Conducting an ISO/IEC 27001 Audit

Conducting the certification audit: stage 1 and stage 2, the opening meeting, communication, guides and observers, evidence collection, sampling, checklists, working papers and test plans, corroboration, drafting findings and nonconformities, and the benefit of the doubt.

5 minutes 5 Questions

Conducting an ISO/IEC 27001 audit is the core competency of a Lead Auditor. It follows the guidance of ISO 19011 (auditing management systems) and, for certification bodies, ISO/IEC 27006 and ISO/IEC 17021-1. The goal is to gather objective evidence showing whether an organization's Information Sec…

Concepts covered
The Benefit of the DoubtDocumented Information ReviewGuides and ObserversAudit InterviewsAudit Sampling MethodsAudit Test PlansCorroboration and Evaluation of EvidenceDrafting Audit FindingsAudit Checklists: Advantages and DisadvantagesAuditing the Risk Assessment and the Statement of ApplicabilityCommunication During the AuditNonconformity ReportsStage 1 Versus Stage 2 AuditMajor and Minor NonconformitiesAudit Working PapersStage 1 Audit Objectives and ActivitiesObservation and Technical VerificationStage 2 Audit Objectives and ActivitiesQuality Review of Audit DocumentationAuditing the Implementation of Annex A ControlsAuditing Internal Audit and Management ReviewDocumented Information Evaluation CriteriaAudit Observations and Opportunities for ImprovementThe Opening MeetingConflict Resolution During an Audit
Test mode:
Start practice test

ISO 27001 LA - Conducting an ISO/IEC 27001 Audit Example Questions

Test your knowledge of Conducting an ISO/IEC 27001 Audit

Question 1

Under ISO/IEC 27001:2022, which statement best describes the relationship an auditor should expect between an organization's internal audit and its management review?

Correct Answer: Internal audit results are an input to management review, whose outputs include improvement decisions and ISMS changes.

Clause 9.3.2 lists audit results, within information on information security performance, as a required input to management review. Clause 9.3.3 states that review outputs include decisions on continual improvement opportunities and any needs for changes to the ISMS.
The option about closing every nonconformity and approving root causes is wrong because those activities belong to the corrective action process in Clause 10.2, not to management review outputs. The option that reverses the flow is wrong because internal audit gathers evidence and reports results, while top management makes improvement decisions through management review.
Key concept: the direction of information flow from internal audit (9.2) into management review (9.3) as part of performance evaluation.

Question 2

During stage 2 of a regional hospital's ISMS audit, the audit team leader reviews a test plan that a team member drafted for control 8.13 Information backup. The Statement of Applicability includes this control. The plan has two steps: interview the backup administrator and read the hospital's backup procedure. That procedure requires daily backups and quarterly restore tests. What is the main weakness the audit team leader should identify in this test plan?

Correct Answer: It collects only design evidence, so it needs sampled backup logs and restore test records to confirm the procedure operates

The plan only shows how backups are supposed to work, through an interview and a documented procedure. Stage 2 must confirm the control actually operates, so the auditor needs objective evidence such as sampled daily backup logs and records of the quarterly restore tests.
Comparing the procedure to ISO/IEC 27002 frequencies is wrong because 27002 is guidance, not audit criteria. The hospital sets its own backup frequencies based on its risk assessment.
Interviewing every staff member who handles backups is impractical and goes against sampling principles. More interviews would still produce only testimonial evidence.
Key concept: at stage 2, auditors verify that controls are implemented and effective using objective records, not only design documents and interviews.

Question 3

During a stage 2 audit of an insurance broker, the auditor reviews the Statement of Applicability. It marks control 8.13 Information backup as included and implemented, and its justification refers to several risk register entries. The ISMS manager says that restore tests are performed quarterly. The auditor wants to confirm that the control selection really follows from the risk treatment process and is operating. What should the auditor do next?

Correct Answer: Select risk register entries treated by backups, trace them to the SoA entry, and examine records of the quarterly restore tests

Tracing selected risk register entries to the SoA justification confirms that including information backup results from the risk treatment process required by clause 6.1.3. Examining the quarterly restore test records then provides objective evidence that the control actually operates as claimed.
Accepting the ISMS manager's verbal statement is wrong because management approval of the SoA does not verify implementation, and auditors must corroborate claims with records. Comparing practices against ISO/IEC 27002 is wrong because that standard is guidance, not auditable requirements, so deviations from it are not nonconformities by themselves.
Key concept: audit trail from risk assessment through the SoA to objective evidence of control effectiveness.

More Conducting an ISO/IEC 27001 Audit questions
593 questions (total)
Practice 100 questions
One session at a time, always new questions