Fundamental Audit Concepts and Principles

Audit concepts and principles from ISO 19011: first, second and third-party audits, the seven principles of auditing, professional ethics, irregularities and legal obligations, audit evidence types and sufficiency, and auditing outsourced operations and with big data.

5 minutes 5 Questions

In the ISO/IEC 27001 Lead Auditor context, fundamental audit concepts and principles come mainly from ISO 19011 (Guidelines for auditing management systems) and ISO/IEC 17021-1 (requirements for certification bodies). An audit is a systematic, independent and documented process for obtaining object…

Concepts covered
Risk-Based Approach to AuditingTypes of Audit EvidenceBig Data and Data Analytics in AuditsDetermining the Type and Amount of EvidenceFirst-, Second- and Third-Party AuditsAuditor Professional Responsibility and Code of EthicsIntegrity and Fair PresentationIrregularities and Illegal Acts Found During an AuditLaws and Regulations Applicable to the AuditeeEvidence-Based ApproachDue Professional Care and ConfidentialityAudit Concepts and Terminology (ISO 19011)Remote Auditing and Technology Trends in AuditingAudit Criteria, Findings and ConclusionsEthical Obligations to the Audit Client, Auditee and AuthoritiesAuditing Outsourced OperationsReliability and Sufficiency of Audit EvidenceIndependence and Impartiality of the Auditor
Test mode:
Start practice test

ISO 27001 LA - Fundamental Audit Concepts and Principles Example Questions

Test your knowledge of Fundamental Audit Concepts and Principles

Question 1

A logistics company's Statement of Applicability includes Annex A control 5.18 Access rights, which it implements through quarterly access reviews across forty systems in the ISMS scope. While preparing the stage 2 audit plan, the audit team leader notes two facts. The risk assessment rates the payment system as the highest risk, and a recent internal audit reported late reviews in two departments. Audit time is limited. How should the team leader plan the type and amount of evidence for this control?

Correct Answer: Weight the sample toward the payment system and the areas flagged internally, comparing review records against current system access listings.

Weighting the sample toward the highest-risk payment system and the departments with known late reviews focuses limited audit time where nonconformity is most likely and most significant. Comparing review records against current access listings also gives objective evidence of whether the control is effective, not just whether reviews were documented.
Examining every review for all forty systems is impractical within limited audit time, and audits rely on sampling rather than seeking complete assurance.
An equal random sample ignores the risk assessment and the internal audit results, so effort is wasted on low-risk areas.
Key concept: risk-based audit sampling, which uses risk and prior findings to decide the type and amount of evidence (ISO 19011 and ISO/IEC 27007).

Question 2

During a stage 2 audit of a regional hospital, the auditor finds records showing that patient data is exported to an external analytics provider with no contract or documented legal basis. The hospital's legal obligations for patient data fall within the ISMS scope. Concerned about the patients, the auditor emails the national data protection regulator that evening to report the export, before raising it with anyone else. Was the auditor's action appropriate?

Correct Answer: No, because the matter goes to the audit team leader and the audit client, with external disclosure only where law requires it

The auditor acted inappropriately. Under ISO 19011 confidentiality principles and ISO/IEC 17021-1, audit information may not be disclosed to third parties without the client's consent, unless the law requires it. Significant findings, including potential legal noncompliance, must be escalated to the audit team leader and communicated to the audit client.
The integrity principle does not create a general duty to report suspected breaches directly to a regulator. Doing so bypasses the confidentiality obligations and the defined audit communication process.
The opportunity-for-improvement option is also wrong. Legal obligations are within the ISMS scope, so the uncontrolled export is relevant to the audit criteria and is likely a nonconformity.
Key concept: auditor confidentiality and escalation of significant findings.

Question 3

An audit team leader is planning a one-day surveillance audit at a cloud hosting provider certified to ISO/IEC 27001:2022. Since the last audit, the organization has migrated its customer databases to a new platform and outsourced its security event monitoring. It has also closed a minor nonconformity raised on user access reviews. Time on site is limited. Which allocation of audit effort best reflects the risk-based approach to auditing?

Correct Answer: Weight the sample toward the platform migration, the outsourced monitoring arrangement and whether the access review corrective action proved effective.

Focusing on the platform migration, the outsourced monitoring and the effectiveness of the access review corrective action is correct because ISO 19011 requires audit effort to follow the risks and changes most likely to affect the ISMS and its intended outcomes. These areas carry the greatest uncertainty since the last audit.
Spreading effort evenly across the Statement of Applicability ignores risk and wastes limited time on stable, low-risk controls.
Weighting toward processes with the most documented information confuses volume of evidence with significance of risk.
Key concept: risk-based audit planning and sampling, prioritizing changes, outsourced processes and verification of corrective action effectiveness.

More Fundamental Audit Concepts and Principles questions
479 questions (total)
Practice 100 questions
One session at a time, always new questions