Managing an ISO/IEC 27001 Audit Program

Managing the ISMS audit program: follow-up, surveillance and recertification audits, changes to certification, PDCA in the audit program, audit resources and records, combined audits, auditor competence and performance, and professional auditor behavior.

5 minutes 5 Questions

Managing an ISO/IEC 27001 audit program means planning, coordinating and controlling a set of audits over a defined period, usually a three-year certification cycle, rather than running a single audit. The guidance comes mainly from ISO 19011 (clause 5), ISO/IEC 27007 for ISMS-specific auditing, an…

Concepts covered
Surveillance AuditsFirst-, Second- and Third-Party Audit ProgramsEstablishing an Audit ProgramPersonal Attributes and Behaviors of a Professional AuditorPDCA in Audit Program ManagementCombined AuditsAuditor CompetenceManagement and Protection of Audit RecordsRecertification AuditsAudit Follow-Up and Verification of Corrective ActionsTools Used by Professional AuditorsAudit Program Resources, Procedures and PoliciesQuality and Complaint Management in an Audit ProgramMonitoring Auditor and Audit Program PerformanceSpecial and Short-Notice AuditsExtension, Reduction, Suspension and Withdrawal of Certification
Test mode:
Start practice test

ISO 27001 LA - Managing an ISO/IEC 27001 Audit Program Example Questions

Test your knowledge of Managing an ISO/IEC 27001 Audit Program

Question 1

A cloud hosting provider has held ISO/IEC 27001 certification for three years. Over the last year it merged with a software firm, added two new sites and outsourced its data centre operations. As a result, the ISMS scope and several risk treatment decisions were revised. While planning the recertification audit, the audit team leader proposes stage 1 activities before evaluating implementation. The certification body's programme manager asks whether this proposal is justified. What is the best answer?

Correct Answer: Yes, because significant changes to the organization or its ISMS context can make stage 1 activities necessary at recertification

ISO/IEC 17021-1 and ISO/IEC 27006-1 state that where there have been significant changes to the management system, the organization, or the context in which the ISMS operates, such as a merger, new sites, outsourced operations, or a revised scope, a stage 1 audit may be required at recertification.
Claiming stage 1 belongs only to initial certification ignores this explicit provision for significant changes. Claiming every recertification must repeat the full stage 1 and stage 2 sequence is wrong, because stage 1 at recertification depends on the extent of change and is not automatic.
Key concept: recertification audit planning and when stage 1 is needed after significant changes.

Question 2

A software company holding ISO 9001 certification asks its certification body for a combined ISO 9001 and ISO/IEC 27001 stage 2 audit. In the draft audit plan, the audit team leader schedules one joint session per standard-shared topic, including the top management interview and the review of document control. The plan also assigns a quality auditor with no information security competence to evaluate the access control and logging controls listed in the Statement of Applicability, because these processes are shared with quality. Is the draft audit plan appropriate?

Correct Answer: Partly, because shared elements may be audited jointly, but each technical area needs an auditor competent in that discipline

The plan is only partly appropriate: combined audits may cover common elements such as top management interviews and document control in joint sessions, but ISO/IEC 27006 and ISO/IEC 17021-1 require the team to have competence in each technical area it evaluates, so access control and logging controls need an auditor with information security competence.
Claiming any single auditor can evaluate both standards ignores competence requirements; integration of processes does not transfer auditor competence.
Insisting on fully separate interviews and document reviews contradicts the efficiency principle that allows shared elements to be audited jointly.
Key concept: combined audit planning and audit team competence.

Question 3

At a regional hospital, the ISO/IEC 27001 internal audit programme manager explains her routine to the auditor. After each scheduled audit closes, she checks whether the audit met the programme objectives and timetable. She also collects auditee feedback and reviews each auditor's performance evaluation. So far she has made no changes to the programme. Applying ISO 19011, in which PDCA phase of audit programme management does this work belong?

Correct Answer: Check, because it monitors programme implementation and auditor performance against the programme objectives

ISO 19011 clause 5.6, monitoring the audit programme, is the Check phase. It covers evaluating whether schedules and programme objectives are achieved, assessing audit team performance and collecting auditee feedback, which is exactly what the manager does after each audit.
The Act option is wrong because Act (clause 5.7, reviewing and improving the audit programme) involves deciding on and making changes, and no changes have been made yet. The Do option is wrong because Do (clause 5.5, implementing the audit programme) covers conducting audits and managing their outcomes, not evaluating how well the programme is performing.
Key concept: PDCA mapping of ISO 19011 audit programme management, where monitoring is Check and review and improvement is Act.

More Managing an ISO/IEC 27001 Audit Program questions
251 questions (total)
Practice 100 questions
One session at a time, always new questions