuity, security responsibilities, and exit arrangements to protect information assets when outsourcing agreements end, whether expected or unexpected.

Although the auditors assessed monitoring mechanisms and contractual compliance, identifying that termination contingencies were not fully addressed indicates that this critical area was insufficiently covered. Therefore, the audit did not include all necessary steps to fully evaluate outsourced operations. Option A is incorrect because the scenario explicitly identifies a missing element. Option C is incorrect because the audit went beyond quality monitoring and included governance, contractual obligations, and termination planning, even though that planning was incomplete.

Thus, the most accurate conclusion is that the audit overlooked crucial steps related to termination arrangements, making option B correct.

The following are purposes of information security, except increasing business assets. Increasing business assets is not a purpose of information security, as it is not directly related to protecting information and systems from threats and risks. Information security may contribute to increasing business assets by enhancing customer trust, reputation, compliance, and efficiency, but it is not its primary goal. Ensuring business continuity is a purpose of information security, as it aims to prevent or minimize disruptions or losses caused by incidents affecting information and systems. Minimizing business risk is a purpose of information security, as it aims to identify and reduce threats and vulnerabilities that may compromise information and systems. Maximizing return on investment is a purpose of information security, as it aims to optimize the costs and benefits of implementing and maintaining information security controls and measures. References: : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 23. : [ISO/IEC 27001 Brochures | PECB], page 4.

Lawsy's lack of specific procedures for the use of laptops outside the workplace, despite allowing such use, represents a nonconformity. ISO/IEC 27001 requires that security controls and management processes be clearly defined, documented, and implemented. Relying solely on employees' common knowledge does not fulfill the standard's requirements for managing information security risks associated with mobile and teleworking.

The correct answers for matching each of the descriptions with the appropriate risk term are:

The strategy chosen to respond to a specific information security risk: This is a definition of information security risk treatment. According to ISO/IEC 27000:2022, information security risk treatment is “the process of selecting and implementing measures to modify the information security risk” Section 3.33.

The effect of uncertainty on information security objectives: This is a definition of information security risk. According to ISO/IEC 27000:2022, information security risk is “the effect of uncertainty on information security objectives” Section 3.32.

The requirements against which information security risks are evaluated: This is a definition of information security risk criteria. According to ISO/IEC 27000:2022, information security risk criteria are “the terms of reference by which the significance of information security risks is assessed” Section 3.31.

A definition of the overall level of information security risk that is considered to be tolerable: This is a definition of information security risk acceptance criteria. According to ISO/IEC 27000:2022, information security risk acceptance criteria are “the level of information security risk that is acceptable” Section 3.30.

ISO/IEC 27001 emphasizes the need for organizations to have a comprehensive incident management and recovery plan for various situations, including the termination of contracts with key service providers. In the case of SendPay, having a specific, documented recovery plan that outlines steps and protocols in case of sudden termination is necessary to ensure business continuity and compliance with the standard.

SendPay's inability to restore their services immediately after the contract termination indicates a lack of a comprehensive business continuity plan that addresses the potential impacts of such terminations. This oversight can result in significant operational disruptions, as observed.

Integrity is one of the basic components of information security, along with confidentiality and availability. Integrity means that information is safeguarded from unauthorized or accidental changes that could affect its accuracy and completeness. Integrity ensures that information is reliable and trustworthy3. References: ISO/IEC 27001:2022 Lead Auditor Training Course - BSI

The correct answer is Detailed descriptions of all audit findings with corrective actions, because this information is not a required element of a quality review documentation template. Quality review documentation focuses on verifying the adequacy, consistency, and compliance of the audit process itself, not on managing corrective actions.

According to ISO/IEC 17021-1 and ISO 19011, quality review records typically include identification of the reviewer and preparer, confirmation that required audit steps were completed, dates of review activities, and confirmation that conclusions are supported by evidence. These elements ensure traceability, accountability, and procedural compliance.

Option A is required because identifying both the preparer and reviewer supports independence and accountability in the review process. Option C is also required because recording completion dates provides evidence that reviews were performed at the appropriate stage of the audit process.

Option B is incorrect because detailed audit findings and corrective actions belong in audit reports and corrective action tracking systems, not in the quality review template. Including corrective actions in quality review documentation would blur the distinction between audit execution and audit oversight.

Therefore, detailed descriptions of audit findings with corrective actions are not a required element of quality review documentation.

The correct order of the stages is:

Prepare the audit checklist

Gather objective evidence

Review audit evidence

Document findings

Audit preparation: This stage involves defining the audit objectives, scope, criteria, and plan. The auditor also prepares the audit checklist, which is a list of questions or topics that will be covered during the audit. The audit checklist helps the auditor to ensure that all relevant aspects of the ISMS are addressed and that the audit evidence is collected in a systematic and consistent manner12.

Audit execution: This stage involves conducting the audit activities, such as opening meeting, interviews, observations, document review, and closing meeting. The auditor gathers objective evidence, which is any information that supports the audit findings and conclusions. Objective evidence can be qualitative or quantitative, and can be obtained from various sources, such as records, statements, physical objects, or observations123.

Audit reporting: This stage involves reviewing the audit evidence, evaluating the audit findings, and documenting the audit results. The auditor reviews the audit evidence to determine whether it is sufficient, reliable, and relevant to support the audit findings. The auditor evaluates the audit findings to determine the degree of conformity or nonconformity of the ISMS with the audit criteria. The auditor documents the audit results in an audit report, which is a formal record of the audit process and outcomes. The audit report typically includes the following elements123:

An introduction clarifying the scope, objectives, timing and extent of the work performed

An executive summary indicating the key findings, a brief analysis and a conclusion

The intended report recipients and, where appropriate, guidelines on classification and circulation

Detailed findings and analysis

Recommendations for improvement, where applicable

A statement of conformity or nonconformity with the audit criteria

Any limitations or exclusions of the audit scope or evidence

Any deviations from the audit plan or procedures

Any unresolved issues or disagreements between the auditor and the auditee

A list of references, abbreviations, and definitions used in the report

A list of appendices, such as audit plan, audit checklist, audit evidence, audit team members, etc.

Audit follow-up: This stage involves verifying the implementation and effectiveness of the corrective actions taken by the auditee to address the audit findings. The auditor monitors the progress and completion of the corrective actions, and evaluates their impact on the ISMS performance and conformity. The auditor may conduct a follow-up audit to verify the corrective actions on-site, or may rely on other methods, such as document review, remote interviews, or self-assessment by the auditee. The auditor documents the follow-up results and updates the audit report accordingly123.

According to the PECB Candidate Handbook for ISO/IEC 27001 Lead Auditor, audit methods can be classified into two categories: with or without interaction with individuals representing the auditee (page 12). Audit methods with interaction include reviewing checklists with auditee and conducting interviews, as they involve direct communication and feedback from the auditee. Audit methods without interaction include sampling (e.g. products), observing work performed via live video streaming, checking legal compliance with local authorities, and analysing documents provided in advance of the audit, as they do not require any dialogue or exchange with the auditee. References: PECB Candidate Handbook for ISO/IEC 27001 Lead Auditor, page 12.

According to ISO/IEC 27001:2022, clause 7.2.2, the organization shall ensure that all persons who have access to information are aware of the information security policy and their contribution to the effectiveness of the ISMS, including the benefits of improved information security performance2. Therefore, awareness training on information security is a requirement for all persons, not just new hires. References: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) | CQI | IRCA

The correct options for how the auditor should respond are:

A. Advise the MSR that an extension of the scope may be incorporated but will have to go through established procedures

D. Determine whether the Management System covers the processes at the new site and, if so, proceed with the audit

These options are consistent with the ISO/IEC 27006:2015 standard, which states that any changes to the scope of certification should be notified by the client to the certification body, and that the certification body should evaluate and decide on these changes in accordance with its procedures1. The auditor should also verify that the ISMS is implemented and maintained at all sites included in the scope of certification1.

The other options are not appropriate for how the auditor should respond, because:

B. Advise the MSR that the audit scope has been determined based on their initial application so the audit has to proceed as planned: This option is too rigid and does not allow for any flexibility or adaptation to the client’s situation. The auditor should be open to consider any changes to the scope of certification that may have occurred since the initial application, as long as they are properly notified and evaluated by the certification body.

C. Suggest that the MSR cancels the audit contract and reapplies for the new situation: This option is too drastic and unnecessary, as it would cause delays and costs for both the client and the certification body. The auditor should not suggest that the client cancels the audit contract, but rather that they follow the established procedures for requesting and approving an extension of the scope of certification.

E. Advise the MSR that, within the existing scope, the new work area can be included without any problem: This option is too lenient and does not ensure that the new work area meets the requirements of ISO/IEC 27001 and the ISMS. The auditor should not assume that the new work area can be included within the existing scope without any problem, but rather that they need to verify that the ISMS is implemented and maintained at the new site, and that any changes to the scope of certification are approved by the certification body.

F. Confirm that the auditor will advise the auditee that the audit scope will be revised to include the new work area: This option is too presumptuous and does not respect the authority of the certification body. The auditor should not confirm that they will revise the audit scope to include the new work area, but rather that they will advise the certification body of the client’s request for an extension of the scope of certification, and wait for their decision.

Machine learning is a subset of artificial intelligence that involves the use of algorithms and statistical models to enable systems to improve their performance on a specific task over time with experience or data, without being explicitly programmed. In the context of the scenario, machine learning would be the technology that allows the chatbot to learn from patterns in queries to provide the right answers.

“In a third-party audit an observation can indicate conformity at organisation is not required to take action.”

According to the PECB Candidate Handbook1, an observation is “a statement of fact made during an audit and substantiated by objective evidence”. An observation can indicate conformity or nonconformity, but it does not require any corrective action from the audited organisation. A recommendation, on the other hand, is “a suggestion for improvement based on an observation”. A recommendation may or may not be accepted by the audited organisation.

According to the Fundamentals – Third parties2, a third-party audit is “an audit conducted by an external organisation that has the legal right to audit an organisation’s processes and procedures”. A third-party audit can result in a finding, which is “a conclusion reached by the auditor based on the audit evidence collected”. A finding can be positive or negative, depending on whether the audited organisation meets the audit criteria or not. A nonconformity is “a finding that indicates the non-fulfilment of a requirement”. A nonconformity requires corrective action from the audited organisation to prevent recurrence.

Capability Maturity Model (CMM) is a framework that describes the key elements of an effective software process. It defines five levels of maturity for software development organizations, from initial to optimized. The CMM helps organizations to assess their current level of process capability and identify the areas for improvement1. References: ISO/IEC 27001:2022 Lead Auditor - IECB

The correct answer is A, because internal and external audits serve different but complementary purposes within an ISO/IEC 27001-based ISMS. Internal audits are conducted by or on behalf of the organization to regularly assess the effectiveness, conformity, and continual improvement of the ISMS. Their results help management identify weaknesses, risks, and opportunities for improvement before they become systemic issues.

ISO/IEC 27001 requires organizations to conduct internal audits at planned intervals to ensure the ISMS conforms to both internal requirements and the standard. These audits provide valuable input into management reviews, corrective actions, and readiness for external audits. In this way, internal audits act as an early warning and improvement mechanism.

External audits, conducted by an independent certification body, rely partly on the maturity demonstrated through internal audit outcomes. They verify whether the organization’s ISMS meets ISO/IEC 27001 requirements and whether internal audits are effective and properly implemented.

Option B is incorrect because internal audits are not passive reviews of external audit outputs; they are independent assessments with their own scope and objectives. Option C is incorrect because the roles are reversed: internal audits focus on ongoing internal improvement, while external audits focus on certification conformity.

Therefore, internal audits directly support and complement external audits by strengthening ISMS readiness and effectiveness.

The IRT’s finding that FTP transmits authentication credentials in clear text represents a vulnerability in information security terms. A vulnerability is defined as a weakness in an asset, system, or control that can be exploited by a threat. In this scenario, FTP itself is not a threat, nor is it the risk; rather, it is the technical weakness that enabled the attackers to succeed.

The attackers (hackers) are the threat, and the potential loss of proprietary information is the impact. The risk arises from the combination of the threat exploiting the vulnerability and causing harm. However, the question specifically asks what the IRT’s finding about FTP represents, and that finding is the identification of a weakness in the system design. The use of clear-text authentication is a well-known security weakness, making it easier for attackers to capture credentials through network traffic interception.

ISO/IEC 27001:2022 risk assessment logic requires organizations to distinguish clearly between threats, vulnerabilities, and risks during incident analysis. The IRT did exactly this by identifying that the protocol itself lacked encryption, which is a vulnerability. This is further supported by the corrective action taken: replacing FTP with SSH. SSH provides encrypted communication, which directly addresses the vulnerability by removing the weakness that allowed credential exposure.

Therefore, the IRT’s findings correctly identify FTP as a vulnerability, making option A the correct answer.

This is a minor nonconformity. The backup frequency not adhering to the company's procedure of daily backups but occurring once a month represents a deviation from established processes, yet it might not immediately impact the effectiveness of the information security management system.

From Exact Extract:

1. Definition of control types (ISO-aligned understanding)

In information security management:

Preventive controls are designed to prevent an incident from occurring.

Detective controls are designed to identify and detect incidents or anomalies after or as they occur.

Corrective controls are designed to correct issues after detection.

2. Analysis of the controls implemented by Fintive

The scenario explicitly states that Fintive implemented the following controls:

Comprehensive audit logging

Automated alert systems to flag unusual activities

Periodic access reviews

Monitoring system behavior for anomalies

All of these controls are designed to:

Detect unauthorized access

Detect errors

Detect suspicious activities

Enable investigation after detection

This aligns directly with detective controls, not preventive or corrective.

3. ISO/IEC 27002:2022 – Exact control alignment

The controls implemented correspond to Annex A technological and organisational detective controls, including:

A.8.15 – Logging

Logging enables the detection and investigation of security events.

A.8.16 – Monitoring activities

Monitoring is used to detect anomalous behaviour and potential security incidents.

A.5.18 – Access rights (periodic reviews)

Access reviews detect inappropriate or excessive access.

These controls do not prevent the chatbot from malfunctioning, nor do they directly fix it — they detect issues so that action can be taken.

4. Why the other options are incorrect

A. Preventive – IncorrectPreventive controls would include secure coding practices, input validation, sandboxing, or improved testing before release. These were not the controls described.

C. Corrective – IncorrectCorrective controls would involve fixing the chatbot logic, retraining the model, or disabling unsafe features. The scenario explicitly focuses on detection and monitoring, not correction.

Auditor Conclusion

Fintive implemented detective controls to identify unauthorized access, errors, and suspicious activity arising from the chatbot’s behaviour. This is consistent with ISO/IEC 27001:2022 risk treatment and monitoring requirements.

Audit methods are techniques used by auditors to obtain audit evidence. Audit methods can be classified into two categories: those that involve human interaction and those that do not2. Audit methods that involve human interaction require direct communication between the auditor and the auditee or other relevant parties, such as interviews, questionnaires, surveys, meetings, etc. Audit methods that do not involve human interaction rely on observation, inspection, measurement, testing, sampling, analysis, etc., without requiring any verbal or written exchange2. Therefore, performing an independent review of procedures in preparation for an audit and reviewing the auditee’s response to an audit finding are examples of audit methods that involve human interaction, as they require reading and evaluating documents provided by the auditee or other sources. On the other hand, analysing data by remotely accessing the auditee’s server and observing work performed by remote surveillance are examples of audit methods that do not involve human interaction, as they do not require any direct communication with the auditee or other parties. References: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) | CQI | IRCA

The correct statement which defines the content of the scope of the ISMS is that the ISMS scope should take any information security issues that have occurred and any interested parties’ requirements into consideration. According to ISO/IEC 27001:2022, the scope of the ISMS should be determined by considering the internal and external issues, the requirements and expectations of interested parties, the interfaces and dependencies between the organisation and other parties, and the information security risks. The scope of the ISMS should also be aligned with the strategic direction of the organisation and be appropriate to its purpose and context. The scope of the ISMS should not be limited by the government’s recommendation, nor exclude external service providers, nor be based on a single department or function, unless these are justified by the risk assessment and the needs and expectations of interested parties. References: = ISO/IEC 27001:2022, clause 4.3; PECB Candidate Handbook ISO 27001 Lead Auditor, page 15; ISO 27001 scope statement | How to set the scope of your ISMS - Advisera.

The purpose of a Stage 2 audit is to evaluate the implementation of the management system, in this case, the ISMS, according to the requirements of ISO/IEC 27001:2022 and the organisation’s own policies and procedures. The Stage 2 audit involves collecting evidence of the effectiveness and performance of the ISMS, as well as verifying the conformity and suitability of the organisation’s controls. The Stage 2 audit also assesses the organisation’s ability to achieve its information security objectives and to manage information security risks. References: = ISO/IEC 27006:2022, clause 9.2.2.2; PECB Candidate Handbook ISO 27001 Lead Auditor, page 28.

A property of information that has the ability to prove occurrence of a claimed event is integrity. Integrity is one of the three main objectives of information security, along with confidentiality and availability. Integrity ensures that information and systems are not corrupted, modified, or deleted by unauthorized actions or events. Integrity also implies that information and systems can be verified and validated as authentic and accurate. Electronic chain letters are not a property of information, but a type of spam or hoax message that may contain malicious or misleading content. Availability means that service should be accessible at the required time and usable only by the authorized entity. Accessibility is not a property of information, but a characteristic of usability that refers to how easy it is for users to access and interact with information and systems. References: : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 24. : [ISO/IEC 27001 Brochures | PECB], page 4. : [ISO/IEC 27001 LEAD AUDITOR - PECB], page 13.

The main purpose of a Stage 1 audit is to evaluate the adequacy and effectiveness of the organisation’s ISMS documentation, and to assess whether the organisation is prepared for the Stage 2 audit, where the implementation and operation of the ISMS will be verified. The Stage 1 audit also involves verifying the scope, objectives, and context of the ISMS, as well as identifying any areas of concern or nonconformities that need to be addressed before the Stage 2 audit.

Comprehensive and Detailed In-Depth Explanation:

A. Assigning responsibilities to the audit team members (Correct Answer) – This is not Sarah’s responsibility. The certification body assigns the audit team and defines responsibilities, ensuring independence and objectivity.

B. Defining the audit criteria and objectives (Correct Responsibility) – Sarah, as the audit team leader, must establish audit criteria and objectives, per ISO 19011 (Guidelines for Auditing Management Systems).

C. Planning the audit (Correct Responsibility) – The audit team leader is responsible for planning the audit, including timelines and resource allocation.

Relevant Standard Reference:

ISO/IEC 27001:2022 Clause 9.2 (Internal Audit)

ISO 19011:2018 Clause 5.5.2 (Defining Audit Objectives and Criteria)

The audit team used documented information review and observation for evidence collection and evaluation for analysis, making option A the correct answer. This aligns directly with ISO 19011, which identifies document review, observation, and evaluation as primary audit techniques.

In the scenario, auditors reviewed ISMS documentation remotely, observed departmental practices during stage 2, and evaluated whether controls such as access rights management and training documentation met ISO/IEC 27001 requirements. These activities constitute classic evidence-based auditing methods.

Option B is incorrect because there is no indication that technical verification or extensive sampling of systems occurred. Option C is incorrect because the audit did not rely solely on interviews, nor was trend analysis the primary analytical method used. Interviews were supplementary, not exclusive.

ISO auditing requires auditors to triangulate evidence using multiple methods. The combination of document review, observation, and evaluative analysis reflects appropriate and recommended audit practice.

A first-party audit is an internal audit in which the organization’s own staff or contractors check the conformity and effectiveness of the ISMS. A certification body auditor and an audit team from an accreditation body are external auditors who conduct audits for the purpose of certification or accreditation. They do not participate in a first-party audit, but rather in a third-party audit. References: First & Second Party Audits - operational services, The ISO 27001 Audit Process | Blog | OneTrust, The ISO 27001 Audit Process | A Beginner’s Guide - IAS USA

Risk analysis is the process by which the nature of the risk is determined along with its probability and impact. Risk analysis involves estimating the likelihood and consequences of potential events or situations that could affect the organization’s information security objectives or requirements12. Risk analysis could use qualitative or quantitative methods, or a combination of both12.

Risk management is the process by which a risk is controlled at all stages of its life cycle by means of the application of organisational policies, procedures and practices. Risk management involves establishing the context, identifying, analyzing, evaluating, treating, monitoring, and reviewing the risks that could affect the organization’s information security performance or compliance12. Risk management aims to ensure that risks are identified and treated in a timely and effective manner, and that opportunities for improvement are exploited12.

Risk identification is the process by which a risk is recognised and described. Risk identification involves identifying and documenting the sources, causes, events, scenarios, and potential impacts of risks that could affect the organization’s information security objectives or requirements12. Risk identification could use various techniques, such as brainstorming, interviews, checklists, surveys, or historical data12.

Risk evaluation is the process by which the impact and/or probability of a risk is compared against risk criteria to determine if it is tolerable. Risk evaluation involves comparing the results of risk analysis with predefined criteria that reflect the organization’s risk appetite, tolerance, or acceptance12. Risk evaluation could use various methods, such as ranking, scoring, or matrix12. Risk evaluation helps to prioritize and decide on the appropriate risk treatment options12.

Risk mitigation is the process by which the impact and/or probability of a risk is reduced by means of the application of controls. Risk mitigation involves selecting and implementing measures that are designed to prevent, reduce, transfer, or accept risks that could affect the organization’s information security objectives or requirements12. Risk mitigation could include various types of controls, such as technical, organizational, legal, or physical12. Risk mitigation should be based on a cost-benefit analysis and a residual risk assessment12.

Risk transfer is the process by which a risk is passed to a third party, for example through obtaining appropriate insurance. Risk transfer involves sharing or shifting some or all of the responsibility or liability for a risk to another party that has more capacity or capability to manage it12. Risk transfer could include various methods, such as contracts, agreements, partnerships, outsourcing, or insurance12. Risk transfer should not be used as a substitute for effective risk management within the organization12.

References :=

ISO/IEC 27001:2022 Information technology — Security techniques — Information security management systems — Requirements

ISO/IEC 27005:2022 Information technology — Security techniques — Information security risk management

By using illegal versions of software, NightCore ignored the control about intellectual property rights under Annex A.8.1.1 of ISO/IEC 27001, which requires the protection of organizational records to include intellectual property and personal information held in the form of data or software.

ISO/IEC 27001 requires organizations to comply with applicable legal, statutory, regulatory, and contractual requirements, including those pertaining to information security. These requirements must be identified, documented, and kept up to date as part of the organization's ISMS.

competence of the audit team and decision made by the certification body

According to ISO/IEC 17021-1, which specifies the requirements for bodies providing audit and certification of management systems, an accredited certification means that the certification body has been evaluated by an accreditation body against recognized standards to demonstrate its competence, impartiality and performance capability1. Therefore, an accredited certification assures the competence of the audit team that conducts the audit in accordance with ISO 19011 and ISO/IEC 27001:2022, and the decision made by the certification body that grants or maintains the certification based on the audit evidence and findings2. References: ISO/IEC 17021-1:2015 - Conformity assessment – Requirements for bodies providing audit and certification of management systems – Part 1: Requirements, ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) | CQI | IRCA

The following four statements are true according to ISO/IEC 27001’s risk management requirements: 12

The results of risk assessments must be maintained. This is true because clause 8.2.3 of ISO/IEC 27001:2022 requires the organisation to retain documented information of the information security risk assessment process and the results12

ISO/IEC 27001 provides an outline approach for the management of risk. This is true because clause 6.1.2 of ISO/IEC 27001:2022 specifies the general steps for the information security risk management process, which include establishing the risk criteria, assessing the risks, treating the risks, and monitoring and reviewing the risks12

The organisation must produce a risk treatment plan for every business risk identified. This is true because clause 6.1.3 of ISO/IEC 27001:2022 requires the organisation to produce a risk treatment plan that defines the actions to be taken to address the unacceptable risks, the responsibilities, the expected dates, and the resources required12

Risk assessments should be undertaken following significant changes. This is true because clause 8.2.4 of ISO/IEC 27001:2022 requires the organisation to review and update the risk assessment at planned intervals or when significant changes occur12

The following four statements are false according to ISO/IEC 27001’s risk management requirements:

Risk identification is used to determine the severity of an information security risk. This is false because risk identification is used to identify the assets, threats, vulnerabilities, and existing controls that are relevant to the information security risk management process. The severity of an information security risk is determined by the risk analysis, which evaluates the likelihood and impact of the risk scenarios12

The organisation must operate a risk treatment process to eliminate its information security risks. This is false because the organisation can choose from four options to treat its information security risks: avoid, transfer, mitigate, or accept. The organisation does not have to eliminate all its information security risks, but only those that are unacceptable according to its risk criteria12

The initial phase in an organisation’s risk management process should be information security risk assessment. This is false because the initial phase in an organisation’s risk management process should be establishing the risk management framework, which includes defining the risk management policy, objectives, scope, roles, responsibilities, and criteria. The information security risk assessment is the second phase in the risk management process12

Risks assessments should be undertaken at monthly intervals. This is false because there is no fixed frequency for conducting risk assessments in ISO/IEC 27001. The organisation should determine the appropriate intervals for reviewing and updating the risk assessment based on its risk appetite, risk profile, and operational context12

According to the ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) course, the following actions should be taken when a nonconformity identified for completion before the follow-up audit is still outstanding:

A. Report the failure to address the corrective action for the outstanding nonconformity to the organisation’s top management. This is part of the auditor’s responsibility to communicate the audit results and ensure that the audit objectives are met12.

C. If the delay is justified agree on a revised date for clearing the nonconformity with the auditee/audit client. This is part of the auditor’s responsibility to verify the effectiveness of the corrective actions taken by the auditee and to close the nonconformity when the evidence is satisfactory12.

E. Decide whether the delay in addressing the nonconformity is justified. This is part of the auditor’s responsibility to evaluate the evidence presented by the auditee and to use professional judgement and objectivity to determine the validity of the reasons for the delay12.

G. Note the nonconformity is still outstanding and follow audit trails to determine why. This is part of the auditor’s responsibility to collect and verify audit evidence and to identify the root causes of the nonconformity12.

This scenario represents an "audit finding." An audit finding refers to results that indicate a deviation from the expected performance or standards. Discovering that two employees have not received the required training is an audit finding indicating noncompliance with the organization's training requirements.

The four controls from the list that the auditor in training should review are:

•B. How access to source code and development tools are managed: This control requires the organisation to restrict and monitor the access to the source code and development tools that are used to create, modify, or maintain the software applications and systems that process or store the data of external clients. This is important for ensuring the integrity, confidentiality, and availability of the software and the data, as well as for preventing unauthorized changes, errors, or malicious code injection.

•D. How protection against malware is implemented: This control requires the organisation to implement appropriate measures to detect, prevent, and remove malware from the IT systems and devices that process or store the data of external clients. This includes using antivirus software, firewalls, email filtering, web filtering, and other tools to protect against viruses, worms, ransomware, spyware, and other malicious software. This is essential for safeguarding the data and the systems from corruption, theft, or damage caused by malware.

•E. How the organisation evaluates its exposure to technical vulnerabilities: This control requires the organisation to identify and assess the technical vulnerabilities that may affect the IT systems and devices that process or store the data of external clients. This includes using vulnerability scanning tools, penetration testing tools, threat intelligence sources, and other methods to discover and evaluate the weaknesses and gaps in the security of the systems and the devices. This is necessary for prioritizing and implementing the appropriate corrective actions and controls to mitigate the risks posed by the vulnerabilities.

•G. The organisation’s arrangements for information deletion: This control requires the organisation to establish and implement policies and procedures for deleting the data of external clients from the IT systems and devices when it is no longer needed or required. This includes defining the criteria and methods for data deletion, such as secure erasure, encryption, or physical destruction. This is important for complying with the contractual obligations and the legal and regulatory requirements regarding the retention and disposal of the data, as well as for protecting the confidentiality and integrity of the data.

 Information or data that are classified as public do not require labeling. Public information or data are those that are intended for general disclosure and have no impact on the organization’s operations or reputation if disclosed. Labeling is a method of implementing classification, which is a process of structuring information according to its sensitivity and value for the organization. Labeling helps to identify the level of protection and handling required for each type of information. Information or data that are classified as internal, confidential, or highly confidential require labeling, as they contain information that is not suitable for public disclosure and may cause harm or loss to the organization if disclosed. References: : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 34. : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 37. : [ISO/IEC 27001 LEAD AUDITOR - PECB], page 14.

Relevant Standard Reference:

ISO/IEC 17021-1:2015 Clause 9.6.2 (Purpose of Surveillance Audits)

"An audit finding is the result of the evaluation of the collected audit evidence against audit criteria."

The words that best complete the sentence to describe an audit finding are evaluation and evidence. According to ISO 19011:2022, an audit finding is the result of the evaluation of the collected audit evidence against audit criteria12. The other options are either not related to the definition of an audit finding or do not fit the sentence grammatically. References: 1: ISO 19011:2022, Guidelines for auditing management systems, Clause 3.11 \n2: PECB Certified ISO/IEC 27001 Lead Auditor Exam Preparation Guide, Domain 5: Conducting an ISO/IEC 27001 audit

Explanation (ISO-aligned)

Vulnerability scanning tools may produce false positives.

ISO/IEC 27002:2022 A.8.8 (Management of technical vulnerabilities) requires vulnerabilities to be evaluated, not blindly accepted.

A vulnerability becomes confirmed only after validation, contextual analysis, or successful exploitation.

Option A is incorrect because scan results require validation.

Option B is incorrect because failure to exploit does not prove absence of vulnerability.

✅ Correct reasoning: risk must be validated before confirmation.

Materiality in the context of an audit involves assessing what level of nonconformities or failures, including those related to legal and contractual compliance, would be significant enough to affect the audit conclusions. Costs related to these issues are considered when determining materiality.

The three options of the corrections and corrective actions listed that you would expect ABC to make in response to the nonconformity are:

B. ABC cancels the service agreement with WeCare.

E. ABC introduces background checks on information security performance for all suppliers.

F. ABC periodically monitors compliance with all applicable legislation and contractual requirements involving third parties.

B. This option is a possible correction and corrective action that ABC could take to address the nonconformity. A correction is the action taken to eliminate a detected nonconformity, while a corrective action is the action taken to eliminate the cause of a nonconformity and to prevent its recurrence1. By cancelling the service agreement with WeCare, ABC could stop the unauthorized use of residents’ personal data and protect their privacy and rights. This could also prevent further complaints and legal issues from the residents and their family members. However, this option may also have some drawbacks, such as the loss of a service provider, the need to find an alternative solution, and the potential impact on the residents’ well-being.

E. This option is a possible corrective action that ABC could take to address the nonconformity. By introducing background checks on information security performance for all suppliers, ABC could ensure that they select and work with reliable and trustworthy partners who respect the confidentiality, integrity, and availability of the information they handle. This could also help ABC to comply with information security control A.15.1.1 (Information security policy for supplier relationships), which requires the organisation to agree and document information security requirements for mitigating the risks associated with supplier access to the organisation’s assets2.

F. This option is a possible corrective action that ABC could take to address the nonconformity. By periodically monitoring compliance with all applicable legislation and contractual requirements involving third parties, ABC could verify that the suppliers are fulfilling their obligations and responsibilities regarding information security. This could also help ABC to comply with information security control A.18.1.1 (Identification of applicable legislation and contractual requirements), which requires the organisation to identify, document, and keep up to date the relevant legislative, regulatory, contractual, and other requirements to which the organisation is subject3.

The main purpose of a Stage 1 third-party audit is to determine readiness for a Stage 2 audit. A Stage 1 audit is a preliminary assessment that evaluates the organization’s ISMS documentation, scope, context, and objectives, and identifies any major gaps or nonconformities that need to be addressed before the Stage 2 audit. A Stage 1 audit does not introduce the audit team to the client, as this is done during the audit planning phase. A Stage 1 audit does not check for legal compliance by the organization, as this is done during the Stage 2 audit. A Stage 1 audit does not prepare an independent audit report, as this is done after the Stage 2 audit. References: : CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 70. : ISO/IEC 27001 LEAD AUDITOR - PECB, page 23.

The correct answer is during the first and second years of certification, making option B correct. According to ISO/IEC 17021-1, ISO/IEC 27006, and standard certification cycle rules, ISO/IEC 27001 certification follows a three-year certification cycle. After the initial certification audit, the organization is subject to periodic surveillance audits to ensure continued conformity of the ISMS.

Surveillance audits are typically conducted annually during the first and second years following certification. Their purpose is to verify that the ISMS remains effective, that corrective actions are maintained, and that the organization continues to comply with ISO/IEC 27001 requirements. These audits are less extensive than the initial certification audit but still cover critical ISMS elements, changes, incidents, and improvement activities.

Option A is incorrect because surveillance audits are mandatory and scheduled by the certification body, not optional or request-based. Option C is incorrect because five years exceeds the standard certification cycle. Instead, a recertification audit is conducted in the third year, not a surveillance audit.

Therefore, surveillance audits are normally conducted during the first and second years after certification, confirming option B as correct.

The incorrect statement is B, because auditors are permitted to adjust the audit plan based on materiality considerations identified during the stage 2 audit. ISO 19011 explicitly allows auditors to adapt audit plans as new information emerges, provided such changes are justified and documented. Preventing adjustments would contradict the principles of risk-based and evidence-based auditing.

Materiality is evaluated throughout the audit lifecycle. During initial contact and audit planning, inherent risks and organizational complexity influence audit duration and resource allocation, making statement A correct. During stage 1 audits, auditors review documentation and high-level processes to identify key areas that warrant deeper examination during stage 2, making statement C correct.

Statement B incorrectly suggests that once stage 2 begins, the audit plan is fixed and cannot be adjusted. In practice, if auditors discover that certain processes or assets are more material than initially assessed, they may legitimately reallocate audit time or adjust focus to ensure sufficient coverage of high-impact areas. This flexibility is essential to achieve reasonable assurance.

Therefore, statement B is not correct, as it contradicts established auditing norms and ISO guidance on audit adaptability.

Comprehensive and Detailed In-Depth Explanation:

C. Correct Answer:

Professional skepticism involves challenging evidence, verifying claims, and avoiding assumptions.

The auditors critically assessed the validity of evidence, ensuring claims made by Techvology were backed by concrete proof.

A. Incorrect:

Risk-based auditing prioritizes high-risk areas, but the paragraph focuses on verifying claims and evidence.

B. Incorrect:

Fair presentation ensures accurate reporting of findings, but the paragraph focuses on questioning evidence, not reporting.

Relevant Standard Reference:

ISO 19011:2018 Clause 4 (Principles of Auditing: Professional Skepticism)

Comprehensive and Detailed In-Depth Explanation:

A. Correct Answer:

Techmanic misrepresented its certification scope, which is a violation of ISO certification rules.

Suspension allows time for corrective action before withdrawal is considered.

B. Incorrect:

Certification withdrawal is only necessary if corrective actions fail after suspension.

C. Incorrect:

Transfer does not resolve misrepresentation issues.

Relevant Standard Reference:

ISO/IEC 17021-1:2015 Clause 9.6.5 (Certification Suspension and Misrepresentation Issues)

The correct answer is the certification body, because ISO/IEC 17021-1 clearly assigns responsibility for establishing the audit scope and audit criteria to the certification body, not to the audit team or the auditee. The certification body is responsible for managing the certification process, ensuring consistency, impartiality, and compliance with accreditation requirements.

The audit scope defines the boundaries of the certification audit, including organizational units, locations, activities, and processes to be audited. The audit criteria define the set of policies, procedures, and requirements against which conformity is assessed, such as ISO/IEC 27001 requirements, statutory obligations, and internal ISMS policies. While the audit team leader may plan how the audit will be conducted within the defined scope, they do not determine the scope itself.

Option A is incorrect because the audit team leader’s role is to manage the audit execution, prepare the audit plan, and coordinate audit activities, not to establish the official scope or criteria. Option B is incorrect because although discussions with the auditee are necessary to understand the organization and confirm scope feasibility, the final authority remains with the certification body.

This separation of responsibility ensures independence and prevents organizations from unduly influencing the certification boundaries. Therefore, the certification body is the entity that establishes the audit scope and audit criteria.

The auditor should verify if the information required by the standard is documented, without necessarily focusing on the format, as long as the content meets the requirements of the standard. ISO/IEC 27001 does not mandate a specific format for documentation, only that necessary information is appropriately documented, maintained, and controlled.

A third-party virtual audit is an external audit conducted by an independent certification body using remote technology such as video conferencing, screen sharing, and electronic document exchange. The purpose of a third-party virtual audit is to verify the conformity and effectiveness of the information security management system (ISMS) and to issue a certificate of compliance12

Before you start conducting the audit, you would need to inform the auditee about the following issues: 12

You will ask those being interviewed to state their name and position beforehand, i.e., to confirm their identity and role in the ISMS. This is to ensure that you are interviewing the relevant personnel and that they are authorized to provide information and evidence for the audit.

You will ask for a 360-degree view of the room where the audit is being carried out, i.e., to verify the physical and environmental security of the audit location. This is to ensure that there are no unauthorized persons or devices in the vicinity that could compromise the confidentiality, integrity, or availability of the information being audited.

The other issues are not relevant or appropriate for a third-party virtual audit, because:

You will ask to see the ID card of the person that is on the screen, i.e., to verify their identity. This is not necessary if you have already asked them to state their name and position beforehand, and if you have access to the auditee’s organizational chart or staff directory. Asking to see the ID card could also be seen as intrusive or disrespectful by the auditee.

You will take photos of every person you interview, i.e., to document the audit process. This is not advisable as it could violate the privacy or consent of the auditee and the interviewees. Taking photos could also be seen as unprofessional or suspicious by the auditee. You should rely on the audit records and evidence provided by the auditee and the audit tool instead.

You will not record any part of the audit, unless permitted, i.e., to respect the auditee’s preferences and rights. This is not a valid issue to inform the auditee about, as you should always record the audit for quality assurance and verification purposes. Recording the audit is also a requirement of the ISO/IEC 27001 standard and the certification body. You should inform the auditee that you will record the audit and obtain their consent before the audit begins.

You expect the auditee to have assessed all risks associated with online activities, i.e., to ensure the security of the audit process. This is not an issue to inform the auditee about, as it is part of the auditee’s responsibility and obligation to have a risk assessment and treatment process for their ISMS. You should assess the auditee’s risk management practices and controls during the audit, not before it.

Comprehensive and Detailed In-Depth Explanation:

B. Correct Answer:

Stage 1 audits identify gaps and allow the organization to correct major nonconformities before Stage 2 certification.

ISO/IEC 27006 requires organizations to address major nonconformities before proceeding to Stage 2.

A. Incorrect:

Organizations are allowed to correct nonconformities identified in Stage 1.

C. Incorrect:

Major changes must be addressed, not just minor modifications.

Relevant Standard Reference:

ISO/IEC 27006:2020 Clause 9.2.3 (Stage 1 and Stage 2 Audit Process)